linux/net/rds
Aohan Mei f97d8c7bab rds: ib: use rds_conn_drop() on protocol version mismatch
rds_ib_cm_connect_complete() runs from the RDMA-CM event handler with
conn->c_cm_lock held.  When the peer negotiates a protocol version
older than RDS_PROTOCOL_COMPAT_VERSION, the handler calls
rds_conn_destroy(), which is only safe in the rmmod path: it
synchronously tears the connection down and flush_work()es the
shutdown work cp_down_w.

That shutdown work (rds_conn_shutdown()) needs cp_cm_lock, which is
the very lock the event handler still holds, so the flush never
completes: the two workers wait on each other and the RDS connection
workqueues stall for good.

All other RDMA-CM failure paths (REJECTED, CONNECT_ERROR,
DISCONNECTED) use rds_conn_drop(), which marks the connection
RDS_CONN_ERROR and schedules the shutdown work asynchronously.  Use
it here as well.

Fixes: f147dd9eca ("RDS/IB: Disallow connections less than RDS 3.1")
Reported-by: TencentOS Corvus AI <corvus@tencent.com>
Cc: stable@vger.kernel.org
Reviewed-by: Allison Henderson <achender@kernel.org>
Signed-off-by: Aohan Mei <henrymei@tencent.com>
Link: https://patch.msgid.link/20260911073436.3542080-1-ljp1205831794@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-14 18:47:52 -07:00
..
af_rds.c rds: convert to getsockopt_iter 2026-06-11 12:19:05 +02:00
bind.c
cong.c net/rds: use wq_has_sleeper() in rds_cong_map_updated() 2026-08-24 12:03:25 -07:00
connection.c net/rds: don't let rds_conn_shutdown() consume a concurrent drop 2026-09-02 19:42:24 -07:00
ib_cm.c rds: ib: use rds_conn_drop() on protocol version mismatch 2026-09-14 18:47:52 -07:00
ib_frmr.c
ib_mr.h
ib_rdma.c net/rds: unpin MR pages with unpin_user_pages_dirty_lock() 2026-08-04 18:01:02 -07:00
ib_recv.c net/rds: acquire the fastpath locks in rds_conn_shutdown() 2026-09-02 19:42:23 -07:00
ib_ring.c
ib_send.c net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion 2026-06-09 18:32:54 -07:00
ib_stats.c
ib_sysctl.c
ib.c RDMA v7.3 merge window pull 2026-08-21 11:48:54 -07:00
ib.h net/rds: Optimize rds_ib_laddr_check 2026-04-12 13:33:19 -07:00
info.c treewide: refresh kmalloc_obj() conversions 2026-09-04 21:37:00 -07:00
info.h rds: convert to getsockopt_iter 2026-06-11 12:19:05 +02:00
Kconfig
loop.c net/rds: initialize i_conn_path in rds_inc_init() 2026-08-13 12:52:29 +02:00
loop.h
Makefile
message.c net/rds: fix tcp stream corruption with large pages 2026-09-10 08:19:17 -07:00
page.c
rdma_transport.c
rdma_transport.h
rdma.c net/rds: hold the socket while an rds_mr references it 2026-08-04 18:00:54 -07:00
rds_single_path.h
rds.h net/rds: hold the socket while an rds_mr references it 2026-08-04 18:00:54 -07:00
recv.c net/rds: clear i_rx_lat_trace in rds_inc_path_init() 2026-08-13 12:53:14 +02:00
send.c net/rds: acquire the fastpath locks in rds_conn_shutdown() 2026-09-02 19:42:23 -07:00
stats.c
sysctl.c
tcp_connect.c
tcp_listen.c net/rds: tcp: don't force RDS_CONN_RESETTING over a concurrent shutdown 2026-09-02 19:42:23 -07:00
tcp_recv.c net/rds: use special gfp_t format specifier 2026-05-28 21:04:53 -07:00
tcp_send.c
tcp_stats.c
tcp.c net/rds: don't let rds_conn_shutdown() consume a concurrent drop 2026-09-02 19:42:24 -07:00
tcp.h
threads.c
transport.c