rxrpc: Fix potential race in error handling in afs_make_call()

If the rxrpc call set up by afs_make_call() receives an error whilst it is
transmitting the request, there's the possibility that it may get to the
point the rxrpc call is ended (after the error_kill_call label) just as the
call is queued for async processing.

This could manifest itself as call->rxcall being seen as NULL in
afs_deliver_to_call() when it tries to lock the call.

Fix this by splitting rxrpc_kernel_end_call() into a function to shut down
an rxrpc call and a function to release the caller's reference and calling
the latter only when we get to afs_put_call().

Reported-by: Jeffrey Altman <jaltman@auristor.com>
Signed-off-by: David Howells <dhowells@redhat.com>
Tested-by: kafs-testing+fedora36_64checkkafs-build-306@auristor.com
cc: Marc Dionne <marc.dionne@auristor.com>
cc: "David S. Miller" <davem@davemloft.net>
cc: Eric Dumazet <edumazet@google.com>
cc: Jakub Kicinski <kuba@kernel.org>
cc: Paolo Abeni <pabeni@redhat.com>
cc: linux-afs@lists.infradead.org
cc: netdev@vger.kernel.org
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/Documentation/networking/rxrpc.rst b/Documentation/networking/rxrpc.rst
index ec1323d92c9671914020eec63f9734e1e9cfd2d7..e807e18ba32ac92afb1f29a3adf89db9921fd9aa 100644 (file)
--- a/Documentation/networking/rxrpc.rst
+++ b/Documentation/networking/rxrpc.rst
@@ -848,14 +848,21 @@ The kernel interface functions are as follows:
      returned.  The caller now holds a reference on this and it must be
      properly ended.
 
- (#) End a client call::
+ (#) Shut down a client call::
 
-       void rxrpc_kernel_end_call(struct socket *sock,
+       void rxrpc_kernel_shutdown_call(struct socket *sock,
+                                       struct rxrpc_call *call);
+
+     This is used to shut down a previously begun call.  The user_call_ID is
+     expunged from AF_RXRPC's knowledge and will not be seen again in
+     association with the specified call.
+
+ (#) Release the ref on a client call::
+
+       void rxrpc_kernel_put_call(struct socket *sock,
                                   struct rxrpc_call *call);
 
-     This is used to end a previously begun call.  The user_call_ID is expunged
-     from AF_RXRPC's knowledge and will not be seen again in association with
-     the specified call.
+     This is used to release the caller's ref on an rxrpc call.
 
  (#) Send data through a call::
 

diff --git a/fs/afs/rxrpc.c b/fs/afs/rxrpc.c
index 7817e2b860e5eb30a2c758d78a737615993bdd85..e08b850c3e6df87c4802f0497e9cc382b7157c6b 100644 (file)
--- a/fs/afs/rxrpc.c
+++ b/fs/afs/rxrpc.c
@@ -179,7 +179,8 @@ void afs_put_call(struct afs_call *call)
                ASSERT(call->type->name != NULL);
 
                if (call->rxcall) {
-                       rxrpc_kernel_end_call(net->socket, call->rxcall);
+                       rxrpc_kernel_shutdown_call(net->socket, call->rxcall);
+                       rxrpc_kernel_put_call(net->socket, call->rxcall);
                        call->rxcall = NULL;
                }
                if (call->type->destructor)
@@ -420,10 +421,8 @@ error_kill_call:
         * The call, however, might be queued on afs_async_calls and we need to
         * make sure we don't get any more notifications that might requeue it.
         */
-       if (call->rxcall) {
-               rxrpc_kernel_end_call(call->net->socket, call->rxcall);
-               call->rxcall = NULL;
-       }
+       if (call->rxcall)
+               rxrpc_kernel_shutdown_call(call->net->socket, call->rxcall);
        if (call->async) {
                if (cancel_work_sync(&call->async_work))
                        afs_put_call(call);

