[PATCH net-next 0/6] net/rds: make connection lifetime reference-counted

Hi all,

This set is the next stage of the RDS stabilization work, following
"net/rds: own the fastpath locks across connection teardown", now
net-next.  This series is targeted to net-next as well. Though the 
series fixes real use-after-frees (one syzbot report and one report
from Chengfeng Ye below), it does so by reworking connection lifetime,
which is a substantial change.

rds_conn_destroy() frees the connection, its paths and its workqueues
on the spot, relying on the documented assumption that "no one else is
referencing the connection".  That assumption stopped being true a
long time ago.  Connections are destroyed not only on rmmod but also
on IB device removal and on protocol-version mismatch, while pointers
to them still live in socket rs_conn caches, congestion-map conn
lists, CM callbacks and workers, and - for as long as an application
leaves data unread - in every rds_incoming sitting on a receive
queue.  Each of those is a use-after-free waiting for its trigger, and
no single Fixes: commit covers the rot, so the series carries
Reported-by tags where there are concrete reports instead.

  Patch 1 gives the connection itself a destroy-in-progress marker so
  that rds_destroy_pending() covers single-connection destroy, not
  just the netns-teardown and module-unload cases.  Without it, the
  work-requeueing sites can re-arm works on a connection whose
  workqueues are about to be destroyed.
  Based on UEK commits:
     e2f5005adf63 net/rds: Add krefs to struct rds_connection
     https://github.com/oracle/linux-uek/commit/e2f5005adf63

     6c53ef92f46e net/rds: Merge uses of conn->c_destroy_in_prog & RDS_DESTROY_PENDING
     https://github.com/oracle/linux-uek/commit/6c53ef92f46e

  Patch 2 splits rds_conn_destroy() into a quiesce phase and a
  kref-governed free, so a connection with references still
  outstanding stays allocated (quiesced, unhashed and unusable) until
  the last reference is dropped.
  Based on UEK commits:
     2c8569e4c880 ("net/rds: Add krefs to struct rds_connection").
     https://github.com/oracle/linux-uek/commit/2c8569e4c880

  Patch 3 hands out real references everywhere a connection pointer
  previously escaped bare: rds_conn_lookup(), __rds_conn_create()'s
  return, the rs_conn sendmsg cache, and the parent's c_passive
  pointer.
  Based on UEK commits:
     2c8569e4c880 ("net/rds: Add krefs to struct rds_connection")
     https://github.com/oracle/linux-uek/commit/2c8569e4c880

     0e9e3a72b7f7 ("net/rds: rds_sendmsg must use rs_conn only when not being destroyed").
     https://github.com/oracle/linux-uek/commit/0e9e3a72b7f7

  Patch 4 makes each transport's exit path wait for its own
  connections to actually be freed before the module text goes away,
  since the free - including the transport's conn_free - is now
  asynchronous.
  Based on UEK commits:
     ece4b4e39afa ("net/rds: wait_event_timeout until zero connections during rmmod")
     https://github.com/oracle/linux-uek/commit/ece4b4e39afa

     905ec90e6166 ("net/rds: Each RDS transport should keep its own connection count")
     https://github.com/oracle/linux-uek/commit/905ec90e6166

  Patch 5 is the cleanup fallout of patch 4: the global rds_conn_count
  has no remaining consumer besides a workqueue-name seed, so switch
  the seed to the per-transport count and remove it.
  Based on UEK commits:
     905ec90e6166 ("net/rds: Each RDS transport should keep its own connection count").
     https://github.com/oracle/linux-uek/commit/905ec90e6166

  Patch 6 makes struct rds_incoming hold a reference on i_conn, which
  is the fix for the KASAN use-after-free Chengfeng Ye reported [1],
  where rds_info_getsockopt() walks a socket receive queue whose incs
  point at connections rmmod already freed.
  Based on UEK commits:
      99b9a3715419 ("net/rds: fix crash by expanding kref coverage to rds_incoming.i_conn").
      https://github.com/oracle/linux-uek/commit/99b9a3715419

Patches 2, 3, 4 and 6 are ports of the connection kref work Sharath
Srinivasan did for Oracle UEK, adapted to the upstream code.

The series has been validated with the RDS selftests over both
loopback-TCP and RXE-RDMA transports, plus targeted churn tests that
delete network namespaces and unload the modules under live rds-stress
traffic - the paths this series changes.

[1] https://lore.kernel.org/netdev/20260720184955.3008978-1-nicoyip.dev@gmail.com/ (local)

Allison


Allison Henderson (2):
  net/rds: make rds_destroy_pending() cover single-connection destroy
  net/rds: drop rds_conn_count in favor of t_conn_count

Sharath Srinivasan (4):
  net/rds: split connection destroy into quiesce and kref-governed free
  net/rds: hold connection references in lookup, sockets and c_passive
  net/rds: wait for connections to be freed on transport unload
  net/rds: hold a connection reference from struct rds_incoming

 net/rds/af_rds.c     |   8 ++
 net/rds/connection.c | 189 ++++++++++++++++++++++++++++++++++++++-----
 net/rds/ib.c         |  14 +++-
 net/rds/ib_cm.c      |   8 +-
 net/rds/loop.c       |   2 +
 net/rds/message.c    |  16 +++-
 net/rds/rds.h        |  25 +++++-
 net/rds/recv.c       |  21 ++++-
 net/rds/send.c       |  45 +++++++++--
 net/rds/tcp.c        |   1 +
 net/rds/tcp_listen.c |   5 +-
 11 files changed, 297 insertions(+), 37 deletions(-)

-- 
2.25.1