From: Sharath Srinivasan The to_be_dropped list is declared once at the top of rds_send_xmit() but the function can loop via "goto restart" after each batch. The code currently relies on rds_send_remove_from_sock() having emptied the list entry by entry (via list_del_init()) at the end of the previous batch; nothing in rds_send_xmit() itself guarantees the list head is empty when a new batch starts. Re-initialize the list on every restart so a change in the callee's behavior cannot turn into list corruption and double-puts. This is hardening: no user-visible bug is known in the current code. This mirrors Oracle UEK commit "net/rds: rds_send_xmit should INIT_LIST_HEAD(&to_be_dropped) on restart". Signed-off-by: Gerd Rausch Signed-off-by: Sharath Srinivasan [achender: port to net-next (keep the existing LIST_HEAD declaration and add only the restart re-init); update commit message] Assisted-by: Claude-Code:claude-fable-5 Signed-off-by: Allison Henderson --- net/rds/send.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/net/rds/send.c b/net/rds/send.c index 309021e0cc9bc..c28dc9f820af0 100644 --- a/net/rds/send.c +++ b/net/rds/send.c @@ -200,6 +200,12 @@ int rds_send_xmit(struct rds_conn_path *cp) restart: batch_count = 0; + /* The drop processing after over_batch relies on the callees + * emptying to_be_dropped entry by entry; re-initialize it here + * rather than depending on that implicit behavior. + */ + INIT_LIST_HEAD(&to_be_dropped); + /* * sendmsg calls here after having queued its message on the send * queue. We only have one task feeding the connection at a time. If -- 2.25.1