[PATCH net-next v6 01/12] net/rds: ib: don't enable interrupts in rds_ib_conn_free()
flat view
COLD15d
From: Allison Henderson <achender@kernel.org>
Date: 2026-09-22 08:54:12
Also in:
linux-rdma
Subsystem:
networking [general], rds - reliable datagram sockets, the rest · Maintainers:
"David S. Miller", Eric Dumazet, Jakub Kicinski, Paolo Abeni, Allison Henderson, Linus Torvalds
Revision v6 of 4 in this series.
Revisions (4)
- v1 [diff vs current]
- v2 [diff vs current]
- v6 current
- v8 [diff vs current]
rds_ib_conn_free() unlinks the connection from its device or nodev
list under spin_lock_irq()/spin_unlock_irq(). It is not only called
from the rmmod path, though: __rds_conn_create() calls
trans->conn_free() to undo a lost creation race while it still holds
rds_conn_lock, taken with spin_lock_irqsave(). The unconditional
spin_unlock_irq() then re-enables interrupts with rds_conn_lock held
and leaves them enabled when the caller's spin_unlock_irqrestore()
runs, defeating the irqsave the caller relied on.
Use the irqsave/irqrestore pair, as rds_tcp_conn_free() and
rds_loop_conn_free() already do.
Fixes: 745cbccac3fe ("RDS: Rewrite connection cleanup, fixing oops on rmmod")
Assisted-by: Claude-Code:claude-fable-5
Signed-off-by: Allison Henderson <achender@kernel.org>
---
net/rds/ib_cm.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
diff --git a/net/rds/ib_cm.c b/net/rds/ib_cm.c
index 6e3110a04ae6..53147793d44b 100644
--- a/net/rds/ib_cm.c
+++ b/net/rds/ib_cm.c@@ -1271,6 +1271,7 @@ void rds_ib_conn_free(void *arg) { struct rds_ib_connection *ic = arg; spinlock_t *lock_ptr; + unsigned long flags; rdsdebug("ic %p\n", ic);
@@ -1278,12 +1279,16 @@ void rds_ib_conn_free(void *arg) * Conn is either on a dev's list or on the nodev list. * A race with shutdown() or connect() would cause problems * (since rds_ibdev would change) but that should never happen. + * + * Callers may hold rds_conn_lock with interrupts disabled + * (__rds_conn_create() undoing a lost creation race), so do not + * re-enable interrupts unconditionally here. */ lock_ptr = ic->rds_ibdev ? &ic->rds_ibdev->spinlock : &ib_nodev_conns_lock; - spin_lock_irq(lock_ptr); + spin_lock_irqsave(lock_ptr, flags); list_del(&ic->ib_node); - spin_unlock_irq(lock_ptr); + spin_unlock_irqrestore(lock_ptr, flags); rds_ib_recv_free_caches(ic);
--
2.25.1