From nobody Fri Sep 25 23:53:30 2026 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4273041BA61 for ; Mon, 7 Sep 2026 11:38:06 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.133.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788781087; cv=none; b=numBMwJkE0KpbW1cn+iG1U+Hyxe3O0wog5jCiM9WONX1RKV76NxdweOztoagiCLIiy15BTRu4+JLs6nr0orR864MA58KhiE1LXgIJC4wcaaofwOjZS9lBm7w5f/91MpYMwV2vokBqi6N5MHStcvT/KM8K8mSjd8SimLm5iYxjBw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788781087; c=relaxed/simple; bh=QkrXgiLBzAZrUOZ6rbFL5J/0l0Uf0yR9sCHA/3lcU/A=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=Asp+qoD0MSq8F0Xq7xiU1joJmqQlq6l9RkWD1vfyZbzaH6wobgi6h5Gu6qqr74PPdDyg7+vnRocjVvSq4EXdqbbQDtAfD5WW4nSNDCkPS6gJeb/knlWQ05tVD1V35MA5OUpgMkNyN1ya6ONz8nRV4KzZHv9Oq5lUAP3+nxqPlHo= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=LV9MzCAY; arc=none smtp.client-ip=170.10.133.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="LV9MzCAY" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1788781085; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=sfhzEQdfY31yuT9bz4poJnqa+tccgqvEMkzikJwbDsU=; b=LV9MzCAYa0pAmHr7H+NZ60H0QkBvyhsP6XULKW6Ipe0m+z06lq5h259JNvsCE8XpglhhU3 wH8WohAgBthGBbTRIUMF/reQBG3HtNaqnSrA3tDlgF18uPD47jFHcXipBcrEo7bpCBCGM6 nldzvDrIS2gS8Xe/AcX+WcFRj5mJ/Ls= Received: from mx-prod-mc-05.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-696-xCWdMGJkMG6O50tqMUecqQ-1; Mon, 07 Sep 2026 07:37:59 -0400 X-MC-Unique: xCWdMGJkMG6O50tqMUecqQ-1 X-Mimecast-MFC-AGG-ID: xCWdMGJkMG6O50tqMUecqQ_1788781078 Received: from mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.17]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-05.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 2C9CD19540DD; Mon, 7 Sep 2026 11:37:58 +0000 (UTC) Received: from warthog.com (unknown [10.44.32.158]) by mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id AE1C31956042; Mon, 7 Sep 2026 11:37:54 +0000 (UTC) From: David Howells To: netdev@vger.kernel.org Cc: David Howells , Marc Dionne , Jakub Kicinski , "David S. Miller" , Eric Dumazet , Paolo Abeni , Simon Horman , linux-afs@lists.infradead.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org Subject: [PATCH net v9 01/14] afs: Fix lack of loop around sendmsg() to rxrpc Date: Mon, 7 Sep 2026 12:37:28 +0100 Message-ID: <20260907113743.1453210-2-dhowells@redhat.com> In-Reply-To: <20260907113743.1453210-1-dhowells@redhat.com> References: <20260907113743.1453210-1-dhowells@redhat.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.0 on 10.30.177.17 Content-Type: text/plain; charset="utf-8" Fix the afs callers of sendmsg() to send data through an rxrpc socket to call again if a short send occurs. Note that this is also a prerequisite for changing the way rxrpc_send_data() works to return a short send rather than an error if some data was buffered. Fixes: 08e0e7c82eea ("[AF_RXRPC]: Make the in-kernel AFS filesystem use AF_= RXRPC.") Link: https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260824091645.41= 5423-1-dhowells%40redhat.com Signed-off-by: David Howells cc: Marc Dionne cc: Eric Dumazet cc: "David S. Miller" cc: Jakub Kicinski cc: Paolo Abeni cc: Simon Horman cc: linux-afs@lists.infradead.org cc: stable@vger.kernel.org --- fs/afs/rxrpc.c | 38 ++++++++++++++++++++++++-------------- 1 file changed, 24 insertions(+), 14 deletions(-) diff --git a/fs/afs/rxrpc.c b/fs/afs/rxrpc.c index d82916657a3d..a80b043d36be 100644 --- a/fs/afs/rxrpc.c +++ b/fs/afs/rxrpc.c @@ -412,26 +412,32 @@ void afs_make_call(struct afs_call *call, gfp_t gfp) msg.msg_controllen =3D 0; msg.msg_flags =3D MSG_WAITALL | (call->write_iter ? MSG_MORE : 0); =20 - ret =3D rxrpc_kernel_send_data(call->net->socket, rxcall, - &msg, call->request_size, - afs_notify_end_request_tx); - if (ret < 0) - goto error_do_abort; + do { + ret =3D rxrpc_kernel_send_data(call->net->socket, rxcall, &msg, + msg_data_left(&msg), + afs_notify_end_request_tx); + if (ret < 0) + goto error_do_abort; + } while (msg_data_left(&msg) > 0); =20 if (call->write_iter) { msg.msg_iter =3D *call->write_iter; msg.msg_flags &=3D ~MSG_MORE; trace_afs_send_data(call, &msg); =20 - ret =3D rxrpc_kernel_send_data(call->net->socket, - call->rxcall, &msg, - iov_iter_count(&msg.msg_iter), - afs_notify_end_request_tx); + do { + ret =3D rxrpc_kernel_send_data(call->net->socket, + call->rxcall, &msg, + msg_data_left(&msg), + afs_notify_end_request_tx); + if (ret < 0) { + trace_afs_sent_data(call, &msg, ret); + goto error_do_abort; + } + } while (msg_data_left(&msg) > 0); *call->write_iter =3D msg.msg_iter; =20 - trace_afs_sent_data(call, &msg, ret); - if (ret < 0) - goto error_do_abort; + trace_afs_sent_data(call, &msg, 0); } =20 /* Note that at this point, we may have received the reply or an abort @@ -912,8 +918,12 @@ void afs_send_simple_reply(struct afs_call *call, cons= t void *buf, size_t len) msg.msg_controllen =3D 0; msg.msg_flags =3D 0; =20 - n =3D rxrpc_kernel_send_data(net->socket, call->rxcall, &msg, len, - afs_notify_end_reply_tx); + do { + n =3D rxrpc_kernel_send_data(net->socket, call->rxcall, + &msg, msg_data_left(&msg), + afs_notify_end_reply_tx); + } while (n >=3D 0 && msg_data_left(&msg) > 0); + if (n >=3D 0) { /* Success */ _leave(" [replied]"); From nobody Fri Sep 25 23:53:30 2026 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 70DF448A2BE for ; Mon, 7 Sep 2026 11:38:09 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.133.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788781091; cv=none; b=oVGdGg6AgKjYKlP9hMMHu63YuqwtHDfuCZ7XvoVI3wz9azJarwPBLihbs6ADPPDD8PAdOUzSLKThHC/Kray8gfkISAA+c/UzlpE45Noh6JdjWBhxG8/8TtUzttIM8HhIafEolQowWbFYVUY/6lB+FkO6hzVMeonVuGB6kIZzZok= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788781091; c=relaxed/simple; bh=tfEoOqUUY5uPobZJkXgbLqSu5IFOc+FoE1/vAmlcrmI=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=BRKijtkLDRx9mu1+7xhmCcF6ubCC5ij0v2AU4NVT3d8oGj/9Ve7h7tSKBDBgPqDpayhT2iklMnJr3pjuNigR+LwypRPsyZMBNn/+lb+M2Dmy5n28WkOVDOzzT6OQKo3697v5tXDVEOw3q6Jm9VBWcByIPaNJ5wEiLTXp+DtvMsU= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=X8ng6K/K; arc=none smtp.client-ip=170.10.133.