Merge branch 'net-rds-fix-init-failures-leaving-built-in-transports-on-a-dead-core'

Allison Henderson says:

====================
net/rds: fix init failures leaving built-in transports on a dead core

The kernel test robot hit a slab-use-after-free on rds_wq at boot with
CONFIG_SYSCTL=n and RDS, RDS_RDMA and RDS_TCP built in [1].  Two
separate bugs are involved.

With CONFIG_SYSCTL=n, register_net_sysctl() is a stub that returns
NULL, and RDS treats that as -ENOMEM, so rds_init() fails even though
every tunable has a usable default.  Patch 1 only treats NULL as a
failure when sysctl support is built in.

Second, when RDS is built in, a failed rds_init() does not stop the
rds_rdma and rds_tcp initcalls.  They run against a core that has
already been torn down and queue onto or flush the freed rds_wq.  The
error path of rds_ib_init() did this in the robot's report.  The
rds_tcp listen socket can also do it when an incoming connection
arrives.  Patch 2 makes both transports bail out with -ENODEV unless
rds_init() succeeded.  Modular builds can't hit this, because the
transports need symbols from rds.ko.

Thanks to Oleg Nesterov and Joel Granados for the analysis in [2].

Testing: x86_64 under virtme-ng, built in RDS/RDS_RDMA/RDS_TCP,
CONFIG_SYSCTL=n, KASAN, booted with initcall_debug:
  - net/main: rds_init() returns -ENOMEM, then rds_rdma_init() hits
    KASAN slab-use-after-free in __flush_workqueue() from rds_ib_init(),
    reproducing [1].
  - patch 2 only: rds_init() still returns -ENOMEM; rds_rdma_init() and
    rds_tcp_init() return -ENODEV and the boot completes cleanly.
  - both patches: rds_init(), rds_rdma_init() and rds_tcp_init() all
    return 0, no KASAN reports.

[1] https://lore.kernel.org/oe-lkp/202610190310.9737b2e3-lkp@intel.com
[2] https://lore.kernel.org/all/atdoGiW_sHlWgOwt@redhat.com/
====================

Link: https://patch.msgid.link/20261021195837.142802-1-achender@kernel.org
Signed-off-by: Paolo Abeni <pabeni@redhat.com>

net/rds/af_rds.c

@@ -925,8 +925,11 @@ static void rds6_sock_info(struct socket *sock, unsigned int len,
 }
 #endif
 
+static bool rds_initialized;
+
 static void rds_exit(void)
 {
+	rds_initialized = false;
 	sock_unregister(rds_family_ops.family);
 	proto_unregister(&rds_proto);
 	rds_conn_exit();
@@ -947,6 +950,16 @@ module_exit(rds_exit);
 
 u32 rds_gen_num;
 
+/* When RDS is built in, a failed rds_init() does not stop the rds_rdma
+ * and rds_tcp initcalls from running against a core that has already
+ * been torn down (rds_wq in particular).  Let them bail out early.
+ */
+bool rds_is_initialized(void)
+{
+	return rds_initialized;
+}
+EXPORT_SYMBOL_GPL(rds_is_initialized);
+
 static int __init rds_init(void)
 {
 	int ret;
@@ -983,6 +996,7 @@ static int __init rds_init(void)
 	rds_info_register_func(RDS6_INFO_SOCKETS, rds6_sock_info);
 	rds_info_register_func(RDS6_INFO_RECV_MESSAGES, rds6_sock_inc_info);
 #endif
+	rds_initialized = true;
 
 	goto out;
 

net/rds/ib_sysctl.c

@@ -114,7 +114,7 @@ void rds_ib_sysctl_exit(void)
 int rds_ib_sysctl_init(void)
 {
 	rds_ib_sysctl_hdr = register_net_sysctl(&init_net, "net/rds/ib", rds_ib_sysctl_table);
-	if (!rds_ib_sysctl_hdr)
+	if (!rds_ib_sysctl_hdr && IS_ENABLED(CONFIG_SYSCTL))
 		return -ENOMEM;
 	return 0;
 }

net/rds/rdma_transport.c

@@ -336,6 +336,9 @@ static int __init rds_rdma_init(void)
 {
 	int ret;
 
+	if (!rds_is_initialized())
+		return -ENODEV;
+
 	ret = rds_ib_init();
 	if (ret)
 		goto out;

net/rds/rds.h

@@ -1042,6 +1042,7 @@ extern unsigned int  rds_sysctl_trace_level;
 int rds_threads_init(void);
 void rds_threads_exit(void);
 extern struct workqueue_struct *rds_wq;
+bool rds_is_initialized(void);
 void rds_queue_reconnect(struct rds_conn_path *cp);
 void rds_connect_worker(struct work_struct *);
 void rds_shutdown_worker(struct work_struct *);

net/rds/sysctl.c

@@ -103,7 +103,7 @@ int rds_sysctl_init(void)
 
 	rds_sysctl_reg_table =
 		register_net_sysctl(&init_net, "net/rds", rds_sysctl_rds_table);
-	if (!rds_sysctl_reg_table)
+	if (!rds_sysctl_reg_table && IS_ENABLED(CONFIG_SYSCTL))
 		return -ENOMEM;
 	return 0;
 }

net/rds/tcp.c

@@ -637,7 +637,7 @@ static __net_init int rds_tcp_init_net(struct net *net)
 	tbl[RDS_TCP_RCVBUF].data = &rtn->rcvbuf_size;
 	rtn->rds_tcp_sysctl = register_net_sysctl_sz(net, "net/rds/tcp", tbl,
 						     ARRAY_SIZE(rds_tcp_sysctl_table));
-	if (!rtn->rds_tcp_sysctl) {
+	if (!rtn->rds_tcp_sysctl && IS_ENABLED(CONFIG_SYSCTL)) {
 		pr_warn("could not register sysctl\n");
 		err = -ENOMEM;
 		goto fail;
@@ -815,6 +815,9 @@ static int __init rds_tcp_init(void)
 {
 	int ret;
 
+	if (!rds_is_initialized())
+		return -ENODEV;
+
 	rds_tcp_conn_slab = KMEM_CACHE(rds_tcp_connection, 0);
 	if (!rds_tcp_conn_slab) {
 		ret = -ENOMEM;