[PATCH net-next v2 2/2] net/rds: initialize i_conn_path in rds_inc_init()

[Allison Henderson <achender@kernel.org>]

From: William Kucharski <william.kucharski@oracle.com>

rds_inc_init() initializes every field of the embedded rds_incoming
except i_conn_path, and incomings are not zero-allocated (IB carves
them out of a slab cache).  The field therefore holds stale garbage
for incs created by rds_ib.

The loopback transport is different: rds_loop_xmit() re-runs
rds_inc_init() on the message's embedded inc after
rds_send_queue_rm() has already stored the connection path in it, so
there the field holds a live value rather than garbage, and a NULL
store would discard it.  Switch rds_loop_xmit() to
rds_inc_path_init() with the connection's single path, which is
exactly the value readers of the field reconstruct for a
non-multipath transport.

With loopback preserving the field, initialize it to NULL in
rds_inc_init() so that any future reader trips over a clean NULL
pointer instead of a stale one, and so the two init helpers
(rds_inc_init/rds_inc_path_init) leave the structure in an
equivalent, fully-initialized state.  Hardening only; no reader
dereferences i_conn_path for a non-multipath transport today.

This mirrors Oracle UEK commit "rds: rds_inc_init() should initialize
the inc->i_conn_path field".

Signed-off-by: William Kucharski <william.kucharski@oracle.com>
[achender: port to net-next; keep loopback's i_conn_path valid by
 switching rds_loop_xmit() to rds_inc_path_init(); update commit
 message]
Assisted-by: Claude-Code:claude-fable-5
Signed-off-by: Allison Henderson <achender@kernel.org>
---
v2: keep loopback's i_conn_path valid by switching rds_loop_xmit() to
rds_inc_path_init(); rewrite the commit message - for loopback the
field held a live value, not garbage.
v1: https://lore.kernel.org/netdev/20260806072045.1092968-3-achender@kernel.org/
 net/rds/loop.c | 6 +++++-
 net/rds/recv.c | 1 +
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/net/rds/loop.c b/net/rds/loop.c
index ac9295a766b1..e6b0750bbeda 100644
--- a/net/rds/loop.c
+++ b/net/rds/loop.c
@@ -89,7 +89,11 @@ static int rds_loop_xmit(struct rds_connection *conn, struct rds_message *rm,
 
 	BUG_ON(hdr_off || sg || off);
 
-	rds_inc_init(&rm->m_inc, conn, &conn->c_laddr);
+	/* rds_send_queue_rm() stored the connection path in this embedded
+	 * inc; use the path init so the re-initialization keeps the field
+	 * valid instead of discarding it.
+	 */
+	rds_inc_path_init(&rm->m_inc, &conn->c_path[0], &conn->c_laddr);
 	/* For the embedded inc. Matching put is in loop_inc_free() */
 	rds_message_addref(rm);
 
diff --git a/net/rds/recv.c b/net/rds/recv.c
index cf3884d87931..f1513dfb2716 100644
--- a/net/rds/recv.c
+++ b/net/rds/recv.c
@@ -47,6 +47,7 @@ void rds_inc_init(struct rds_incoming *inc, struct rds_connection *conn,
 	refcount_set(&inc->i_refcount, 1);
 	INIT_LIST_HEAD(&inc->i_item);
 	inc->i_conn = conn;
+	inc->i_conn_path = NULL;
 	inc->i_saddr = *saddr;
 	inc->i_usercopy.rdma_cookie = 0;
 	inc->i_usercopy.rx_tstamp = ktime_set(0, 0);
-- 
2.25.1