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="X8ng6K/K" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1788781088; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=9luXgLKX7odCzaclov5u6jsmNvxKtHBsHpUJ1lHcupg=; b=X8ng6K/K+xJ1w5A0st/XpBzRPJqqvypYObIjrz/pssKKA5VX0uDodaBgW+1uw191lG2Pox 3jISOGk1HI/UHqX8SObBPOP+SNrNmHPhs6qRXsLV12M+xNcNV441RzPqD9XF72VMkLQB8T zLFetapO+BsqP75mBWnhBy8pA/+AyJ0= Received: from mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-482-_Pc-tk2OPKW0ga5iJG1FHA-1; Mon, 07 Sep 2026 07:38:05 -0400 X-MC-Unique: _Pc-tk2OPKW0ga5iJG1FHA-1 X-Mimecast-MFC-AGG-ID: _Pc-tk2OPKW0ga5iJG1FHA_1788781083 Received: from mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.17]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 6FA6D1802162; Mon, 7 Sep 2026 11:38:03 +0000 (UTC) Received: from warthog.com (unknown [10.44.32.158]) by mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id D25F81956042; Mon, 7 Sep 2026 11:37:59 +0000 (UTC) From: David Howells To: netdev@vger.kernel.org Cc: David Howells , Marc Dionne , Jakub Kicinski , "David S. Miller" , Eric Dumazet , Paolo Abeni , Simon Horman , linux-afs@lists.infradead.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org Subject: [PATCH net v9 02/14] afs: Fix afs to abort the rxrpc call on send error Date: Mon, 7 Sep 2026 12:37:29 +0100 Message-ID: <20260907113743.1453210-3-dhowells@redhat.com> In-Reply-To: <20260907113743.1453210-1-dhowells@redhat.com> References: <20260907113743.1453210-1-dhowells@redhat.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.0 on 10.30.177.17 Content-Type: text/plain; charset="utf-8" Fix afs_send_empty_reply() and afs_send_simple_reply() to always try to abort the rxrpc call rather than just aborting on -ENOMEM and otherwise abandoning it. If the call is already complete due to network failure or a received abort, this will do nothing. Also make afs_make_call() always abort on send error; again, it does nothing if the rxrpc call is already dead. Fixes: 08e0e7c82eea ("[AF_RXRPC]: Make the in-kernel AFS filesystem use AF_= RXRPC.") Link: https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260824091645.41= 5423-1-dhowells%40redhat.com Signed-off-by: David Howells cc: Marc Dionne cc: Eric Dumazet cc: "David S. Miller" cc: Jakub Kicinski cc: Paolo Abeni cc: Simon Horman cc: linux-afs@lists.infradead.org cc: stable@vger.kernel.org --- fs/afs/rxrpc.c | 35 +++++++++++------------------------ include/trace/events/rxrpc.h | 2 +- 2 files changed, 12 insertions(+), 25 deletions(-) diff --git a/fs/afs/rxrpc.c b/fs/afs/rxrpc.c index a80b043d36be..04756d8744e2 100644 --- a/fs/afs/rxrpc.c +++ b/fs/afs/rxrpc.c @@ -449,10 +449,8 @@ void afs_make_call(struct afs_call *call, gfp_t gfp) return; =20 error_do_abort: - if (ret !=3D -ECONNABORTED) - rxrpc_kernel_abort_call(call->net->socket, rxcall, - RX_USER_ABORT, ret, - afs_abort_send_data_error); + rxrpc_kernel_abort_call(call->net->socket, rxcall, + RX_USER_ABORT, ret, afs_abort_send_data_error); if (call->async) { afs_see_call(call, afs_call_trace_async_abort); return; @@ -865,6 +863,7 @@ void afs_send_empty_reply(struct afs_call *call) { struct afs_net *net =3D call->net; struct msghdr msg; + int ret; =20 _enter(""); =20 @@ -877,22 +876,13 @@ void afs_send_empty_reply(struct afs_call *call) msg.msg_controllen =3D 0; msg.msg_flags =3D 0; =20 - switch (rxrpc_kernel_send_data(net->socket, call->rxcall, &msg, 0, - afs_notify_end_reply_tx)) { - case 0: - _leave(" [replied]"); + ret =3D rxrpc_kernel_send_data(net->socket, call->rxcall, &msg, 0, + afs_notify_end_reply_tx); + if (ret >=3D 0) return; =20 - case -ENOMEM: - _debug("oom"); - rxrpc_kernel_abort_call(net->socket, call->rxcall, - RXGEN_SS_MARSHAL, -ENOMEM, - afs_abort_oom); - fallthrough; - default: - _leave(" [error]"); - return; - } + rxrpc_kernel_abort_call(net->socket, call->rxcall, + RXGEN_SS_MARSHAL, ret, afs_abort_send_error); } =20 /* @@ -930,12 +920,9 @@ void afs_send_simple_reply(struct afs_call *call, cons= t void *buf, size_t len) return; } =20 - if (n =3D=3D -ENOMEM) { - _debug("oom"); - rxrpc_kernel_abort_call(net->socket, call->rxcall, - RXGEN_SS_MARSHAL, -ENOMEM, - afs_abort_oom); - } + + rxrpc_kernel_abort_call(net->socket, call->rxcall, + RXGEN_SS_MARSHAL, n, afs_abort_send_error); _leave(" [error]"); } =20 diff --git a/include/trace/events/rxrpc.h b/include/trace/events/rxrpc.h index 704a10de6670..554dfb777b93 100644 --- a/include/trace/events/rxrpc.h +++ b/include/trace/events/rxrpc.h @@ -20,10 +20,10 @@ /* AFS errors */ \ EM(afs_abort_general_error, "afs-error") \ EM(afs_abort_interrupted, "afs-intr") \ - EM(afs_abort_oom, "afs-oom") \ EM(afs_abort_op_not_supported, "afs-op-notsupp") \ EM(afs_abort_probeuuid_negative, "afs-probeuuid-neg") \ EM(afs_abort_send_data_error, "afs-send-data") \ + EM(afs_abort_send_error, "afs-send-error") \ EM(afs_abort_unmarshal_error, "afs-unmarshal") \ EM(afs_abort_unsupported_sec_class, "afs-unsup-sec-class") \ /* rxperf errors */ \ From nobody Fri Sep 25 23:53:30 2026 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id CD86448D87A for ; Mon, 7 Sep 2026 11:38:13 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.133.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788781095; cv=none; b=VHOn/MsLzHc57iZQvIE/dDWgouUl/i3iZszdQ2TdPjyiiLxl8g0SsCJoP0Q8jZu4SjFrXm2j4EzfrLgTUVpeK7tRMATWevEFNaJe9mcn/VGU7RLdcSr92tG7I3WR3C3GEGNt5sSROLLc5WmGPnx7XalDyHgC3W6Ms96V1/Tt7us= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788781095; c=relaxed/simple; bh=wwUuDa4eS6XqCSxTxNWd0rsvrdpQOaB5NzlDMTwVm84=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=k8Ph33xdzI+s25hCy3wERrGTdorBq+9m9PTXUvgWVlsi9ga2Gunqd/5+J0NqiwYMKFKwm1BgLZjRQRHjswElnS1Xa/oi83lXGctFjmlqMMCsh3ZuBRMWw5tkVLRqqYig0SQDSy9c5hJ6mDo0i8XttnJTS1aNvAqu2xiGoEQVGeA= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=TXVQfeEY; arc=none smtp.client-ip=170.10.133.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="TXVQfeEY" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1788781092; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=Bg/USTIfP8wxD4E88M09UTPS1gwZy1IhDKQimHIpjwI=; b=TXVQfeEYTHRnPQRsYhvgvfN/YspeenqCWx90j+mgPRugUUMX6I28m59YOXhXULAvV1Z33L HbNcCPdCiOgC3H/gPmjrxkp+s31VuxYWd+b+KyKvTITWudRDChPX/1e13O5Lsn44hFAzl1 scwmU5z3F2E2hBMSLweX7JDG0FVALFY= Received: from mx-prod-mc-01.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-226-hkmrzlq4MKmJdVyibu2bGg-1; Mon, 07 Sep 2026 07:38:09 -0400 X-MC-Unique: hkmrzlq4MKmJdVyibu2bGg-1 X-Mimecast-MFC-AGG-ID: hkmrzlq4MKmJdVyibu2bGg_1788781088 Received: from mx-prod-int-08.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-08.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.111]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-01.