Re: [linus:master] [sysctl] 8d75c338f0: BUG:KASAN:slab-use-after-free_in_touch_wq_lockdep_map

[Joel Granados <joel.granados@kernel.org>]

[-- Attachment #1: Type: text/plain, Size: 5489 bytes --]

On Mon, Oct 19, 2026 at 12:52:58PM -0700, Allison Henderson wrote:
> On Mon, 2026-10-19 at 17:35 +0200, Oleg Nesterov wrote:
> > On 10/19, Oleg Nesterov wrote:
> 
> Hi Oleg, Joel,
> 
> Thanks for running this down.  Agreed we shouldn't just fail to init because
> sysctl is off.  Some comments below:
> 
> 
> > > 
> > > But. rds_init() can also fail even if CONFIG_SYSCTL=y, after
> > > rds_sysctl_init(), so to me this looks like a bug in net/rds/.
> > > 
> Yes that's a separate bug, so I'll send a separate fix for that.
> 
> > > 
> > > In any case, I guess net/rds/ init paths should not fail if
> > > CONFIG_SYSCTL=n ?
> > 
> > So I think that something like the uncompiled/untested patch below makes
> > sense anyway even if doesn't fix all the potential problems with rds_wq.
> > 
> > What do you think?
> > 
> > Oleg.
> > ---
> > 
> > diff --git a/net/rds/ib_sysctl.c b/net/rds/ib_sysctl.c
> > index 2af678e71e3c..bccdb5c4df1d 100644
> > --- a/net/rds/ib_sysctl.c
> > +++ b/net/rds/ib_sysctl.c
> > @@ -36,19 +36,10 @@
> >  
> >  #include "ib.h"
> >  
> > -static struct ctl_table_header *rds_ib_sysctl_hdr;
> > -
> >  unsigned long rds_ib_sysctl_max_send_wr = RDS_IB_DEFAULT_SEND_WR;
> >  unsigned long rds_ib_sysctl_max_recv_wr = RDS_IB_DEFAULT_RECV_WR;
> >  unsigned long rds_ib_sysctl_max_recv_allocation = (128 * 1024 * 1024) / RDS_FRAG_SIZE;
> > -static unsigned long rds_ib_sysctl_max_wr_min = 1;
> > -/* hardware will fail CQ creation long before this */
> > -static unsigned long rds_ib_sysctl_max_wr_max = (u32)~0;
> > -
> >  unsigned long rds_ib_sysctl_max_unsig_wrs = 16;
> > -static unsigned long rds_ib_sysctl_max_unsig_wr_min = 1;
> > -static unsigned long rds_ib_sysctl_max_unsig_wr_max = 64;
> > -
> >  /*
> >   * This sysctl does nothing.
> >   *
> > @@ -61,6 +52,14 @@ static unsigned long rds_ib_sysctl_max_unsig_wr_max = 64;
> >   */
> >  unsigned int rds_ib_sysctl_flow_control = 0;
> >  
> > +#ifdef CONFIG_SYSCTL
> > +static unsigned long rds_ib_sysctl_max_wr_min = 1;
> > +/* hardware will fail CQ creation long before this */
> > +static unsigned long rds_ib_sysctl_max_wr_max = (u32)~0;
> > +
> > +static unsigned long rds_ib_sysctl_max_unsig_wr_min = 1;
> > +static unsigned long rds_ib_sysctl_max_unsig_wr_max = 64;
> > +
> >  static struct ctl_table rds_ib_sysctl_table[] = {
> >  	{
> >  		.procname       = "max_send_wr",
> > @@ -105,6 +104,8 @@ static struct ctl_table rds_ib_sysctl_table[] = {
> >  	},
> >  };
> >  
> > +static struct ctl_table_header *rds_ib_sysctl_hdr;
> > +
> >  void rds_ib_sysctl_exit(void)
> >  {
> >  	if (rds_ib_sysctl_hdr)
> > @@ -118,3 +119,15 @@ int rds_ib_sysctl_init(void)
> >  		return -ENOMEM;
> >  	return 0;
> >  }
> 
> 
> The real rds_sysctl_init() also does the runtime setup of
> rds_sysctl_reconnect_min_jiffies (msecs_to_jiffies(1)).  Without
> it, the reconnect back off is lost.
> 
> Also, if register_net_sysctl_sz() returns NULL in rds_tcp_init_net(),
> it fails as an -ENOMEM.  So RDS/TCP would still fail to come up with
> CONFIG_SYSCTL=n.  A simpler fix might be to just handle the NULL at the
> three call sites, e.g.:
> 
>         rds_sysctl_reg_table =
>                 register_net_sysctl(&init_net, "net/rds", rds_sysctl_rds_table);
>         if (!rds_sysctl_reg_table && IS_ENABLED(CONFIG_SYSCTL))
>                 return -ENOMEM;
> 

Remember to NULL check rds_sysctl_reg_table in rds_sysctl_exit(). You
might hit another UAF on exit if you don't.

> And same for rds_ib_sysctl_init() and rds_tcp_init_net().  The exit
> paths are ok, since unregister_net_sysctl_table() is already a
> no-op stub when sysctl is off.
> 
> Let me know if you want to respin or if you'd rather I send it.
> Either way is fine with me.
> 
> Thanks
> Allison
> 
> > +
> > +#else
> > +
> > +void rds_ib_sysctl_exit(void)
> > +{
> > +}
> > +
> > +int rds_ib_sysctl_init(void)
> > +{
> > +	return 0;
> > +}
> > +#endif
> > diff --git a/net/rds/sysctl.c b/net/rds/sysctl.c
> > index 025f518a4349..a0673a41633a 100644
> > --- a/net/rds/sysctl.c
> > +++ b/net/rds/sysctl.c
> > @@ -36,11 +36,6 @@
> >  
> >  #include "rds.h"
> >  
> > -static struct ctl_table_header *rds_sysctl_reg_table;
> > -
> > -static unsigned long rds_sysctl_reconnect_min = 1;
> > -static unsigned long rds_sysctl_reconnect_max = ~0UL;
> > -
> >  unsigned long rds_sysctl_reconnect_min_jiffies;
> >  unsigned long rds_sysctl_reconnect_max_jiffies = HZ;
> >  
> > @@ -49,6 +44,10 @@ unsigned int  rds_sysctl_max_unacked_bytes = (16 << 20);
> >  
> >  unsigned int rds_sysctl_ping_enable = 1;
> >  
> > +#ifdef CONFIG_SYSCTL
> > +static unsigned long rds_sysctl_reconnect_min = 1;
> > +static unsigned long rds_sysctl_reconnect_max = ~0UL;
> > +
> >  static struct ctl_table rds_sysctl_rds_table[] = {
> >  	{
> >  		.procname       = "reconnect_min_delay_ms",
> > @@ -91,6 +90,8 @@ static struct ctl_table rds_sysctl_rds_table[] = {
> >  	},
> >  };
> >  
> > +static struct ctl_table_header *rds_sysctl_reg_table;
> > +
> >  void rds_sysctl_exit(void)
> >  {
> >  	unregister_net_sysctl_table(rds_sysctl_reg_table);
> > @@ -107,3 +108,15 @@ int rds_sysctl_init(void)
> >  		return -ENOMEM;
> >  	return 0;
> >  }
> > +
> > +#else
> > +
> > +void rds_sysctl_exit(void)
> > +{
> > +}
> > +
> > +int rds_sysctl_init(void)
> > +{
> > +	return 0;
> > +}
> > +#endif
> > 
> 

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 659 bytes --]