CVE-2026-98070: net/rds: acquire RDS_IN_XMIT in rds_tcp_reset_callbacks()

In the Linux kernel, the following vulnerability has been resolved:

net/rds: acquire RDSINXMIT in rdstcpresetcallbacks()

rdstcpresetcallbacks() quiesces the transmit path by setting the path state to RDSCONNRESETTING and then waiting for RDSINXMIT to be sampled clear before swapping the underlying socket and calling rdssendpathreset().

Sampling the bit clear is not the same as owning it: rdssendxmit() can re-acquire RDSINXMIT right after the waitevent() returns. Its state recheck after taking the lock is a store-buffering pattern (the resetter writes the state and reads the bit, the sender writes the bit and reads the state) and acquireinxmit() is only an acquire operation, so on weakly ordered architectures both sides can miss each other's write and the transmit path then runs concurrently with rdssendpathreset() rewriting cpxmit state - which is exactly what the comment above rdssendpathreset() tells its callers to prevent.

Take the lock instead, hold it across the socket swap and rdssendpathreset(), and release it with a wake-up at the end. The lock-ordering constraint documented above the wait still holds: the lock is acquired before locksock(), so a sender inside tcpsendmsg() can never be waited on while we hold the socket lock.

Two details of the old code go away with the same change:

- tsock is now read only after the lock is acquired. The old code cached it before waiting; the teardown in rdsconnshutdown() releases that socket and clears tsock, so a pointer cached before the wait can be stale by the time the accept path resumes. Reading it under RDSINXMIT is what makes the exclusion complete once the teardown owns the same lock, which the next patch arranges; until then the teardown still only samples the bit, and the two paths remain as exposed to each other as they are today.

- The old !osock early path called rdssendpathreset() with no serialization at all. It now runs under the lock like the normal path. The conditional RDSCONNRESETTING transition of the previous patch happens before the socket check either way: a path found without a socket is either still connecting (its reconnect worker blocked on tconnpathlock) and legitimately goes RESETTING -> UP on the new socket, or it has been torn down meanwhile and is dropped.

The in-function comment describing the old wait-based quiesce is rewritten to describe the lock-based one, and the stale block comment above the function (which still described a return value and an incomplete list of tsock writers) is refreshed to name all four writers - the connect, accept, teardown and swap paths - and what serializes each of them.