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 1155119540E7; Mon, 7 Sep 2026 11:38:08 +0000 (UTC) Received: from warthog.com (unknown [10.44.32.158]) by mx-prod-int-08.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 04266180034F; Mon, 7 Sep 2026 11:38:04 +0000 (UTC) From: David Howells To: netdev@vger.kernel.org Cc: David Howells , Marc Dionne , Jakub Kicinski , "David S. Miller" , Eric Dumazet , Paolo Abeni , Simon Horman , linux-afs@lists.infradead.org, linux-kernel@vger.kernel.org, stable@kernel.org Subject: [PATCH net v9 03/14] rxrpc: Fix lack of loop around reply send in rxperf server Date: Mon, 7 Sep 2026 12:37:30 +0100 Message-ID: <20260907113743.1453210-4-dhowells@redhat.com> In-Reply-To: <20260907113743.1453210-1-dhowells@redhat.com> References: <20260907113743.1453210-1-dhowells@redhat.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.111 Content-Type: text/plain; charset="utf-8" Fix rxperf_process_call() to loop around when sending the magic cookie in case of a short send. Also make it always try to abort the call on send error. Fixes: 75bfdbf2fca3 ("rxrpc: Implement an in-kernel rxperf server for testi= ng purposes") Link: https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260824091645.41= 5423-1-dhowells%40redhat.com Signed-off-by: David Howells cc: Marc Dionne cc: Eric Dumazet cc: "David S. Miller" cc: Jakub Kicinski cc: Paolo Abeni cc: Simon Horman cc: linux-afs@lists.infradead.org cc: stable@kernel.org --- include/trace/events/rxrpc.h | 2 +- net/rxrpc/rxperf.c | 15 +++++++++------ 2 files changed, 10 insertions(+), 7 deletions(-) diff --git a/include/trace/events/rxrpc.h b/include/trace/events/rxrpc.h index 554dfb777b93..56dc9b614071 100644 --- a/include/trace/events/rxrpc.h +++ b/include/trace/events/rxrpc.h @@ -28,8 +28,8 @@ EM(afs_abort_unsupported_sec_class, "afs-unsup-sec-class") \ /* rxperf errors */ \ EM(rxperf_abort_general_error, "rxperf-error") \ - EM(rxperf_abort_oom, "rxperf-oom") \ EM(rxperf_abort_op_not_supported, "rxperf-op-notsupp") \ + EM(rxperf_abort_send_error, "rxperf-send-error") \ EM(rxperf_abort_unmarshal_error, "rxperf-unmarshal") \ /* RxKAD security errors */ \ EM(rxkad_abort_1_short_check, "rxkad1-short-check") \ diff --git a/net/rxrpc/rxperf.c b/net/rxrpc/rxperf.c index b8df6d22314d..ebd54222c64e 100644 --- a/net/rxrpc/rxperf.c +++ b/net/rxrpc/rxperf.c @@ -538,15 +538,18 @@ static int rxperf_process_call(struct rxperf_call *ca= ll) iov[0].iov_len =3D len; iov_iter_kvec(&msg.msg_iter, WRITE, iov, 1, len); msg.msg_flags =3D 0; - n =3D rxrpc_kernel_send_data(rxperf_socket, call->rxcall, &msg, len, - rxperf_notify_end_reply_tx); + do { + n =3D rxrpc_kernel_send_data(rxperf_socket, call->rxcall, + &msg, msg_data_left(&msg), + rxperf_notify_end_reply_tx); + } while (n >=3D 0 && msg_data_left(&msg) > 0); + if (n >=3D 0) return 0; /* Success */ =20 - if (n =3D=3D -ENOMEM) - rxrpc_kernel_abort_call(rxperf_socket, call->rxcall, - RXGEN_SS_MARSHAL, -ENOMEM, - rxperf_abort_oom); + rxrpc_kernel_abort_call(rxperf_socket, call->rxcall, + RXGEN_SS_MARSHAL, n, + rxperf_abort_send_error); return n; } From nobody Fri Sep 25 23:53:30 2026 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id AAA4947ECC0 for ; Mon, 7 Sep 2026 11:38:21 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.133.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788781103; cv=none; b=eWEA7abyOh7Doe7hnQ5BmtMdPYcdqWgxXDXJ7zyqV7SyE7S50FsuLsl77oMvtYBC1J6+1nsotbVo/ehc4B9mZyKpNDv4ejhf+bLbt9c9Hs32gDYtBNU0Ysv86SUwwS76xEFdoQ9HrIoHiEOJjtheevsS7uOKRnFTQRbx5t7Fn2o= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788781103; c=relaxed/simple; bh=ZtEu2PHvw1SjfO0Lr2jDTuXPP33/9pkmn37mdyPY354=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=oL1IB0ni6AXa2jGhBllHyxKd5u0Clr5f6ZpggKiTyB4LhEHtolsOoD+6Us1CUPSyYEvH3wYYBlAynM0ZRuzudh7DRjevH8dH3+jQAn3tgsqiZe38mdX0xTESH3a80mWHyomSSdrEYFgeYod49BAuaPaAgQd5h5AZR5uRYtwdLfA= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=f30Xmty7; arc=none smtp.client-ip=170.10.133.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="f30Xmty7" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1788781100; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=kblW+4X0qELmQ+paYNuu36a6ezabX7pB4fI7hh59UYU=; b=f30Xmty7Z/ofZ+b+f/O7HYboFJDFb1hMFD/E2ORsbUvUN1YoFuxOvqorVjdgVDBMLEbbBd Uf0upsAN2rezO75xjEIQKRxQ1LXyvH5QJRyL7qrXf23WGxsEZ1fjvvEVmj8w1vsoUyGuKB u7tX5siTgypZKhOE/g3sbhtYK5eGDyc= Received: from mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-294-l32XF283Mnyr8ygzKrf1bA-1; Mon, 07 Sep 2026 07:38:15 -0400 X-MC-Unique: l32XF283Mnyr8ygzKrf1bA-1 X-Mimecast-MFC-AGG-ID: l32XF283Mnyr8ygzKrf1bA_1788781094 Received: from mx-prod-int-10.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-10.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.95]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 89707180137D; Mon, 7 Sep 2026 11:38:13 +0000 (UTC) Received: from warthog.com (unknown [10.44.32.158]) by mx-prod-int-10.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 9BFBA427; Mon, 7 Sep 2026 11:38:09 +0000 (UTC) From: David Howells To: netdev@vger.kernel.org Cc: David Howells , Marc Dionne , Jakub Kicinski , "David S. Miller" , Eric Dumazet , Paolo Abeni , Simon Horman , linux-afs@lists.infradead.org, linux-kernel@vger.kernel.org, Jeffrey Altman , stable@vger.kernel.org Subject: [PATCH net v9 04/14] rxrpc: Fix sendmsg to not return an error if last packet queued Date: Mon, 7 Sep 2026 12:37:31 +0100 Message-ID: <20260907113743.1453210-5-dhowells@redhat.com> In-Reply-To: <20260907113743.1453210-1-dhowells@redhat.com> References: <20260907113743.1453210-1-dhowells@redhat.