CVE-2026-98069: net/rds: acquire the fastpath locks in rds_conn_shutdown()

In the Linux kernel, the following vulnerability has been resolved:

net/rds: acquire the fastpath locks in rdsconnshutdown()

rdsconnshutdown() quiesces the transmit and receive-refill paths by waiting for RDSINXMIT and RDSRECVREFILL to be sampled clear, and then runs the transport shutdown and rdsconnpathreset(). Sampling the bits clear is not the same as owning them: the moment after the waitevent() returns, rdssendxmit() can re-acquire RDSINXMIT (or rdsibrecvrefill() can re-acquire RDSRECVREFILL) and run concurrently with the teardown.

The sender does recheck the connection state after taking the lock, but that recheck is a classic store-buffering pattern: teardown writes the state and reads the bit while the sender writes the bit and reads the state. acquireinxmit() is only an acquire operation, so on weakly ordered architectures both sides can miss each other's write, and the transmit path then runs while the transport zeroes its rings (e.g. rdsibringinit()) and rdssendpathreset() rewrites the transmit state under it.

Oracle UEK fixed the same class of crashes - a 14-year tail of BUGON()s in rdsibsubsignaled(), unexpected op-codes and NULL dereferences in rdsibsendcqehandler() during failover testing - by making the teardown path acquire the fastpath bit locks instead of testing them ("rds: Make sure transmit path and connection tear-down does not run concurrently"). Ownership of a single word is decided by RMW atomicity, so no cross-variable ordering is needed.

Do the same here: take both locks before calling the transport shutdown, hold them across rdsconnpathreset(), and release them explicitly with a wake-up afterwards. Both are released with clearbitunlock(), so that the ring re-initialization done by the transport shutdown and the transmit state rewritten by rdssendpathreset() are ordered before either bit is seen clear by the next acquireinxmit() or acquirerefill().

The fastpath users of these bits - rdssendxmit() and rdsibrecvrefill() - are trylock style and back off while teardown owns the locks, so no new lock dependency is introduced for them. rdstcpresetcallbacks() is different: since the previous patch it acquires RDSINXMIT as well, and it blocks doing so, so its wait now spans the teardown instead of at most one send batch. That waiter runs from rdstcpacceptone() on the single-threaded krdsd workqueue and holds rdstcpacceptlock and tconnpathlock while it waits, so a duelling SYN accepted while its path is being torn down parks accept processing for the duration of the teardown - for TCP bounded by the (up to 5 s) drain loop in rdstcpconnpathshutdown(). An IB path's drain in rdsibconnpathshutdown() has no round cap, but no blocking waiter either: rdstcpresetcallbacks() is the only blocking acquirer of these bits and waits only on its own TCP path, and the fastpaths are trylock-and-back-off on both transports, so a long IB drain lengthens only that path's own quiesce. The window is narrow: the accept-side state check has to pass before the teardown moves the path to RDSCONNDISCONNECTING.

Because krdsd is a single global workqueue, everything else queued there - accept processing for other connections and network namespaces, and the flushworkqueue(rdswq) in rdstcplistenstop() during namespace teardown - waits behind the parked accept worker for that time. It cannot deadlock, although the waits do point at each other: the teardown blocks until the bit's holder releases it, and the holder may be that krdsd accept worker. The holder finishes without needing anything the teardown owns: the sync cancels rdstcpresetcallbacks() issues target cpsendw and cprecvw on the path's ordered cpwq, whose only execution slot is occupied by the blocked cpdownw itself, so they are pending at most and cancel without flushing - a reliance on cpwq being ordered that is now noted next to those cancels (on ---truncated---