diff --git a/include/net/af_rxrpc.h b/include/net/af_rxrpc.h
index ba717eac0229a26ecfc303840509108e61be5d3e..01a35e113ab952779d5ca68cef82875c7fc56bc3 100644 (file)
--- a/include/net/af_rxrpc.h
+++ b/include/net/af_rxrpc.h
@@ -57,7 +57,8 @@ int rxrpc_kernel_recv_data(struct socket *, struct rxrpc_call *,
                           struct iov_iter *, size_t *, bool, u32 *, u16 *);
 bool rxrpc_kernel_abort_call(struct socket *, struct rxrpc_call *,
                             u32, int, enum rxrpc_abort_reason);
-void rxrpc_kernel_end_call(struct socket *, struct rxrpc_call *);
+void rxrpc_kernel_shutdown_call(struct socket *sock, struct rxrpc_call *call);
+void rxrpc_kernel_put_call(struct socket *sock, struct rxrpc_call *call);
 void rxrpc_kernel_get_peer(struct socket *, struct rxrpc_call *,
                           struct sockaddr_rxrpc *);
 bool rxrpc_kernel_get_srtt(struct socket *, struct rxrpc_call *, u32 *);

diff --git a/net/rxrpc/af_rxrpc.c b/net/rxrpc/af_rxrpc.c
index 102f5cbff91a3b3748407a83f63bcf2dabaf88a2..c32b164206f9d46b9263149935fa22efe00631e2 100644 (file)
--- a/net/rxrpc/af_rxrpc.c
+++ b/net/rxrpc/af_rxrpc.c
@@ -342,31 +342,44 @@ static void rxrpc_dummy_notify_rx(struct sock *sk, struct rxrpc_call *rxcall,
 }
 
 /**
- * rxrpc_kernel_end_call - Allow a kernel service to end a call it was using
+ * rxrpc_kernel_shutdown_call - Allow a kernel service to shut down a call it was using
  * @sock: The socket the call is on
  * @call: The call to end
  *
- * Allow a kernel service to end a call it was using.  The call must be
+ * Allow a kernel service to shut down a call it was using.  The call must be
  * complete before this is called (the call should be aborted if necessary).
  */
-void rxrpc_kernel_end_call(struct socket *sock, struct rxrpc_call *call)
+void rxrpc_kernel_shutdown_call(struct socket *sock, struct rxrpc_call *call)
 {
        _enter("%d{%d}", call->debug_id, refcount_read(&call->ref));
 
        mutex_lock(&call->user_mutex);
-       rxrpc_release_call(rxrpc_sk(sock->sk), call);
-
-       /* Make sure we're not going to call back into a kernel service */
-       if (call->notify_rx) {
-               spin_lock(&call->notify_lock);
-               call->notify_rx = rxrpc_dummy_notify_rx;
-               spin_unlock(&call->notify_lock);
+       if (!test_bit(RXRPC_CALL_RELEASED, &call->flags)) {
+               rxrpc_release_call(rxrpc_sk(sock->sk), call);
+
+               /* Make sure we're not going to call back into a kernel service */
+               if (call->notify_rx) {
+                       spin_lock(&call->notify_lock);
+                       call->notify_rx = rxrpc_dummy_notify_rx;
+                       spin_unlock(&call->notify_lock);
+               }
        }
-
        mutex_unlock(&call->user_mutex);
+}
+EXPORT_SYMBOL(rxrpc_kernel_shutdown_call);
+
+/**
+ * rxrpc_kernel_put_call - Release a reference to a call
+ * @sock: The socket the call is on
+ * @call: The call to put
+ *
+ * Drop the application's ref on an rxrpc call.
+ */
+void rxrpc_kernel_put_call(struct socket *sock, struct rxrpc_call *call)
+{
        rxrpc_put_call(call, rxrpc_call_put_kernel);
 }
-EXPORT_SYMBOL(rxrpc_kernel_end_call);
+EXPORT_SYMBOL(rxrpc_kernel_put_call);
 
 /**
  * rxrpc_kernel_check_life - Check to see whether a call is still alive

diff --git a/net/rxrpc/rxperf.c b/net/rxrpc/rxperf.c
index 4a2e90015ca72c3af3aa794ae63ab99c25157b00..085e7892d31040a8b3f18bbb8332f3f26f7321df 100644 (file)
--- a/net/rxrpc/rxperf.c
+++ b/net/rxrpc/rxperf.c
@@ -342,7 +342,8 @@ static void rxperf_deliver_to_call(struct work_struct *work)
 call_complete:
        rxperf_set_call_complete(call, ret, remote_abort);
        /* The call may have been requeued */
-       rxrpc_kernel_end_call(rxperf_socket, call->rxcall);
+       rxrpc_kernel_shutdown_call(rxperf_socket, call->rxcall);
+       rxrpc_kernel_put_call(rxperf_socket, call->rxcall);
        cancel_work(&call->work);
        kfree(call);
 }