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.6 on 10.30.177.95 Content-Type: text/plain; charset="utf-8" Fix AF_RXRPC sendmsg() so that it doesn't return an error if it has successfully queued the last packet of a call, but the call has seen to have completed after it did that. Rather, leave it to recvmsg() to report the completion (which it will do anyway). The problem with trying to report the error twice is that the caller may try to clean up the dead call twice. Fixes: 4ba68c519255 ("rxrpc: Return an error to sendmsg if call failed") Signed-off-by: David Howells cc: Marc Dionne cc: Jeffrey Altman cc: Eric Dumazet cc: "David S. Miller" cc: Jakub Kicinski cc: Paolo Abeni cc: Simon Horman cc: linux-afs@lists.infradead.org cc: stable@vger.kernel.org --- fs/afs/rxrpc.c | 2 +- net/rxrpc/sendmsg.c | 22 ++++++++++++++++------ 2 files changed, 17 insertions(+), 7 deletions(-) diff --git a/fs/afs/rxrpc.c b/fs/afs/rxrpc.c index 04756d8744e2..1f5b6aa68943 100644 --- a/fs/afs/rxrpc.c +++ b/fs/afs/rxrpc.c @@ -878,7 +878,7 @@ void afs_send_empty_reply(struct afs_call *call) =20 ret =3D rxrpc_kernel_send_data(net->socket, call->rxcall, &msg, 0, afs_notify_end_reply_tx); - if (ret >=3D 0) + if (ret >=3D 0) /* Shouldn't buffer more than 0 bytes. */ return; =20 rxrpc_kernel_abort_call(net->socket, call->rxcall, diff --git a/net/rxrpc/sendmsg.c b/net/rxrpc/sendmsg.c index ed2c9a51005a..1d66e9808162 100644 --- a/net/rxrpc/sendmsg.c +++ b/net/rxrpc/sendmsg.c @@ -453,9 +453,6 @@ static int rxrpc_send_data(struct rxrpc_sock *rx, =20 success: ret =3D copied; - if (rxrpc_call_is_complete(call) && - call->error < 0) - ret =3D call->error; out: call->tx_pending =3D txb; _leave(" =3D %d", ret); @@ -467,8 +464,14 @@ static int rxrpc_send_data(struct rxrpc_sock *rx, return call->error; =20 maybe_error: - if (copied) + if (copied) { + if (rxrpc_call_is_complete(call) && + call->error < 0) { + ret =3D call->error; + goto out; + } goto success; + } goto out; =20 efault: @@ -800,9 +803,16 @@ int rxrpc_do_sendmsg(struct rxrpc_sock *rx, struct msg= hdr *msg, size_t len) * Allow a kernel service to send data on a call. The call must be in an = state * appropriate to sending data. No control data should be supplied in @ms= g, * nor should an address be supplied. MSG_MORE should be flagged if there= 's - * more data to come, otherwise this data will end the transmission phase. + * more data to come, otherwise this data will end the transmission phase = if + * all the data is buffered. + * + * Note that this function may return a short send, in which case it shoul= d be + * called again for the remainder of the data or to pick up an error that + * caused the short send. * - * Return: %0 if successful and a negative error code otherwise. + * Return: The number of bytes buffered (could be %0 if @len is 0 or + * msg_iter holds 0 bytes) if successful and a negative error code + * otherwise. */ int rxrpc_kernel_send_data(struct socket *sock, struct rxrpc_call *call, struct msghdr *msg, size_t len, From nobody Fri Sep 25 23:53:30 2026 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 49C0B49480F for ; Mon, 7 Sep 2026 11:38:24 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.129.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788781105; cv=none; b=GrjVFv/B+lM3fBcse7SoeRM9cDR99kddxbO9hnoSLvO6esmve/jE0MDUpbAN0jdMpfGIvaKDn/5IuyqpAT533cRMbW6JmKjhP/Rhiadwu22p/rr2/9IUAR+HCROPOIwgNeZmL2oTHc3M93yS++oidpjqWZRhIbbETXlIRAJgi0E= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788781105; c=relaxed/simple; bh=Hs3L2JWkKOYuDzhkdd6k2DfZ0N5LOqcZOqLU7BkyZwM=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=sbHRtmbVBePdBTrQvYBqH6kwAT4UyYDuaFR6EPDJpQ6SdmezN3NEyWboZ9xlbIdaj6ZUcyWsxL0Tl0g5Y+BUUb+y4z3pUubRsDZnxh8lduu4QZVjHG7RP4dhHB/CSDFfpNsszirL/p7qmjSzbP04lijdy11VgtKMdxw1csibjwQ= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=dZRzGg/9; arc=none smtp.client-ip=170.10.129.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="dZRzGg/9" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1788781103; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=CXhFZ1mABywDeC+BzGLKbgEtDrREzsxnWbEq/vxDP4Q=; b=dZRzGg/9SxHabNPxhVV6fA/cgCbCkLEsFqp8kJ0KO4lv+5J0VAKXqG/qTgWKkQIS2qlrXL nTW68PTtAjEtbOK0tUPiHszsVEd388/EibnmmywcrBhpj52wyBqmYjpqL3N3GOpLBuL2iw Jo46mlYRUlwgmqvWEh/XbhSHmGG5qd8= Received: from mx-prod-mc-01.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-347-M1QlhbPePeKDOJfpQBwD7g-1; Mon, 07 Sep 2026 07:38:20 -0400 X-MC-Unique: M1QlhbPePeKDOJfpQBwD7g-1 X-Mimecast-MFC-AGG-ID: M1QlhbPePeKDOJfpQBwD7g_1788781098 Received: from mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.17]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-01.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 6728B1955DE1; Mon, 7 Sep 2026 11:38:18 +0000 (UTC) Received: from warthog.com (unknown [10.44.32.158]) by mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 1FF781956042; Mon, 7 Sep 2026 11:38:14 +0000 (UTC) From: David Howells To: netdev@vger.kernel.org Cc: David Howells , Marc Dionne , Jakub Kicinski , "David S. Miller" , Eric Dumazet , Paolo Abeni , Simon Horman , linux-afs@lists.infradead.org, linux-kernel@vger.kernel.org, Jeffrey Altman , stable@vger.kernel.org Subject: [PATCH net v9 05/14] rxrpc: Fix sendmsg length Date: Mon, 7 Sep 2026 12:37:32 +0100 Message-ID: <20260907113743.1453210-6-dhowells@redhat.com> In-Reply-To: <20260907113743.1453210-1-dhowells@redhat.com> References: <20260907113743.1453210-1-dhowells@redhat.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.0 on 10.30.177.17 Content-Type: text/plain; charset="utf-8" rxrpc_send_data() is given two data lengths (len and msg->msg_iter.count) and is inconsistent about how it uses them. Fix this by using len in preference to msg->msg_iter.count. Also limit the amount copied to either len or msg->msg_iter.count, whichever is smaller. Note that, currently, all the callers have len and msg->msg_iter.count the same and so the problem won't occur. Fixes: 382d7974de31 ("RxRPC: Use iov_iter_count() in rxrpc_send_data() inst= ead of the len argument") Signed-off-by: David Howells cc: Marc Dionne cc: Jeffrey Altman cc: Eric Dumazet cc: "David S. Miller" cc: Jakub Kicinski cc: Paolo Abeni cc: Simon Horman cc: linux-afs@lists.infradead.org cc: stable@vger.kernel.org --- net/rxrpc/sendmsg.c | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-) diff --git a/net/rxrpc/sendmsg.c b/net/rxrpc/sendmsg.c index 1d66e9808162..565799548102 100644 --- a/net/rxrpc/sendmsg.c +++ b/net/rxrpc/sendmsg.c @@ -379,9 +379,9 @@ static int rxrpc_send_data(struct rxrpc_sock *rx, =20 ret =3D -EMSGSIZE; if (call->tx_total_len !=3D -1) { - if (len - copied > call->tx_total_len) + if (len > call->tx_total_len) goto maybe_error; - if (!more && len - copied !=3D call->tx_total_len) + if (!more && len !=3D call->tx_total_len) goto maybe_error; } =20 @@ -405,7 +405,7 @@ static int rxrpc_send_data(struct rxrpc_sock *rx, * the security header is going to be in the padded * region (enc blocksize), but the trailer is not. */ - remain =3D more ? INT_MAX : msg_data_left(msg); + remain =3D more ? INT_MAX : len; txb =3D call->conn->security->alloc_txbuf(call, remain, sk->sk_allocati= on); if (!txb) { ret =3D -ENOMEM; @@ -416,8 +416,8 @@ static int rxrpc_send_data(struct rxrpc_sock *rx, _debug("append"); =20 /* append next segment of data to the current buffer */ - if (msg_data_left(msg) > 0) { - size_t copy =3D umin(txb->space, msg_data_left(msg)); + if (len > 0) { + size_t copy =3D min3(txb->space, len, msg_data_left(msg)); =20 _debug("add %zu", copy); if (!copy_from_iter_full(txb->data + txb->offset, @@ -428,6 +428,7 @@ static int rxrpc_send_data(struct rxrpc_sock *rx, txb->len +=3D copy; txb->offset +=3D copy; copied +=3D copy; + len -=3D copy; if (call->tx_total_len !