Commit ba3d1f480c7a for kernel

commit ba3d1f480c7a3fba963e7867ad6cc557c197acbc
Author: Allison Henderson <achender@kernel.org>
Date:   Mon Sep 21 14:50:27 2026 -0700

    net/rds: size a connection's path set by the transport it ends up with

    __rds_conn_create() computes npaths from the caller's transport before
    it decides whether a connection to one of the host's own addresses is
    to be handled by the loopback transport instead.  That substitution is
    what an RDS/TCP socket sending to a local address gets, and after it
    the path init loop still runs for the TCP transport's RDS_MPATH_WORKERS
    paths and allocates an ordered workqueue for each, while
    rds_loop_conn_alloc() only ever provides transport data for path 0.

    rds_conn_destroy() sizes its teardown from c_trans, by then the
    loopback transport, so it visits path 0 only - and
    rds_conn_path_destroy() would skip the other paths anyway, since it
    returns before destroy_workqueue() for a path without transport data.
    kfree(c_path) then drops the last pointers to seven workqueues.  That
    repeats for every such connection, on every netns teardown or module
    unload, and every distinct local destination address is a separate
    connection.

    Recompute npaths once the transport is final, so that creation and
    destruction agree on the set of paths.  The c_path array stays sized
    for the caller's transport; the unused entries are freed with it.

    Fixes: 4716af3897e9 ("net/rds: Give each connection path its own workqueue")
    Signed-off-by: Allison Henderson <achender@kernel.org>
    Link: https://patch.msgid.link/20260921215027.174657-1-achender@kernel.org
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>

diff --git a/net/rds/connection.c b/net/rds/connection.c
index b6c4beb50eaf..c752a8623cfc 100644
--- a/net/rds/connection.c
+++ b/net/rds/connection.c
@@ -276,6 +276,12 @@ static struct rds_connection *__rds_conn_create(struct net *net,

 	conn->c_trans = trans;

+	/* The transport may just have been swapped for loopback; size the
+	 * set of paths - which is also what rds_conn_destroy() tears down
+	 * again - by the transport the connection actually uses.
+	 */
+	npaths = (trans->t_mp_capable ? RDS_MPATH_WORKERS : 1);
+
 	init_waitqueue_head(&conn->c_hs_waitq);
 	for (i = 0; i < npaths; i++) {
 		__rds_conn_path_init(conn, &conn->c_path[i],