From fbea154a86641d2543a871aa19f7c77a366de542 Mon Sep 17 00:00:00 2001 From: Allison Henderson Date: Wed, 21 Oct 2026 12:58:36 -0700 Subject: [PATCH 1/2] net/rds: do not fail init when CONFIG_SYSCTL=n With CONFIG_SYSCTL=n, register_net_sysctl() and register_net_sysctl_sz() are inline stubs that return NULL. rds_sysctl_init(), rds_ib_sysctl_init() and rds_tcp_init_net() all treat that NULL as -ENOMEM, so RDS refuses to initialize at all even though every tunable has a sane compiled-in default. When RDS is built in, that is worse than a missing feature: the failed rds_init() destroys rds_wq, but the rds_rdma initcall still runs, and when rds_ib_sysctl_init() fails the same way, the error path in rds_ib_init() flushes the already freed workqueue: BUG: KASAN: slab-use-after-free in touch_wq_lockdep_map ... __flush_workqueue rds_ib_init rds_rdma_init ... Allocated by task 1: alloc_workqueue_noprof rds_threads_init rds_init ... Freed by task 0: kfree rcu_do_batch Only treat the NULL return as a failure when sysctl support is actually compiled in. The exit paths need no change: unregister_net_sysctl_table() is an empty stub with CONFIG_SYSCTL=n and already tolerates a NULL header otherwise. The underlying problem of built-in transports initializing after rds_init() has failed is independent of sysctl and is addressed separately. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-lkp/202610190310.9737b2e3-lkp@intel.com Fixes: 3e5048495c85 ("RDS: sysctls") Fixes: e6babe4cc4ce ("RDS/IB: Stats and sysctls") Fixes: c6a58ffed536 ("RDS: TCP: Add sysctl tunables for sndbuf/rcvbuf on rds-tcp socket") Suggested-by: Joel Granados Signed-off-by: Allison Henderson Reviewed-by: Joel Granados Acked-by: Oleg Nesterov Link: https://patch.msgid.link/20261021195837.142802-2-achender@kernel.org Signed-off-by: Paolo Abeni --- net/rds/ib_sysctl.c | 2 +- net/rds/sysctl.c | 2 +- net/rds/tcp.c | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/net/rds/ib_sysctl.c b/net/rds/ib_sysctl.c index 2af678e71e3c..bc97a3eecad6 100644 --- a/net/rds/ib_sysctl.c +++ b/net/rds/ib_sysctl.c @@ -114,7 +114,7 @@ void rds_ib_sysctl_exit(void) int rds_ib_sysctl_init(void) { rds_ib_sysctl_hdr = register_net_sysctl(&init_net, "net/rds/ib", rds_ib_sysctl_table); - if (!rds_ib_sysctl_hdr) + if (!rds_ib_sysctl_hdr && IS_ENABLED(CONFIG_SYSCTL)) return -ENOMEM; return 0; } diff --git a/net/rds/sysctl.c b/net/rds/sysctl.c index 025f518a4349..968d6279bbd3 100644 --- a/net/rds/sysctl.c +++ b/net/rds/sysctl.c @@ -103,7 +103,7 @@ int rds_sysctl_init(void) rds_sysctl_reg_table = register_net_sysctl(&init_net, "net/rds", rds_sysctl_rds_table); - if (!rds_sysctl_reg_table) + if (!rds_sysctl_reg_table && IS_ENABLED(CONFIG_SYSCTL)) return -ENOMEM; return 0; } diff --git a/net/rds/tcp.c b/net/rds/tcp.c index 774a71f88d37..34815b4f658b 100644 --- a/net/rds/tcp.c +++ b/net/rds/tcp.c @@ -637,7 +637,7 @@ static __net_init int rds_tcp_init_net(struct net *net) tbl[RDS_TCP_RCVBUF].data = &rtn->rcvbuf_size; rtn->rds_tcp_sysctl = register_net_sysctl_sz(net, "net/rds/tcp", tbl, ARRAY_SIZE(rds_tcp_sysctl_table)); - if (!rtn->rds_tcp_sysctl) { + if (!rtn->rds_tcp_sysctl && IS_ENABLED(CONFIG_SYSCTL)) { pr_warn("could not register sysctl\n"); err = -ENOMEM; goto fail; From ffbbc315b8b883a1c0e131fb3186b9428d2812aa Mon Sep 17 00:00:00 2001 From: Allison Henderson Date: Wed, 21 Oct 2026 12:58:37 -0700 Subject: [PATCH 2/2] net/rds: do not initialize transports after rds_init() failed rds, rds_rdma and rds_tcp each have their own module_init(). When they are built