=3D -1) call->tx_total_len -=3D copy; } @@ -439,8 +440,8 @@ static int rxrpc_send_data(struct rxrpc_sock *rx, =20 /* add the packet to the send queue if it's now full */ if (!txb->space || - (msg_data_left(msg) =3D=3D 0 && !more)) { - if (msg_data_left(msg) =3D=3D 0 && !more) + (len =3D=3D 0 && !more)) { + if (len =3D=3D 0 && !more) txb->flags |=3D RXRPC_LAST_PACKET; =20 ret =3D call->security->secure_packet(call, txb); @@ -449,7 +450,7 @@ static int rxrpc_send_data(struct rxrpc_sock *rx, rxrpc_queue_packet(rx, call, txb, notify_end_tx); txb =3D NULL; } - } while (msg_data_left(msg) > 0); + } while (len > 0 && msg_data_left(msg) > 0); =20 success: ret =3D copied; From nobody Fri Sep 25 23:53:30 2026 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id CC043499F37 for ; Mon, 7 Sep 2026 11:38:30 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.133.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788781112; cv=none; b=Zq0FPFCYlcoeRpr3qOhxGwj5ZUqVMwzA6QpT4zHmwPDpuMSwaPsZyDO/Y83dfgIZuZBKfhm1slhE40y33KLr2bJxm2JdvwE40fI1WUWaJkx+uLZmXw5WyBP5hXhBSq78b0WrOjnmMwturYOK8rB3xnaR+0OVys20T8VSwISe0T0= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788781112; c=relaxed/simple; bh=n1YdNQJiXH8fGwbWfaPUQZefpOVpAig+D9U4az+hWiA=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=dlwo/jozSWpJVLkKNuUkLHwHhP0Anp5s9z+f24gg3QLoURl6THVwS2ReVyuSMAj4Elj/Hj5SpL4G0eS2XRuqD1aQfg6CVs0WsrQx5ygMAeub/iPGDg9sl+erROZg2/8Nu/h21aGPgGAFZPnPGsU8vBM9+zi2v6hoplWOcSGD4yY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=IpTLzS35; arc=none smtp.client-ip=170.10.133.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="IpTLzS35" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1788781109; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=VfJ0b7lLuaZlI6ivE4yeY/awkgQjqwJ0GGi2sVpj0wY=; b=IpTLzS35KG+wH58F4w98REAJhID+dQ62kTo1yVDpIDsmfdW8aJApPBopAezl4OFfEHcsKi xyl5Bkb+LC7Nnje8BAzRCAqzOvwoHloK2/UNwle5Evt5iHwWa4NqcqfFyJSVB1ZiqmtCER dVqbpGDAuyDsQ3gHnqOO6ICqt6h217g= Received: from mx-prod-mc-01.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-610-Qb0MNS3EO_qiXBIfw6EK0A-1; Mon, 07 Sep 2026 07:38:24 -0400 X-MC-Unique: Qb0MNS3EO_qiXBIfw6EK0A-1 X-Mimecast-MFC-AGG-ID: Qb0MNS3EO_qiXBIfw6EK0A_1788781103 Received: from mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.4]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-01.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 0F4B51955DE1; Mon, 7 Sep 2026 11:38:23 +0000 (UTC) Received: from warthog.com (unknown [10.44.32.158]) by mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id EF61730001A2; Mon, 7 Sep 2026 11:38:19 +0000 (UTC) From: David Howells To: netdev@vger.kernel.org Cc: David Howells , Marc Dionne , Jakub Kicinski , "David S. Miller" , Eric Dumazet , Paolo Abeni , Simon Horman , linux-afs@lists.infradead.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org Subject: [PATCH net v9 06/14] rxrpc: Fix packet encryption error handling Date: Mon, 7 Sep 2026 12:37:33 +0100 Message-ID: <20260907113743.1453210-7-dhowells@redhat.com> In-Reply-To: <20260907113743.1453210-1-dhowells@redhat.com> References: <20260907113743.1453210-1-dhowells@redhat.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.4 Content-Type: text/plain; charset="utf-8" In rxrpc_send_data(), if ->secure_packet() returns an error, the code currently just jumps to out: and returns the error to the app on the assumption that any error returned by this is automatically fatal for the call, and may even have corrupted the transmission queue - but leaving it to userspace to deal with. Nothing stops the application from retrying the sendmsg(), which will try to encrypt the buffer again, and might succeed with a corrupt buffer. Fix rxrpc_send_data() in the following ways: (1) If -ENOMEM is returned, assume we never got as far as the encryption and that the operation is retryable. In which case, jump to maybe_error_rewind and, if we've copied data into the last packet, remove some of the bytes from it that we just added so that we don't tell the caller that we've completed the transmission phase. The iterator is also correspondingly rewound. (2) If any other error occurs, set the TX_ERROR flag on the call and return that error directly; on all subsequent attempts to add data to the call, return -EIO. The app must then abort the call to get rid of it (this allows the app to choose the abort code to use). (3) The TX_NO_MORE test is moved so that both it and the TX_ERROR test are repeated after a wait-for-space is performed. afs_make_call() and afs_send_simple_reply() are also modified to repeat calls to rxrpc_kernel_send_data() if less than a full transfer was made. Fixes: 17926a79320a ("[AF_RXRPC]: Provide secure RxRPC sockets for use by u= serspace and kernel both") Closes: https://sashiko.dev/#/patchset/20260702144919.172295-1-dhowells%40r= edhat.com Signed-off-by: David Howells cc: Marc Dionne cc: Eric Dumazet cc: "David S. Miller" cc: Jakub Kicinski cc: Paolo Abeni cc: Simon Horman cc: linux-afs@lists.infradead.org cc: stable@vger.kernel.org --- Documentation/networking/rxrpc.rst | 11 +++++- include/trace/events/rxrpc.h | 1 + net/rxrpc/ar-internal.h | 1 + net/rxrpc/sendmsg.c | 60 ++++++++++++++++++++++++------ 4 files changed, 60 insertions(+), 13 deletions(-) diff --git a/Documentation/networking/rxrpc.rst b/Documentation/networking/= rxrpc.rst index 8926dab8e2e6..7df6aff7644c 100644 --- a/Documentation/networking/rxrpc.rst +++ b/Documentation/networking/rxrpc.rst @@ -879,14 +879,21 @@ The kernel interface functions are as follows: exclusively to in-kernel virtual addresses. msg.msg_flags may be giv= en MSG_MORE if there will be subsequent data sends for this call. =20 - The msg must not specify a destination address, control data or any f= lags - other than MSG_MORE. len is the total amount of data to transmit. + msg must not specify a destination address, control data or any flags + other than MSG_MORE. len is the amount of data to add to the + transmission. The last-packet flag will only