Re: [linus:master] [sysctl] 8d75c338f0: BUG:KASAN:slab-use-after-free_in_touch_wq_lockdep_map

[Allison Henderson <achender@kernel.org>]

On Mon, 2026-10-19 at 17:35 +0200, Oleg Nesterov wrote:
> On 10/19, Oleg Nesterov wrote:

Hi Oleg, Joel,

Thanks for running this down.  Agreed we shouldn't just fail to init because
sysctl is off.  Some comments below:


> > 
> > But. rds_init() can also fail even if CONFIG_SYSCTL=y, after
> > rds_sysctl_init(), so to me this looks like a bug in net/rds/.
> > 
Yes that's a separate bug, so I'll send a separate fix for that.

> > 
> > In any case, I guess net/rds/ init paths should not fail if
> > CONFIG_SYSCTL=n ?
> 
> So I think that something like the uncompiled/untested patch below makes
> sense anyway even if doesn't fix all the potential problems with rds_wq.
> 
> What do you think?
> 
> Oleg.
> ---
> 
> diff --git a/net/rds/ib_sysctl.c b/net/rds/ib_sysctl.c
> index 2af678e71e3c..bccdb5c4df1d 100644
> --- a/net/rds/ib_sysctl.c
> +++ b/net/rds/ib_sysctl.c
> @@ -36,19 +36,10 @@
>  
>  #include "ib.h"
>  
> -static struct ctl_table_header *rds_ib_sysctl_hdr;
> -
>  unsigned long rds_ib_sysctl_max_send_wr = RDS_IB_DEFAULT_SEND_WR;
>  unsigned long rds_ib_sysctl_max_recv_wr = RDS_IB_DEFAULT_RECV_WR;
>  unsigned long rds_ib_sysctl_max_recv_allocation = (128 * 1024 * 1024) / RDS_FRAG_SIZE;
> -static unsigned long rds_ib_sysctl_max_wr_min = 1;
> -/* hardware will fail CQ creation long before this */
> -static unsigned long rds_ib_sysctl_max_wr_max = (u32)~0;
> -
>  unsigned long rds_ib_sysctl_max_unsig_wrs = 16;
> -static unsigned long rds_ib_sysctl_max_unsig_wr_min = 1;
> -static unsigned long rds_ib_sysctl_max_unsig_wr_max = 64;
> -
>  /*
>   * This sysctl does nothing.
>   *
> @@ -61,6 +52,14 @@ static unsigned long rds_ib_sysctl_max_unsig_wr_max = 64;
>   */
>  unsigned int rds_ib_sysctl_flow_control = 0;
>  
> +#ifdef CONFIG_SYSCTL
> +static unsigned long rds_ib_sysctl_max_wr_min = 1;
> +/* hardware will fail CQ creation long before this */
> +static unsigned long rds_ib_sysctl_max_wr_max = (u32)~0;
> +
> +static unsigned long rds_ib_sysctl_max_unsig_wr_min = 1;
> +static unsigned long rds_ib_sysctl_max_unsig_wr_max = 64;
> +
>  static struct ctl_table rds_ib_sysctl_table[] = {
>  	{
>  		.procname       = "max_send_wr",
> @@ -105,6 +104,8 @@ static struct ctl_table rds_ib_sysctl_table[] = {
>  	},
>  };
>  
> +static struct ctl_table_header *rds_ib_sysctl_hdr;
> +
>  void rds_ib_sysctl_exit(void)
>  {
>  	if (rds_ib_sysctl_hdr)
> @@ -118,3 +119,15 @@ int rds_ib_sysctl_init(void)
>  		return -ENOMEM;
>  	return 0;
>  }


The real rds_sysctl_init() also does the runtime setup of
rds_sysctl_reconnect_min_jiffies (msecs_to_jiffies(1)).  Without
it, the reconnect back off is lost.

Also, if register_net_sysctl_sz() returns NULL in rds_tcp_init_net(),
it fails as an -ENOMEM.  So RDS/TCP would still fail to come up with
CONFIG_SYSCTL=n.  A simpler fix might be to just handle the NULL at the
three call sites, e.g.:

        rds_sysctl_reg_table =
                register_net_sysctl(&init_net, "net/rds", rds_sysctl_rds_table);
        if (!rds_sysctl_reg_table && IS_ENABLED(CONFIG_SYSCTL))
                return -ENOMEM;

And same for rds_ib_sysctl_init() and rds_tcp_init_net().  The exit
paths are ok, since unregister_net_sysctl_table() is already a
no-op stub when sysctl is off.

Let me know if you want to respin or if you'd rather I send it.
Either way is fine with me.

Thanks
Allison

> +
> +#else
> +
> +void rds_ib_sysctl_exit(void)
> +{
> +}
> +
> +int rds_ib_sysctl_init(void)
> +{
> +	return 0;
> +}
> +#endif
> diff --git a/net/rds/sysctl.c b/net/rds/sysctl.c
> index 025f518a4349..a0673a41633a 100644
> --- a/net/rds/sysctl.c
> +++ b/net/rds/sysctl.c
> @@ -36,11 +36,6 @@
>  
>  #include "rds.h"
>  
> -static struct ctl_table_header *rds_sysctl_reg_table;
> -
> -static unsigned long rds_sysctl_reconnect_min = 1;
> -static unsigned long rds_sysctl_reconnect_max = ~0UL;
> -
>  unsigned long rds_sysctl_reconnect_min_jiffies;
>  unsigned long rds_sysctl_reconnect_max_jiffies = HZ;
>  
> @@ -49,6 +44,10 @@ unsigned int  rds_sysctl_max_unacked_bytes = (16 << 20);
>  
>  unsigned int rds_sysctl_ping_enable = 1;
>  
> +#ifdef CONFIG_SYSCTL
> +static unsigned long rds_sysctl_reconnect_min = 1;
> +static unsigned long rds_sysctl_reconnect_max = ~0UL;
> +
>  static struct ctl_table rds_sysctl_rds_table[] = {
>  	{
>  		.procname       = "reconnect_min_delay_ms",
> @@ -91,6 +90,8 @@ static struct ctl_table rds_sysctl_rds_table[] = {
>  	},
>  };
>  
> +static struct ctl_table_header *rds_sysctl_reg_table;
> +
>  void rds_sysctl_exit(void)
>  {
>  	unregister_net_sysctl_table(rds_sysctl_reg_table);
> @@ -107,3 +108,15 @@ int rds_sysctl_init(void)
>  		return -ENOMEM;
>  	return 0;
>  }
> +
> +#else
> +
> +void rds_sysctl_exit(void)
> +{
> +}
> +
> +int rds_sysctl_init(void)
> +{
> +	return 0;
> +}
> +#endif
>