Re: [PATCH net 1/1] net: rds: clear i_sends on setup unwind

[Allison Henderson <achender@kernel.org>]

On Fri, 2026-05-29 at 21:01 +0800, Ren Wei wrote:
> From: Yuqi Xu <xuyq21@lenovo.com>
> 
> The RDS IB connection teardown path is written so it can run during
> partial startup and on repeated shutdown attempts. It uses NULL
> pointers to distinguish resources that are still owned from resources
> that have already been released.
> 
> When rds_ib_setup_qp() fails after allocating i_sends but before
> allocating i_recvs, the sends_out path frees i_sends without clearing
> the pointer. A later shutdown pass can still treat that stale pointer
> as a live send ring allocation.
> 
> Clear i_sends after vfree() in the error unwind path so the existing
> shutdown logic continues to use the correct ownership state.
> 
> Fixes: 3b12f73a5c29 ("rds: ib: add error handle")
> Cc: stable@kernel.org
> Reported-by: Yuan Tan <yuantan098@gmail.com>
> Reported-by: Zhengchuan Liang <zcliangcn@gmail.com>
> Reported-by: Xin Liu <bird@lzu.edu.cn>
> Assisted-by: Codex:GPT-5.4
> Signed-off-by: Yuqi Xu <xuyq21@lenovo.com>
> Signed-off-by: Ren Wei <n05ec@lzu.edu.cn>

Hi Ren Wei,

Looks fine to me. Thanks for the catch!
Reviewed-by: Allison Henderson <achender@kernel.org>

Allison
> ---
>  net/rds/ib_cm.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/net/rds/ib_cm.c b/net/rds/ib_cm.c
> index 0c64c504f79d..4001de0c4959 100644
> --- a/net/rds/ib_cm.c
> +++ b/net/rds/ib_cm.c
> @@ -656,6 +656,7 @@ static int rds_ib_setup_qp(struct rds_connection *conn)
>  
>  sends_out:
>  	vfree(ic->i_sends);
> +	ic->i_sends = NULL;
>  
>  ack_dma_out:
>  	rds_dma_hdr_free(rds_ibdev->dev, ic->i_ack, ic->i_ack_dma,