be set on the outgoing + packet if MSG_MORE is not set and len amount of bytes are buffered. =20 notify_end_rx can be NULL or it can be used to specify a function to = be called when the call changes state to end the Tx phase. This functio= n is called with a spinlock held to prevent the last DATA packet from being transmitted until the function returns. =20 + The function returns the amount of data buffered or an error. It will + return zero only if len is 0 or if msg->msg_iter is empty. It may al= so + make a short write, buffering less than the amount of data provided o= r the + len specified, in which case it should be called again. + (#) Receive data from a call:: =20 int rxrpc_kernel_recv_data(struct socket *sock, diff --git a/include/trace/events/rxrpc.h b/include/trace/events/rxrpc.h index 56dc9b614071..a5c92592d8f9 100644 --- a/include/trace/events/rxrpc.h +++ b/include/trace/events/rxrpc.h @@ -148,6 +148,7 @@ EM(rxrpc_eproto_wrong_security, "wrong-sec") \ EM(rxrpc_recvmsg_excess_data, "recvmsg-excess") \ EM(rxrpc_recvmsg_short_data, "recvmsg-short") \ + EM(rxrpc_sendmsg_tx_error, "tx-error") \ E_(rxrpc_sendmsg_late_send, "sendmsg-late") =20 #define rxrpc_call_poke_traces \ diff --git a/net/rxrpc/ar-internal.h b/net/rxrpc/ar-internal.h index 865f05fe37ab..a6f830c1621f 100644 --- a/net/rxrpc/ar-internal.h +++ b/net/rxrpc/ar-internal.h @@ -642,6 +642,7 @@ enum rxrpc_call_flag { RXRPC_CALL_TX_LAST, /* Last packet in Tx buffer (at rxtx_top) */ RXRPC_CALL_TX_ALL_ACKED, /* Last packet has been hard-acked */ RXRPC_CALL_TX_NO_MORE, /* No more data to transmit (MSG_MORE deasserted)= */ + RXRPC_CALL_TX_ERROR, /* Terminal error; call needs abort */ RXRPC_CALL_SEND_PING, /* A ping will need to be sent */ RXRPC_CALL_RETRANS_TIMEOUT, /* Retransmission due to timeout occurred */ RXRPC_CALL_BEGAN_RX_TIMER, /* We began the expect_rx_by timer */ diff --git a/net/rxrpc/sendmsg.c b/net/rxrpc/sendmsg.c index 565799548102..4ce3ae0ba2e8 100644 --- a/net/rxrpc/sendmsg.c +++ b/net/rxrpc/sendmsg.c @@ -330,13 +330,6 @@ static int rxrpc_send_data(struct rxrpc_sock *rx, bool more =3D msg->msg_flags & MSG_MORE; int ret, copied =3D 0; =20 - if (test_bit(RXRPC_CALL_TX_NO_MORE, &call->flags)) { - trace_rxrpc_abort(call->debug_id, rxrpc_sendmsg_late_send, - call->cid, call->call_id, call->rx_consumed, - 0, -EPROTO); - return -EPROTO; - } - timeo =3D sock_sndtimeo(sk, msg->msg_flags & MSG_DONTWAIT); =20 ret =3D rxrpc_wait_to_be_connected(call, &timeo); @@ -353,6 +346,21 @@ static int rxrpc_send_data(struct rxrpc_sock *rx, sk_clear_bit(SOCKWQ_ASYNC_NOSPACE, sk); =20 reload: + if (unlikely(test_bit(RXRPC_CALL_TX_NO_MORE, &call->flags))) { + trace_rxrpc_abort(call->debug_id, rxrpc_sendmsg_late_send, + call->cid, call->call_id, call->rx_consumed, + 0, -EPROTO); + ret =3D -EPROTO; + goto maybe_error; + } + if (unlikely(test_bit(RXRPC_CALL_TX_ERROR, &call->flags))) { + trace_rxrpc_abort(call->debug_id, rxrpc_sendmsg_tx_error, + call->cid, call->call_id, call->rx_consumed, + 0, -EIO); + ret =3D -EIO; + goto maybe_error; + } + txb =3D call->tx_pending; call->tx_pending =3D NULL; if (txb) @@ -441,12 +449,26 @@ static int rxrpc_send_data(struct rxrpc_sock *rx, /* add the packet to the send queue if it's now full */ if (!txb->space || (len =3D=3D 0 && !more)) { - if (len =3D=3D 0 && !more) - txb->flags |=3D RXRPC_LAST_PACKET; - + /* Do any required crypto. If this fails, it could + * have corrupted the txbuf content with a partial + * encrypt. Assume that ENOMEM is retryable, but + * everything else is terminal. + */ ret =3D call->security->secure_packet(call, txb); - if (ret < 0) + if (ret < 0) { + /* Assume that ENOMEM here means that the + * encryption hasn't happened yet. The data is + * aligned to avoid the need for slow buffering + * in the crypto walk. + */ + if (ret =3D=3D -ENOMEM) + goto maybe_error_rewind; + set_bit(RXRPC_CALL_TX_ERROR, &call->flags); goto out; + } + + if (len =3D=3D 0 && !more) + txb->flags |=3D RXRPC_LAST_PACKET; rxrpc_queue_packet(rx, call, txb, notify_end_tx); txb =3D NULL; } @@ -464,6 +486,22 @@ static int rxrpc_send_data(struct rxrpc_sock *rx, _leave(" =3D %d", call->error); return call->error; =20 +maybe_error_rewind: + /* If we got a retryable error after copying all the supplied data into + * the last packet, we need to rewind as much as we can so the caller + * knows they need to retry the sendmsg. + */ + if (copied && !more && !len) { + unsigned int rewind_by =3D umin(copied, txb->len); + + txb->space +=3D rewind_by; + txb->len -=3D rewind_by; + txb->offset -=3D rewind_by; + copied -=3D rewind_by; + if (call->tx_total_len !=3D -1) + call->tx_total_len +=3D rewind_by; + iov_iter_revert(&msg->msg_iter, rewind_by); + } maybe_error: if (copied) { if (rxrpc_call_is_complete(call) && From nobody Fri Sep 25 23:53:30 2026 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A7569499F3F for ; Mon, 7 Sep 2026 11:38:33 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.129.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788781115; cv=none; b=AJhrI0iVMOvdDjpU37xKA2zKYcJBr+6xyODw+pqhSGSKUQXJOgfDlMrBMyDiP3Mm9mhxK2wI4G/E6ZP/V32jJX2LaHhS85CuORbOvflpRl6UV/D1e9eG+4w5RDaWEkt8oOH9J/q6OaJUtpfpXnRmjLGgMeAhs4I3IBVhSNP5VgI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788781115; c=relaxed/simple; bh=65Br1auYBiiHj8wgAzhI7CcyzB0oho0ZsG+SnKoqrq0=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=j1rhiUwzjqAMz+XIDf7C0AivCCIwQh7SoyiV6SAOY3WOUnNH1J5zzKvydGvvG7fsCQLhkESmxZVYXJSoZ0Lafg5u7t6xn6k/2aTM+o5xAuduhV5I2K57mSPiGIiAQJOAu/iAHiovjlB8lMd1Q8j2xGD/U9kv2nTYctRKXLKWugw= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=axxL/ph6; arc=none smtp.client-ip=170.10.129.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="axxL/ph6" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1788781112; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=HP2muXCb2/7xiWXwklq1DL43HbQ2QGhMliF1aXSsjNI=; b=axxL/ph66Gk9JOpBa/QuSSd9Z8cqvuKGe5ftOs+WeFQvTmas48kNv1vI3Lws1F32zgGIqH v+rYNmlL3X4SlmB8kYs9tF9V3IwG2ySFtuyMAbT1oXU0Fd+27phuTruNyk6A4enkILzqjK qzu59UzR/h00XEWkEe9NWT0A2GA6b/Y= Received: from mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-641-2VOKuYX5PaWBPzFv0iXN-w-1; Mon, 07 Sep 2026 07:38:29 -0400 X-MC-Unique: 2VOKuYX5PaWBPzFv0iXN-w-1 X-Mimecast-MFC-AGG-ID: 2VOKuYX5PaWBPzFv0iXN-w_1788781108 Received: from mx-prod-int-08.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-08.