[PATCH net-next v2 0/2] net/rds: Bug fix ports, part 2

[PATCH net-next v2 0/2] net/rds: Bug fix ports, part 2

[Allison Henderson]

Hi all,

This is the next batch of net/rds fixes ported from the Oracle UEK
kernel, following up on the first set now in net-next [1].  

This is v2 of patches 1 and 2 of "net/rds: Bug fix ports, part 2"
[2], which contained two initialization-hardening ports.  While
re-reviewing v1's patches 3 and 4 (the fastpath-lock teardown changes)
I found their locking needs more rework than a respin should carry, so
they are split out and will return as their own series together with
two companion fixes.  The two patches here are independent of them.

[PATCH net 1/2] net/rds: reinitialize to_be_dropped on rds_send_xmit() restart
  Port commit 7f52b9968d79 ("net/rds: rds_send_xmit should INIT_LIST_HEAD (&to_be_dropped) on restart")
  https://github.com/oracle/linux-uek/commit/7f52b9968d79 

[PATCH net 2/2] net/rds: initialize i_conn_path in rds_inc_init()
  Port commit 0ec6a520da4f ("rds: rds_inc_init() should initialize the inc->i_conn_path field")
  https://github.com/oracle/linux-uek/commit/0ec6a520da4f

Questions and comments appreciated!

Thanks,
Allison

v2:
  - Patch 1: the comment now names rds_send_remove_from_sock()
    instead of vaguely blaming "the callees", and the restart-time
    invariant is enforced with a WARN_ON_ONCE(): entries still on
    the list there would keep their message reference and their
    RDS_MSG_ON_SOCK accounting, so a silent re-init would orphan
    them.
  - Patch 2: for loopback the field held a live value written by
    rds_send_queue_rm(), not garbage; rds_loop_xmit() now uses
    rds_inc_path_init() so the re-initialization keeps it valid, and
    the commit message describes the two transports accurately.

[1] https://lore.kernel.org/netdev/20260730041629.3512480-1-achender@kernel.org/
[2] https://lore.kernel.org/netdev/20260806072045.1092968-1-achender@kernel.org/

Sharath Srinivasan (1):
  net/rds: reinitialize to_be_dropped on rds_send_xmit() restart

William Kucharski (1):
  net/rds: initialize i_conn_path in rds_inc_init()

 net/rds/loop.c | 6 +++++-
 net/rds/recv.c | 1 +
 net/rds/send.c | 8 ++++++++
 3 files changed, 14 insertions(+), 1 deletion(-)


base-commit: 4fa4977a0d900f936bcae5cd2c510be5554e8dd6
-- 
2.25.1

[PATCH net-next v2 1/2] net/rds: reinitialize to_be_dropped on rds_send_xmit() restart

[Allison Henderson]

From: Sharath Srinivasan <sharath.srinivasan@oracle.com>

The to_be_dropped list is declared once at the top of rds_send_xmit()
but the function can loop via "goto restart" after each batch.  The
code currently relies on rds_send_remove_from_sock() having emptied
the list entry by entry (via list_del_init()) at the end of the
previous batch; nothing in rds_send_xmit() itself guarantees the list
head is empty when a new batch starts.

Re-initialize the list on every restart, and warn once if it is ever
found non-empty there: entries left on the list at that point would
keep their message reference, their RDS_MSG_ON_SOCK accounting and
their pending RDS_RDMA_DROPPED notification, so a silent re-init
would orphan them.  This is hardening: no user-visible bug is known
in the current code.

This mirrors Oracle UEK commit "net/rds: rds_send_xmit should
INIT_LIST_HEAD(&to_be_dropped) on restart".

Signed-off-by: Gerd Rausch <gerd.rausch@oracle.com>
Signed-off-by: Sharath Srinivasan <sharath.srinivasan@oracle.com>
[achender: port to net-next (keep the existing LIST_HEAD declaration and
 add only the restart re-init); warn if the restart invariant is
 violated; update commit message]
Assisted-by: Claude-Code:claude-fable-5
Signed-off-by: Allison Henderson <achender@kernel.org>
---
v2: name rds_send_remove_from_sock() in the comment; warn once if the
restart-time empty-list invariant is ever violated.
v1: https://lore.kernel.org/netdev/20260806072045.1092968-2-achender@kernel.org/
 net/rds/send.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/net/rds/send.c b/net/rds/send.c
index 309021e0cc9b..15a1b97f13e7 100644
--- a/net/rds/send.c
+++ b/net/rds/send.c
@@ -200,6 +200,14 @@ int rds_send_xmit(struct rds_conn_path *cp)
 restart:
 	batch_count = 0;
 
