From ffbbc315b8b883a1c0e131fb3186b9428d2812aa Mon Sep 17 00:00:00 2001 From: Allison Henderson Date: Wed, 21 Oct 2026 12:58:37 -0700 Subject: [PATCH] net/rds: do not initialize transports after rds_init() failed rds, rds_rdma and rds_tcp each have their own module_init(). When they are built in, those run in link order, so rds_init() goes first, but do_initcalls() does not stop when it fails. The transports then initialize against a core that has already been torn down: rds_wq has been destroyed, yet rds_ib_dev_put(), rds_ib_unregister_client() and rds_tcp_accept_work() still queue onto or flush it, and rds_trans_register() hands the transports to a core whose socket family may never have been registered. This was seen with CONFIG_SYSCTL=n, where rds_sysctl_init() failed and rds_ib_init()'s error path then flushed the freed rds_wq [1], but any rds_init() failure after rds_threads_init() has the same effect. Record whether rds_init() succeeded and have rds_rdma_init() and rds_tcp_init() bail out with -ENODEV otherwise. Modular builds are unaffected: the transports need symbols exported by rds.ko, so they cannot be loaded unless rds_init() succeeded. [1] https://lore.kernel.org/oe-lkp/202610190310.9737b2e3-lkp@intel.com Fixes: 55b7ed0b582f ("RDS: Common RDMA transport code") Fixes: 70041088e3b9 ("RDS: Add TCP transport to RDS") Suggested-by: Oleg Nesterov Signed-off-by: Allison Henderson Link: https://patch.msgid.link/20261021195837.142802-3-achender@kernel.org Signed-off-by: Paolo Abeni --- net/rds/af_rds.c | 14 ++++++++++++++ net/rds/rdma_transport.c | 3 +++ net/rds/rds.h | 1 + net/rds/tcp.c | 3 +++ 4 files changed, 21 insertions(+) diff --git a/net/rds/af_rds.c b/net/rds/af_rds.c index e84d00bbe9a1..fb6b8ddb2d11 100644 --- a/net/rds/af_rds.c +++ b/net/rds/af_rds.c @@ -925,8 +925,11 @@ static void rds6_sock_info(struct socket *sock, unsigned int len, } #endif +static bool rds_initialized; + static void rds_exit(void) { + rds_initialized = false; sock_unregister(rds_family_ops.family); proto_unregister(&rds_proto); rds_conn_exit(); @@ -947,6 +950,16 @@ module_exit(rds_exit); u32 rds_gen_num; +/* When RDS is built in, a failed rds_init() does not stop the rds_rdma + * and rds_tcp initcalls from running against a core that has already + * been torn down (rds_wq in particular). Let them bail out early. + */ +bool rds_is_initialized(void) +{ + return rds_initialized; +} +EXPORT_SYMBOL_GPL(rds_is_initialized); + static int __init rds_init(void) { int ret; @@ -983,6 +996,7 @@ static int __init rds_init(void) rds_info_register_func(RDS6_INFO_SOCKETS, rds6_sock_info); rds_info_register_func(RDS6_INFO_RECV_MESSAGES, rds6_sock_inc_info); #endif + rds_initialized = true; goto out; diff --git a/net/rds/rdma_transport.c b/net/rds/rdma_transport.c index 12559a8ca912..75532734c054 100644 --- a/net/rds/rdma_transport.c +++ b/net/rds/rdma_transport.c @@ -336,6 +336,9 @@ static int __init rds_rdma_init(void) { int ret; + if (!rds_is_initialized()) + return -ENODEV; + ret = rds_ib_init(); if (ret) goto out; diff --git a/net/rds/rds.h b/net/rds/rds.h index 9b1ffc49c0a6..e3937c1ff3a1 100644 --- a/net/rds/rds.h +++ b/net/rds/rds.h @@ -1042,6 +1042,7 @@ extern unsigned int rds_sysctl_trace_level; int rds_threads_init(void); void rds_threads_exit(void); extern struct workqueue_struct *rds_wq; +bool rds_is_initialized(void); void rds_queue_reconnect(struct rds_conn_path *cp); void rds_connect_worker(struct work_struct *); void rds_shutdown_worker(struct work_struct *); diff --git a/net/rds/tcp.c b/net/rds/tcp.c index 34815b4f658b..c1ad37505417 100644 --- a/net/rds/tcp.c +++ b/net/rds/tcp.c @@ -815,6 +815,9 @@ static int __init rds_tcp_init(void) { int ret; + if (!rds_is_initialized()) + return -ENODEV; + rds_tcp_conn_slab = KMEM_CACHE(rds_tcp_connection, 0); if (!rds_tcp_conn_slab) { ret = -ENOMEM;