[PATCH net 1/1] net: rds: clear i_sends on setup unwind

[PATCH net 1/1] net: rds: clear i_sends on setup unwind

[Ren Wei]

From: Yuqi Xu <xuyq21@lenovo.com>

The RDS IB connection teardown path is written so it can run during
partial startup and on repeated shutdown attempts. It uses NULL
pointers to distinguish resources that are still owned from resources
that have already been released.

When rds_ib_setup_qp() fails after allocating i_sends but before
allocating i_recvs, the sends_out path frees i_sends without clearing
the pointer. A later shutdown pass can still treat that stale pointer
as a live send ring allocation.

Clear i_sends after vfree() in the error unwind path so the existing
shutdown logic continues to use the correct ownership state.

Fixes: 3b12f73a5c29 ("rds: ib: add error handle")
Cc: stable@kernel.org
Reported-by: Yuan Tan <yuantan098@gmail.com>
Reported-by: Zhengchuan Liang <zcliangcn@gmail.com>
Reported-by: Xin Liu <bird@lzu.edu.cn>
Assisted-by: Codex:GPT-5.4
Signed-off-by: Yuqi Xu <xuyq21@lenovo.com>
Signed-off-by: Ren Wei <n05ec@lzu.edu.cn>
---
 net/rds/ib_cm.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/net/rds/ib_cm.c b/net/rds/ib_cm.c
index 0c64c504f79d..4001de0c4959 100644
--- a/net/rds/ib_cm.c
+++ b/net/rds/ib_cm.c
@@ -656,6 +656,7 @@ static int rds_ib_setup_qp(struct rds_connection *conn)
 
 sends_out:
 	vfree(ic->i_sends);
+	ic->i_sends = NULL;
 
 ack_dma_out:
 	rds_dma_hdr_free(rds_ibdev->dev, ic->i_ack, ic->i_ack_dma,
-- 
2.54.0

Re: [PATCH net 1/1] net: rds: clear i_sends on setup unwind

[Allison Henderson]

On Fri, 2026-05-29 at 21:01 +0800, Ren Wei wrote:
> From: Yuqi Xu <xuyq21@lenovo.com>
> 
> The RDS IB connection teardown path is written so it can run during
> partial startup and on repeated shutdown attempts. It uses NULL
> pointers to distinguish resources that are still owned from resources
> that have already been released.
> 
> When rds_ib_setup_qp() fails after allocating i_sends but before
> allocating i_recvs, the sends_out path frees i_sends without clearing
> the pointer. A later shutdown pass can still treat that stale pointer
> as a live send ring allocation.
> 
> Clear i_sends after vfree() in the error unwind path so the existing
> shutdown logic continues to use the correct ownership state.
> 
> Fixes: 3b12f73a5c29 ("rds: ib: add error handle")
> Cc: stable@kernel.org
> Reported-by: Yuan Tan <yuantan098@gmail.com>
> Reported-by: Zhengchuan Liang <zcliangcn@gmail.com>
> Reported-by: Xin Liu <bird@lzu.edu.cn>
> Assisted-by: Codex:GPT-5.4
> Signed-off-by: Yuqi Xu <xuyq21@lenovo.com>
> Signed-off-by: Ren Wei <n05ec@lzu.edu.cn>

Hi Ren Wei,

Looks fine to me. Thanks for the catch!
Reviewed-by: Allison Henderson <achender@kernel.org>

Allison
> ---
>  net/rds/ib_cm.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/net/rds/ib_cm.c b/net/rds/ib_cm.c
> index 0c64c504f79d..4001de0c4959 100644
> --- a/net/rds/ib_cm.c
> +++ b/net/rds/ib_cm.c
> @@ -656,6 +656,7 @@ static int rds_ib_setup_qp(struct rds_connection *conn)
>  
>  sends_out:
>  	vfree(ic->i_sends);
> +	ic->i_sends = NULL;
>  
>  ack_dma_out:
>  	rds_dma_hdr_free(rds_ibdev->dev, ic->i_ack, ic->i_ack_dma,