[rds-devel] [External] : Re: [linus:master] [sysctl] 8d75c338f0: BUG:KASAN:slab-use-after-free_in_touch_wq_lockdep_map

[Joel Granados]

On Mon, Oct 19, 2026 at 05:35:54PM +0200, Oleg Nesterov wrote:
> On 10/19, Oleg Nesterov wrote:
> >
> > But. rds_init() can also fail even if CONFIG_SYSCTL=y, after
> > rds_sysctl_init(), so to me this looks like a bug in net/rds/.
> >
> >
> > In any case, I guess net/rds/ init paths should not fail if
> > CONFIG_SYSCTL=n ?
> 
> So I think that something like the uncompiled/untested patch below makes
> sense anyway even if doesn't fix all the potential problems with rds_wq.
> 
> What do you think?

That is a good option. I also did not compile not test it, but guarding
the error inside an ifdef would work and is a pattern that is used
elsewhere.

You can also do this (also untested and not compiled):

diff --git i/net/rds/ib_sysctl.c w/net/rds/ib_sysctl.c
index 2af678e71e3c6..bc97a3eecad69 100644
--- i/net/rds/ib_sysctl.c
+++ w/net/rds/ib_sysctl.c
@@ -114,7 +114,7 @@ void rds_ib_sysctl_exit(void)
 int rds_ib_sysctl_init(void)
 {
        rds_ib_sysctl_hdr = register_net_sysctl(&init_net, "net/rds/ib", rds_ib_sysctl_table);
-       if (!rds_ib_sysctl_hdr)
+       if (!rds_ib_sysctl_hdr && IS_ENABLED(CONFIG_SYSCTL))
                return -ENOMEM;
        return 0;
 }
diff --git i/net/rds/sysctl.c w/net/rds/sysctl.c
index 025f518a43495..41c65b98c94bd 100644
--- i/net/rds/sysctl.c
+++ w/net/rds/sysctl.c
@@ -93,7 +93,8 @@ static struct ctl_table rds_sysctl_rds_table[] = {

 void rds_sysctl_exit(void)
 {
-       unregister_net_sysctl_table(rds_sysctl_reg_table);
+       if (rds_sysctl_reg_table)
+               unregister_net_sysctl_table(rds_sysctl_reg_table);
 }

 int rds_sysctl_init(void)
@@ -103,7 +104,7 @@ int rds_sysctl_init(void)

        rds_sysctl_reg_table =
                register_net_sysctl(&init_net, "net/rds", rds_sysctl_rds_table);
-       if (!rds_sysctl_reg_table)
+       if (!rds_sysctl_reg_table && IS_ENABLED(CONFIG_SYSCTL))
                return -ENOMEM;
        return 0;
 }


Both are ok IMO.

Best

> 
> Oleg.
> ---
> 
> diff --git a/net/rds/ib_sysctl.c b/net/rds/ib_sysctl.c
> index 2af678e71e3c..bccdb5c4df1d 100644
> --- a/net/rds/ib_sysctl.c
> +++ b/net/rds/ib_sysctl.c
> @@ -36,19 +36,10 @@
>  
>  #include "ib.h"
>  
> -static struct ctl_table_header *rds_ib_sysctl_hdr;
> -
>  unsigned long rds_ib_sysctl_max_send_wr = RDS_IB_DEFAULT_SEND_WR;
>  unsigned long rds_ib_sysctl_max_recv_wr = RDS_IB_DEFAULT_RECV_WR;
>  unsigned long rds_ib_sysctl_max_recv_allocation = (128 * 1024 * 1024) / RDS_FRAG_SIZE;
> -static unsigned long rds_ib_sysctl_max_wr_min = 1;
> -/* hardware will fail CQ creation long before this */
> -static unsigned long rds_ib_sysctl_max_wr_max = (u32)~0;
> -
>  unsigned long rds_ib_sysctl_max_unsig_wrs = 16;
> -static unsigned long rds_ib_sysctl_max_unsig_wr_min = 1;
> -static unsigned long rds_ib_sysctl_max_unsig_wr_max = 64;
> -
>  /*
>   * This sysctl does nothing.
>   *
> @@ -61,6 +52,14 @@ static unsigned long rds_ib_sysctl_max_unsig_wr_max = 64;
>   */
>  unsigned int rds_ib_sysctl_flow_control = 0;
>  
> +#ifdef CONFIG_SYSCTL
> +static unsigned long rds_ib_sysctl_max_wr_min = 1;
> +/* hardware will fail CQ creation long before this */
> +static unsigned long rds_ib_sysctl_max_wr_max = (u32)~0;
> +
> +static unsigned long rds_ib_sysctl_max_unsig_wr_min = 1;
> +static unsigned long rds_ib_sysctl_max_unsig_wr_max = 64;
> +
>  static struct ctl_table rds_ib_sysctl_table[] = {
>  	{
>  		.procname       = "max_send_wr",
> @@ -105,6 +104,8 @@ static struct ctl_table rds_ib_sysctl_table[] = {
>  	},
>  };
>  
> +static struct ctl_table_header *rds_ib_sysctl_hdr;
> +
>  void rds_ib_sysctl_exit(void)
>  {
>  	if (rds_ib_sysctl_hdr)
> @@ -118,3 +119,15 @@ int rds_ib_sysctl_init(void)
>  		return -ENOMEM;
>  	return 0;
>  }
> +
> +#else
> +
> +void rds_ib_sysctl_exit(void)
> +{
> +}
> +
> +int rds_ib_sysctl_init(void)
> +{
> +	return 0;
> +}
> +#endif
> diff --git a/net/rds/sysctl.c b/net/rds/sysctl.c
> index 025f518a4349..a0673a41633a 100644
> --- a/net/rds/sysctl.c
> +++ b/net/rds/sysctl.c
> @@ -36,11 +36,6 @@
>  
>  #include "rds.h"
>  
> -static struct ctl_table_header *rds_sysctl_reg_table;
> -
> -static unsigned long rds_sysctl_reconnect_min = 1;
> -static unsigned long rds_sysctl_reconnect_max = ~0UL;
> -
>  unsigned long rds_sysctl_reconnect_min_jiffies;
>  unsigned long rds_sysctl_reconnect_max_jiffies = HZ;
>  
> @@ -49,6 +44,10 @@ unsigned int  rds_sysctl_max_unacked_bytes = (16 << 20);
>  
>  unsigned int rds_sysctl_ping_enable = 1;
>  
> +#ifdef CONFIG_SYSCTL
> +static unsigned long rds_sysctl_reconnect_min = 1;
> +static unsigned long rds_sysctl_reconnect_max = ~0UL;
> +
>  static struct ctl_table rds_sysctl_rds_table[] = {
>  	{
>  		.procname       = "reconnect_min_delay_ms",
> @@ -91,6 +90,8 @@ static struct ctl_table rds_sysctl_rds_table[] = {
>  	},
>  };
>  
> +static struct ctl_table_header *rds_sysctl_reg_table;
> +
>  void rds_sysctl_exit(void)
>  {
>  	unregister_net_sysctl_table(rds_sysctl_reg_table);
> @@ -107,3 +108,15 @@ int rds_sysctl_init(void)
>  		return -ENOMEM;
>  	return 0;
>  }
> +
> +#else
> +
> +void rds_sysctl_exit(void)
> +{
> +}
> +
> +int rds_sysctl_init(void)
> +{
> +	return 0;
> +}
> +#endif
> 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 659 bytes
Desc: not available
URL: <http://oss.oracle.com/pipermail/rds-devel/attachments/20261020/bd9d2c2b/attachment.sig>