in, those run in link order, so rds_init() goes first, but do_initcalls() does not stop when it fails. The transports then initialize against a core that has already been torn down: rds_wq has been destroyed, yet rds_ib_dev_put(), rds_ib_unregister_client() and rds_tcp_accept_work() still queue onto or flush it, and rds_trans_register() hands the transports to a core whose socket family may never have been registered. This was seen with CONFIG_SYSCTL=n, where rds_sysctl_init() failed and rds_ib_init()'s error path then flushed the freed rds_wq [1], but any rds_init() failure after rds_threads_init() has the same effect. Record whether rds_init() succeeded and have rds_rdma_init() and rds_tcp_init() bail out with -ENODEV otherwise. Modular builds are unaffected: the transports need symbols exported by rds.ko, so they cannot be loaded unless rds_init() succeeded. [1] https://lore.kernel.org/oe-lkp/202610190310.9737b2e3-lkp@intel.com Fixes: 55b7ed0b582f ("RDS: Common RDMA transport code") Fixes: 70041088e3b9 ("RDS: Add TCP transport to RDS") Suggested-by: Oleg Nesterov Signed-off-by: Allison Henderson Link: https://patch.msgid.link/20261021195837.142802-3-achender@kernel.org Signed-off-by: Paolo Abeni --- net/rds/af_rds.c | 14 ++++++++++++++ net/rds/rdma_transport.c | 3 +++ net/rds/rds.h | 1 + net/rds/tcp.c | 3 +++ 4 files changed, 21 insertions(+) diff --git a/net/rds/af_rds.c b/net/rds/af_rds.c index e84d00bbe9a1..fb6b8ddb2d11 100644 --- a/net/rds/af_rds.c +++ b/net/rds/af_rds.c @@ -925,8 +925,11 @@ static void rds6_sock_info(struct socket *sock, unsigned int len, } #endif +static bool rds_initialized; + static void rds_exit(void) { + rds_initialized = false; sock_unregister(rds_family_ops.family); proto_unregister(&rds_proto); rds_conn_exit(); @@ -947,6 +950,16 @@ module_exit(rds_exit); u32 rds_gen_num; +/* When RDS is built in, a failed rds_init() does not stop the rds_rdma + * and rds_tcp initcalls from running against a core that has already + * been torn down (rds_wq in particular). Let them bail out early. + */ +bool rds_is_initialized(void) +{ + return rds_initialized; +} +EXPORT_SYMBOL_GPL(rds_is_initialized); + static int __init rds_init(void) { int ret; @@ -983,6 +996,7 @@ static int __init rds_init(void) rds_info_register_func(RDS6_INFO_SOCKETS, rds6_sock_info); rds_info_register_func(RDS6_INFO_RECV_MESSAGES, rds6_sock_inc_info); #endif + rds_initialized = true; goto out; diff --git a/net/rds/rdma_transport.c b/net/rds/rdma_transport.c index 12559a8ca912..75532734c054 100644 --- a/net/rds/rdma_transport.c +++ b/net/rds/rdma_transport.c @@ -336,6 +336,9 @@ static int __init rds_rdma_init(void) { int ret; + if (!rds_is_initialized()) + return -ENODEV; + ret = rds_ib_init(); if (ret) goto out; diff --git a/net/rds/rds.h b/net/rds/rds.h index 9b1ffc49c0a6..e3937c1ff3a1 100644 --- a/net/rds/rds.h +++ b/net/rds/rds.h @@ -1042,6 +1042,7 @@ extern unsigned int rds_sysctl_trace_level; int rds_threads_init(void); void rds_threads_exit(void); extern struct workqueue_struct *rds_wq; +bool rds_is_initialized(void); void rds_queue_reconnect(struct rds_conn_path *cp); void rds_connect_worker(struct work_struct *); void rds_shutdown_worker(struct work_struct *); diff --git a/net/rds/tcp.c b/net/rds/tcp.c index 34815b4f658b..c1ad37505417 100644 --- a/net/rds/tcp.c +++ b/net/rds/tcp.c @@ -815,6 +815,9 @@ static int __init rds_tcp_init(void) { int ret; + if (!rds_is_initialized()) + return -ENODEV; + rds_tcp_conn_slab = KMEM_CACHE(rds_tcp_connection, 0); if (!rds_tcp_conn_slab) { ret = -ENOMEM;