Re: [PATCH net-next v9 09/13] net/rds: hold a connection reference from struct rds_incoming

[netdev-bot+sashiko@kernel.org]

Thank you for your contribution! Sashiko AI review found more severe
issue(s) in other patches of this series. This mail is only an FYI, in case
you want to address the nit picks below when you respin.

Low priority / nit picks for your consideration:

- [Low] The commit fixes a real use-after-free.

--

net/rds: hold a connection reference from struct rds_incoming

This commit makes every holder of rds_incoming->i_conn own a connection
reference. It takes the reference at the six places where i_conn is
assigned, and drops it from rds_inc_put() and from a new
rds_message_free() helper. It fixes a use-after-free where an inc on a
socket receive queue outlives the connection it points at, for example
after a transport unload.

Closes: https://lore.kernel.org/netdev/20260720184955.3008978-1-nicoyip.dev@gmail.com/

> This is not a stable candidate, and carries no Fixes: tag on purpose so
> that it is not picked up without the patches it depends on: reaching the
> use-after-free requires freeing a connection out from under a live
> socket, which needs CAP_SYS_MODULE, and the fix depends on the
> connection reference counting introduced earlier in this series.

[Severity: Low]
Does leaving out the Fixes: tag actually keep this patch out of stable?

AUTOSEL can pick a commit without a Fixes: tag. This one has a
Reported-by:, a Closes:, a KASAN splat and a panic trace, so it looks
like a likely AUTOSEL candidate.

Documentation/process/stable-kernel-rules.rst has a tag for this case.
It tells both AUTOSEL and the scripts that look for Fixes: tags to
ignore a change:

    Cc: <stable+noautosel@kernel.org> # reason goes here, and must be present

Could this patch keep the Fixes: tag and add that Cc line with the
dependency explanation as the reason? That would keep the record of
which commit introduced the bug and still keep the patch out of stable.

A later commit in this series, "net/rds: hold connection references in
lookup, sockets and c_passive", gives the same reason for dropping
Fixes:. Should the noautosel Cc be used there as well?

-- 
Sashiko AI review · https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20261008031333.1142174-1-achender%40kernel.org