Sandro/linux
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-09-18 23:19:34 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity

net/rds: initialize i_conn_path in rds_inc_init()

Browse Source 
rds_inc_init() initializes every field of the embedded rds_incoming
except i_conn_path, and incomings are not zero-allocated (IB carves
them out of a slab cache).  The field therefore holds stale garbage
for incs created by rds_ib.

The loopback transport is different: rds_loop_xmit() re-runs
rds_inc_init() on the message's embedded inc after
rds_send_queue_rm() has already stored the connection path in it, so
there the field holds a live value rather than garbage, and a NULL
store would discard it.  Switch rds_loop_xmit() to
rds_inc_path_init() with the connection's single path, which is
exactly the value readers of the field reconstruct for a
non-multipath transport.

With loopback preserving the field, initialize it to NULL in
rds_inc_init() so that any future reader trips over a clean NULL
pointer instead of a stale one, and so the two init helpers
(rds_inc_init/rds_inc_path_init) leave the structure in an
equivalent, fully-initialized state.  Hardening only; no reader
dereferences i_conn_path for a non-multipath transport today.

This mirrors Oracle UEK commit "rds: rds_inc_init() should initialize
the inc->i_conn_path field".

Signed-off-by: William Kucharski <william.kucharski@oracle.com>
[achender: port to net-next; keep loopback's i_conn_path valid by
 switching rds_loop_xmit() to rds_inc_path_init(); update commit
 message]
Assisted-by: Claude-Code:claude-fable-5
Signed-off-by: Allison Henderson <achender@kernel.org>
Link: https://patch.msgid.link/20260809005103.82371-3-achender@kernel.org
Reviewed-by: Simon Horman <horms@kernel.org>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
This commit is contained in:
William Kucharski
2026-08-13 12:52:29 +02:00
committed by Paolo Abeni
parent a364a7c168
commit ff8376b245
2 changed files with 6 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
net/rds/loop.c
+5 -1
View File
@@ -89,7 +89,11 @@ static int rds_loop_xmit(struct rds_connection *conn, struct rds_message *rm,
BUG_ON(hdr_off || sg || off);
rds_inc_init(&rm->m_inc, conn, &conn->c_laddr);
/* rds_send_queue_rm() stored the connection path in this embedded
* inc; use the path init so the re-initialization keeps the field
* valid instead of discarding it.
*/
rds_inc_path_init(&rm->m_inc, &conn->c_path[0], &conn->c_laddr);
/* For the embedded inc. Matching put is in loop_inc_free() */
rds_message_addref(rm);
net/rds/recv.c
+1
View File
@@ -47,6 +47,7 @@ void rds_inc_init(struct rds_incoming *inc, struct rds_connection *conn,
refcount_set(&inc->i_refcount, 1);
INIT_LIST_HEAD(&inc->i_item);
inc->i_conn = conn;
inc->i_conn_path = NULL;
inc->i_saddr = *saddr;
inc->i_usercopy.rdma_cookie = 0;
inc->i_usercopy.rx_tstamp = ktime_set(0, 0);