mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/
synced 2026-11-10 20:48:12 +00:00
ff8376b245
rds_inc_init() initializes every field of the embedded rds_incoming except i_conn_path, and incomings are not zero-allocated (IB carves them out of a slab cache). The field therefore holds stale garbage for incs created by rds_ib. The loopback transport is different: rds_loop_xmit() re-runs rds_inc_init() on the message's embedded inc after rds_send_queue_rm() has already stored the connection path in it, so there the field holds a live value rather than garbage, and a NULL store would discard it. Switch rds_loop_xmit() to rds_inc_path_init() with the connection's single path, which is exactly the value readers of the field reconstruct for a non-multipath transport. With loopback preserving the field, initialize it to NULL in rds_inc_init() so that any future reader trips over a clean NULL pointer instead of a stale one, and so the two init helpers (rds_inc_init/rds_inc_path_init) leave the structure in an equivalent, fully-initialized state. Hardening only; no reader dereferences i_conn_path for a non-multipath transport today. This mirrors Oracle UEK commit "rds: rds_inc_init() should initialize the inc->i_conn_path field". Signed-off-by: William Kucharski <william.kucharski@oracle.com> [achender: port to net-next; keep loopback's i_conn_path valid by switching rds_loop_xmit() to rds_inc_path_init(); update commit message] Assisted-by: Claude-Code:claude-fable-5 Signed-off-by: Allison Henderson <achender@kernel.org> Link: https://patch.msgid.link/20260809005103.82371-3-achender@kernel.org Reviewed-by: Simon Horman <horms@kernel.org> Signed-off-by: Paolo Abeni <pabeni@redhat.com>
258 lines
7.3 KiB
258 lines
7.3 KiB