+	/* The drop processing after over_batch relies on
+	 * rds_send_remove_from_sock() emptying to_be_dropped entry by
+	 * entry; warn if that post-condition ever stops holding, and
+	 * re-initialize the list head.
+	 */
+	WARN_ON_ONCE(!list_empty(&to_be_dropped));
+	INIT_LIST_HEAD(&to_be_dropped);
+
 	/*
 	 * sendmsg calls here after having queued its message on the send
 	 * queue.  We only have one task feeding the connection at a time.  If
-- 
2.25.1

[PATCH net-next v2 2/2] net/rds: initialize i_conn_path in rds_inc_init()

[Allison Henderson]

From: William Kucharski <william.kucharski@oracle.com>

rds_inc_init() initializes every field of the embedded rds_incoming
except i_conn_path, and incomings are not zero-allocated (IB carves
them out of a slab cache).  The field therefore holds stale garbage
for incs created by rds_ib.

The loopback transport is different: rds_loop_xmit() re-runs
rds_inc_init() on the message's embedded inc after
rds_send_queue_rm() has already stored the connection path in it, so
there the field holds a live value rather than garbage, and a NULL
store would discard it.  Switch rds_loop_xmit() to
rds_inc_path_init() with the connection's single path, which is
exactly the value readers of the field reconstruct for a
non-multipath transport.

With loopback preserving the field, initialize it to NULL in
rds_inc_init() so that any future reader trips over a clean NULL
pointer instead of a stale one, and so the two init helpers
(rds_inc_init/rds_inc_path_init) leave the structure in an
equivalent, fully-initialized state.  Hardening only; no reader
dereferences i_conn_path for a non-multipath transport today.

This mirrors Oracle UEK commit "rds: rds_inc_init() should initialize
the inc->i_conn_path field".

Signed-off-by: William Kucharski <william.kucharski@oracle.com>
[achender: port to net-next; keep loopback's i_conn_path valid by
 switching rds_loop_xmit() to rds_inc_path_init(); update commit
 message]
Assisted-by: Claude-Code:claude-fable-5
Signed-off-by: Allison Henderson <achender@kernel.org>
---
v2: keep loopback's i_conn_path valid by switching rds_loop_xmit() to
rds_inc_path_init(); rewrite the commit message - for loopback the
field held a live value, not garbage.
v1: https://lore.kernel.org/netdev/20260806072045.1092968-3-achender@kernel.org/
 net/rds/loop.c | 6 +++++-
 net/rds/recv.c | 1 +
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/net/rds/loop.c b/net/rds/loop.c
index ac9295a766b1..e6b0750bbeda 100644
--- a/net/rds/loop.c
+++ b/net/rds/loop.c
@@ -89,7 +89,11 @@ static int rds_loop_xmit(struct rds_connection *conn, struct rds_message *rm,
 
 	BUG_ON(hdr_off || sg || off);
 
-	rds_inc_init(&rm->m_inc, conn, &conn->c_laddr);
+	/* rds_send_queue_rm() stored the connection path in this embedded
+	 * inc; use the path init so the re-initialization keeps the field
+	 * valid instead of discarding it.
+	 */
+	rds_inc_path_init(&rm->m_inc, &conn->c_path[0], &conn->c_laddr);
 	/* For the embedded inc. Matching put is in loop_inc_free() */
 	rds_message_addref(rm);
 
diff --git a/net/rds/recv.c b/net/rds/recv.c
index cf3884d87931..f1513dfb2716 100644
--- a/net/rds/recv.c
+++ b/net/rds/recv.c
@@ -47,6 +47,7 @@ void rds_inc_init(struct rds_incoming *inc, struct rds_connection *conn,
 	refcount_set(&inc->i_refcount, 1);
 	INIT_LIST_HEAD(&inc->i_item);
 	inc->i_conn = conn;
+	inc->i_conn_path = NULL;
 	inc->i_saddr = *saddr;
 	inc->i_usercopy.rdma_cookie = 0;
 	inc->i_usercopy.rx_tstamp = ktime_set(0, 0);
-- 
2.25.1