Commit e0416e7d authored by David Howells's avatar David Howells Committed by David S. Miller
Browse files

rxrpc: Fix potential race in error handling in afs_make_call() 



If the rxrpc call set up by afs_make_call() receives an error whilst it is
transmitting the request, there's the possibility that it may get to the
point the rxrpc call is ended (after the error_kill_call label) just as the
call is queued for async processing.

This could manifest itself as call->rxcall being seen as NULL in
afs_deliver_to_call() when it tries to lock the call.

Fix this by splitting rxrpc_kernel_end_call() into a function to shut down
an rxrpc call and a function to release the caller's reference and calling
the latter only when we get to afs_put_call().

Reported-by: default avatarJeffrey Altman <jaltman@auristor.com>
Signed-off-by: default avatarDavid Howells <dhowells@redhat.com>
Tested-by: default avatar <kafs-testing+fedora36_64checkkafs-build-306@auristor.com>
cc: Marc Dionne <marc.dionne@auristor.com>
cc: "David S. Miller" <davem@davemloft.net>
cc: Eric Dumazet <edumazet@google.com>
cc: Jakub Kicinski <kuba@kernel.org>
cc: Paolo Abeni <pabeni@redhat.com>
cc: linux-afs@lists.infradead.org
cc: netdev@vger.kernel.org
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 92ce288c

Documentation/networking/rxrpc.rst

+12 −5
Original line number Diff line number Diff line
@@ -848,14 +848,21 @@ The kernel interface functions are as follows: 
     returned.  The caller now holds a reference on this and it must be

     properly ended.



 (#) End a client call::

 (#) Shut down a client call::



	void rxrpc_kernel_end_call(struct socket *sock,

	void rxrpc_kernel_shutdown_call(struct socket *sock,

					struct rxrpc_call *call);



     This is used to end a previously begun call.  The user_call_ID is expunged

     from AF_RXRPC's knowledge and will not be seen again in association with

     the specified call.

     This is used to shut down a previously begun call.  The user_call_ID is

     expunged from AF_RXRPC's knowledge and will not be seen again in

     association with the specified call.



 (#) Release the ref on a client call::



	void rxrpc_kernel_put_call(struct socket *sock,

				   struct rxrpc_call *call);



     This is used to release the caller's ref on an rxrpc call.



 (#) Send data through a call::

fs/afs/rxrpc.c

+4 −5
Original line number Diff line number Diff line
@@ -179,7 +179,8 @@ void afs_put_call(struct afs_call *call) 
		ASSERT(call->type->name != NULL);



		if (call->rxcall) {

			rxrpc_kernel_end_call(net->socket, call->rxcall);

			rxrpc_kernel_shutdown_call(net->socket, call->rxcall);

			rxrpc_kernel_put_call(net->socket, call->rxcall);

			call->rxcall = NULL;

		}

		if (call->type->destructor)
@@ -420,10 +421,8 @@ void afs_make_call(struct afs_addr_cursor *ac, struct afs_call *call, gfp_t gfp) 
	 * The call, however, might be queued on afs_async_calls and we need to

	 * make sure we don't get any more notifications that might requeue it.

	 */

	if (call->rxcall) {

		rxrpc_kernel_end_call(call->net->socket, call->rxcall);

		call->rxcall = NULL;

	}

	if (call->rxcall)

		rxrpc_kernel_shutdown_call(call->net->socket, call->rxcall);

	if (call->async) {

		if (cancel_work_sync(&call->async_work))

			afs_put_call(call);

include/net/af_rxrpc.h

+2 −1
Original line number Diff line number Diff line
@@ -57,7 +57,8 @@ int rxrpc_kernel_recv_data(struct socket *, struct rxrpc_call *, 
			   struct iov_iter *, size_t *, bool, u32 *, u16 *);

bool rxrpc_kernel_abort_call(struct socket *, struct rxrpc_call *,

			     u32, int, enum rxrpc_abort_reason);

void rxrpc_kernel_end_call(struct socket *, struct rxrpc_call *);

void rxrpc_kernel_shutdown_call(struct socket *sock, struct rxrpc_call *call);

void rxrpc_kernel_put_call(struct socket *sock, struct rxrpc_call *call);

void rxrpc_kernel_get_peer(struct socket *, struct rxrpc_call *,

			   struct sockaddr_rxrpc *);

bool rxrpc_kernel_get_srtt(struct socket *, struct rxrpc_call *, u32 *);

net/rxrpc/af_rxrpc.c

+25 −12
Original line number Diff line number Diff line
@@ -342,18 +342,19 @@ static void rxrpc_dummy_notify_rx(struct sock *sk, struct rxrpc_call *rxcall, 
}



/**

 * rxrpc_kernel_end_call - Allow a kernel service to end a call it was using

 * rxrpc_kernel_shutdown_call - Allow a kernel service to shut down a call it was using

 * @sock: The socket the call is on

 * @call: The call to end

 *

 * Allow a kernel service to end a call it was using.  The call must be

 * Allow a kernel service to shut down a call it was using.  The call must be

 * complete before this is called (the call should be aborted if necessary).

 */

void rxrpc_kernel_end_call(struct socket *sock, struct rxrpc_call *call)

void rxrpc_kernel_shutdown_call(struct socket *sock, struct rxrpc_call *call)

{

	_enter("%d{%d}", call->debug_id, refcount_read(&call->ref));



	mutex_lock(&call->user_mutex);

	if (!test_bit(RXRPC_CALL_RELEASED, &call->flags)) {

		rxrpc_release_call(rxrpc_sk(sock->sk), call);



		/* Make sure we're not going to call back into a kernel service */
@@ -362,11 +363,23 @@ void rxrpc_kernel_end_call(struct socket *sock, struct rxrpc_call *call) 
			call->notify_rx = rxrpc_dummy_notify_rx;

			spin_unlock(&call->notify_lock);

		}



	}

	mutex_unlock(&call->user_mutex);

}

EXPORT_SYMBOL(rxrpc_kernel_shutdown_call);



/**

 * rxrpc_kernel_put_call - Release a reference to a call

 * @sock: The socket the call is on

 * @call: The call to put

 *

 * Drop the application's ref on an rxrpc call.

 */

void rxrpc_kernel_put_call(struct socket *sock, struct rxrpc_call *call)

{

	rxrpc_put_call(call, rxrpc_call_put_kernel);

}

EXPORT_SYMBOL(rxrpc_kernel_end_call);

EXPORT_SYMBOL(rxrpc_kernel_put_call);



/**

 * rxrpc_kernel_check_life - Check to see whether a call is still alive

net/rxrpc/rxperf.c

+2 −1
Original line number Diff line number Diff line
@@ -342,7 +342,8 @@ static void rxperf_deliver_to_call(struct work_struct *work) 
call_complete:

	rxperf_set_call_complete(call, ret, remote_abort);

	/* The call may have been requeued */

	rxrpc_kernel_end_call(rxperf_socket, call->rxcall);

	rxrpc_kernel_shutdown_call(rxperf_socket, call->rxcall);

	rxrpc_kernel_put_call(rxperf_socket, call->rxcall);

	cancel_work(&call->work);

	kfree(call);

}