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.111]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id B9A5B182FA53; Mon, 7 Sep 2026 11:38:27 +0000 (UTC) Received: from warthog.com (unknown [10.44.32.158]) by mx-prod-int-08.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id AD80C180034F; Mon, 7 Sep 2026 11:38:24 +0000 (UTC) From: David Howells To: netdev@vger.kernel.org Cc: David Howells , Marc Dionne , Jakub Kicinski , "David S. Miller" , Eric Dumazet , Paolo Abeni , Simon Horman , linux-afs@lists.infradead.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org Subject: [PATCH net v9 07/14] rxrpc: Fix update of call->tx_pending without holding lock Date: Mon, 7 Sep 2026 12:37:34 +0100 Message-ID: <20260907113743.1453210-8-dhowells@redhat.com> In-Reply-To: <20260907113743.1453210-1-dhowells@redhat.com> References: <20260907113743.1453210-1-dhowells@redhat.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.111 Content-Type: text/plain; charset="utf-8" Currently, rxrpc_send_data() updates call->tx_pending just before it returns - but it won't be holding the call->user_mutex when it does this if a wait was interrupted by a signal. This would allow a parallel sendmsg() to race. Further, both the callers of rxrpc_send_data() call it with the lock held, and then it returns an indication through the parameter list to say whether it has dropped the lock or not - after which the callers both just drop the lock if it's still held. Fix this by: (1) Moving the release of call->user_mutex down into rxrpc_send_data() and get rid of the indicator parameter. This makes it easier to see where the lock is held. (2) After waiting, if the attempt to reacquire the mutex is interrupted, just return directly there rather than going to out_unlock Note that there's a slight change in behaviour in that wait_for_space failure now doesn't check for completion because it doesn't hold the call user_mutex. The caller, however, should re-issue the send and pick up any error at a second attempt. Fixes: b0f571ecd794 ("rxrpc: Fix locking in rxrpc's sendmsg") Closes: https://sashiko.dev/#/patchset/20260702144919.172295-1-dhowells%40r= edhat.com Signed-off-by: David Howells cc: Marc Dionne cc: Eric Dumazet cc: "David S. Miller" cc: Jakub Kicinski cc: Paolo Abeni cc: Simon Horman cc: linux-afs@lists.infradead.org cc: stable@vger.kernel.org --- net/rxrpc/sendmsg.c | 48 ++++++++++++++++++++++----------------------- 1 file changed, 24 insertions(+), 24 deletions(-) diff --git a/net/rxrpc/sendmsg.c b/net/rxrpc/sendmsg.c index 4ce3ae0ba2e8..8bb327dc2833 100644 --- a/net/rxrpc/sendmsg.c +++ b/net/rxrpc/sendmsg.c @@ -320,8 +320,8 @@ static int rxrpc_alloc_txqueue(struct sock *sk, struct = rxrpc_call *call) static int rxrpc_send_data(struct rxrpc_sock *rx, struct rxrpc_call *call, struct msghdr *msg, size_t len, - rxrpc_notify_end_tx_t notify_end_tx, - bool *_dropped_lock) + rxrpc_notify_end_tx_t notify_end_tx) + __releases(&call->user_mutex) { struct rxrpc_txbuf *txb; struct sock *sk =3D &rx->sk; @@ -334,12 +334,12 @@ static int rxrpc_send_data(struct rxrpc_sock *rx, =20 ret =3D rxrpc_wait_to_be_connected(call, &timeo); if (ret < 0) - return ret; + goto out_unlock; =20 if (call->conn->state =3D=3D RXRPC_CONN_CLIENT_UNSECURED) { ret =3D rxrpc_init_client_conn_security(call->conn); if (ret < 0) - return ret; + goto out_unlock; } =20 /* this should be in poll */ @@ -464,7 +464,7 @@ static int rxrpc_send_data(struct rxrpc_sock *rx, if (ret =3D=3D -ENOMEM) goto maybe_error_rewind; set_bit(RXRPC_CALL_TX_ERROR, &call->flags); - goto out; + goto out_txb; } =20 if (len =3D=3D 0 && !more) @@ -476,15 +476,18 @@ static int rxrpc_send_data(struct rxrpc_sock *rx, =20 success: ret =3D copied; -out: +out_txb: call->tx_pending =3D txb; +out_unlock: + mutex_unlock(&call->user_mutex); _leave(" =3D %d", ret); return ret; =20 call_terminated: rxrpc_put_txbuf(txb, rxrpc_txbuf_put_send_aborted); - _leave(" =3D %d", call->error); - return call->error; + call->tx_pending =3D NULL; + ret =3D call->error; + goto out_unlock; =20 maybe_error_rewind: /* If we got a retryable error after copying all the supplied data into @@ -507,36 +510,38 @@ static int rxrpc_send_data(struct rxrpc_sock *rx, if (rxrpc_call_is_complete(call) && call->error < 0) { ret =3D call->error; - goto out; + goto out_txb; } goto success; } - goto out; + goto out_txb; =20 efault: ret =3D -EFAULT; - goto out; + goto out_txb; =20 wait_for_space: ret =3D -EAGAIN; if (msg->msg_flags & MSG_DONTWAIT) goto maybe_error; mutex_unlock(&call->user_mutex); - *_dropped_lock =3D true; + ret =3D rxrpc_wait_for_tx_window(rx, call, &timeo, msg->msg_flags & MSG_WAITALL); if (ret < 0) - goto maybe_error; + goto out_nolock; if (call->interruptibility =3D=3D RXRPC_INTERRUPTIBLE) { if (mutex_lock_interruptible(&call->user_mutex) < 0) { ret =3D sock_intr_errno(timeo); - goto maybe_error; + goto out_nolock; } } else { mutex_lock(&call->user_mutex); } - *_dropped_lock =3D false; goto reload; +out_nolock: + _leave(" =3D %d [intr]", ret); + return copied ?: ret; } =20 /* @@ -702,7 +707,6 @@ rxrpc_new_client_call_for_sendmsg(struct rxrpc_sock *rx= , struct msghdr *msg, int rxrpc_do_sendmsg(struct rxrpc_sock *rx, struct msghdr *msg, size_t len) { struct rxrpc_call *call; - bool dropped_lock =3D false; int ret; =20 struct rxrpc_send_params p =3D { @@ -811,16 +815,15 @@ int rxrpc_do_sendmsg(struct rxrpc_sock *rx, struct ms= ghdr *msg, size_t len) ret =3D 0; break; case RXRPC_CMD_SEND_DATA: - ret =3D rxrpc_send_data(rx, call, msg, len, NULL, &dropped_lock); - break; + ret =3D rxrpc_send_data(rx, call, msg, len, NULL); + goto error_put; default: ret =3D -EINVAL; break; } =20 out_put_unlock: - if (!dropped_lock) - mutex_unlock(&call->user_mutex); + mutex_unlock(&call->user_mutex); error_put: rxrpc_put_call(call, rxrpc_call_put_sendmsg); _leave(" =3D %d", ret); @@ -857,7 +860,6 @@ int rxrpc_kernel_send_data(struct socket *sock, struct = rxrpc_call *call, struct msghdr *msg, size_t len, rxrpc_notify_end_tx_t notify_end_tx) { - bool dropped_lock =3D false; int ret; =20 _enter("{%d},", call->debug_id); @@ -868,12 +870,10 @@ int rxrpc_kernel_send_data(struct socket *sock, struc= t rxrpc_call *call, mutex_lock(&call->user_mutex); =20 ret =3D rxrpc_send_data(rxrpc_sk(sock->sk), call, msg, len, - notify_end_tx, &dropped_lock); + notify_end_tx); if (ret =3D=3D -ESHUTDOWN) ret =3D call->error; =20 - if (!dropped_lock) - mutex_unlock(&call->user_mutex); _leave(" =3D %d", ret); return ret; } From nobody Fri Sep 25 23:53:30 2026 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1A85B49EC64 for ; Mon, 7 Sep 2026 11:38:38 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.133.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788781119; cv=none; b=bFZMrrErOyitHduDKLl0YjYvABD15Hi4ojZwFwr1sLGet2KVPwkghFAxHKBDPTTseItgII7qM6+A+bBxlzHOg8l5yEQ/EZknorryO1vuTEJ5C7nBxjOgzHBKYfasO5d9QaohZIZ2RkROI3MMXxI1AFmmAzKCBebwnz0Xi4W5efg= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788781119; c=relaxed/simple; bh=R+vDyZMcwZtPeSYXp7LPR+k2Zxh6L5h6f3+A0yiEABM=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=hs1QEOij53TM3QebaMHuU4ELnZ2/oVTgtnvzasOGpC83zaIVIlfPKLJBGcfhRt23mNHq2h9lwkPCF+QBtXZxwLVW55kZf+PfNBEA+c1p7F+cNXbXAnCBG7fXXYL2DfsX4KFrHVU6pPc/LBPNPheJWGc0zFWDoSNigZflgDTVfFI= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=IUEFyr/z; arc=none smtp.client-ip=170.10.133.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="IUEFyr/z" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1788781117; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=BRwiUko/ZuIdCZgQfYPgdfiRngNwWLuc9cEVQ2YL2IE=; b=IUEFyr/zn0M74siN6aflgT3p5H1uLkHeEuY3/3JzSeyzsztBElDJJ9Q7fG9kfzqIzTxeXs Nl6zCs25+5BdCcD+yj1xc3mhgbJ5u/UBn0jjFBeQuiDVxRQekOXjAqTHJBjqH+cxl4tm74 +gpxG1ywd1whlg/QNJPq9lOnNCC8lz0= Received: from mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-120-ocupbUFvOu2W2J_IBY4csw-1; Mon, 07 Sep 2026 07:38:34 -0400 X-MC-Unique: ocupbUFvOu2W2J_IBY4csw-1 X-Mimecast-MFC-AGG-ID: ocupbUFvOu2W2J_IBY4csw_1788781112 Received: from mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.17]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 9A98718009DE; Mon, 7 Sep 2026 11:38:32 +0000 (UTC) Received: from warthog.com (unknown [10.44.32.158]) by mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 4F31A1956044; Mon, 7 Sep 2026 11:38:29 +0000 (UTC) From: David Howells To: netdev@vger.kernel.org Cc: David Howells , Marc Dionne , Jakub Kicinski , "David S. Miller" , Eric Dumazet , Paolo Abeni , Simon Horman , linux-afs@lists.infradead.org, linux-kernel@vger.kernel.org, stable@kernel.org Subject: [PATCH net v9 08/14] rxrpc: Fix double IRQ enablement Date: Mon, 7 Sep 2026 12:37:35 +0100 Message-ID: <20260907113743.1453210-9-dhowells@redhat.com> In-Reply-To: <20260907113743.1453210-1-dhowells@redhat.com> References: <20260907113743.1453210-1-dhowells@redhat.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.0 on 10.30.177.17 Content-Type: text/plain; charset="utf-8" rxrpc_notify_socket() explicitly disables and then re-enables IRQs, but one of its call chains (rxrpc_input_queue_data() -> rxrpc_end_rx_phase() -> rxrpc_call_completed() -> rxrpc_set_call_completion()) has IRQs disabled around it. Fix this by making rxrpc_notify_socket() use irqsave spinlocks. Fixes: a2ea9a907260 ("rxrpc: Use irq-disabling spinlocks between app and I/= O thread") Link: https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260812110129.97= 9970-6-dhowells@redhat.com Signed-off-by: David Howells cc: Marc Dionne cc: Eric Dumazet cc: "David S. Miller" cc: Jakub Kicinski cc: Paolo Abeni cc: Simon Horman cc: linux-afs@lists.infradead.org cc: stable@kernel.org --- net/rxrpc/recvmsg.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/net/rxrpc/recvmsg.c b/net/rxrpc/recvmsg.c index efcba4b2e74f..56fa324d0962 100644 --- a/net/rxrpc/recvmsg.c +++ b/net/rxrpc/recvmsg.c @@ -24,6 +24,7 @@ void rxrpc_notify_socket(struct rxrpc_call *call) { struct rxrpc_sock *rx; struct sock *sk; + unsigned long flags; =20 _enter("%d", call->debug_id); =20 @@ -38,16 +39,16 @@ void rxrpc_notify_socket(struct rxrpc_call *call) sk =3D &rx->sk; if (rx && sk->sk_state < RXRPC_CLOSE) { if (call->notify_rx) { - spin_lock_irq(&call->notify_lock); + spin_lock_irqsave(&call->notify_lock, flags); call->notify_rx(sk, call, call->user_call_ID); - spin_unlock_irq(&call->notify_lock); + spin_unlock_irqrestore(&call->notify_lock, flags); } else { - spin_lock_irq(&rx->recvmsg_lock); + spin_lock_irqsave(&rx->recvmsg_lock, flags); if (list_empty(&call->recvmsg_link)) { rxrpc_get_call(call, rxrpc_call_get_notify_socket); list_add_tail(&call->recvmsg_link, &rx->recvmsg_q); } - spin_unlock_irq(&rx->recvmsg_lock); + spin_unlock_irqrestore(&rx->recvmsg_lock, flags); =20 if (!sock_flag(sk, SOCK_DEAD)) { _debug("call %ps", sk->sk_data_ready); From nobody Fri Sep 25 23:53:30 2026 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6C6AA481FB4 for ; Mon, 7 Sep 2026 11:38:44 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.129.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788781126; cv=none; b=CfFReqJbO85NCiT5sT51HkfhPS89H5MdXGI20ksC1uKbbhoS7Gfirfe9utByGeiyab/AuFs7VisH2qS2PuxW+Ir+tDVD87hnNiLFBirkzDjluNfq0/9wlyofi4NO1fIqKh8Rx7a1dGaYamkULboDHt2OJqgzvMHjOAbnYhAuTbg= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788781126; c=relaxed/simple; bh=TsDMA/MeL7R3gT7mdT45KJCnSy+kE9/LlWl5Rkg5/7Q=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=bTCD2i1mkShOS1C/eA2wcXhRNn6vFLCrzIkZIE8wWtT4Bj3zl7/dbSVUe9/FHEUGOx56BOJe9zEWzL7iSw0+79SaFBJoPcCuEsF52Qv5LaUQy9c3S3JND+0UX7+3IDO1ocGJmo6TOnC8kawZHl3V5UKuHZGLuExXTQMi9CV+aAU= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=TTsKigCN; arc=none smtp.client-ip=170.10.129.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="TTsKigCN" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1788781123; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=MUKRZg5p5RLsQwLnENs9+U5uoPXN8+g4eiTJcd+gods=; b=TTsKigCNOF66oidLfTZ47qYSFyklPagQiU/dl2W+XjXcI2QFmZnUHPyBLmXc40w/a35mMr W+YCByT3+IQhp435Q2AlB4mT2GwbublNeipX0c+UZF33p1FRyqqqQW5qRPKkQe/Rt3UXm0 oEGQGl6t31SY80jkdcknnIzgMYaNuOc= Received: from mx-prod-mc-05.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-75-9jh6N_ZpPKyasRKm6KeU3g-1; Mon, 07 Sep 2026 07:38:39 -0400 X-MC-Unique: 9jh6N_ZpPKyasRKm6KeU3g-1 X-Mimecast-MFC-AGG-ID: 9jh6N_ZpPKyasRKm6KeU3g_1788781117 Received: from mx-prod-int-06.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-06.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.93]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-05.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 468DB1954B3F; Mon, 7 Sep 2026 11:38:37 +0000 (UTC) Received: from warthog.com (unknown [10.44.32.158]) by mx-prod-int-06.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 1AADC1800348; Mon, 7 Sep 2026 11:38:33 +0000 (UTC) From: David Howells To: netdev@vger.kernel.org Cc: David Howells , Marc Dionne , Jakub Kicinski , "David S. Miller" , Eric Dumazet , Paolo Abeni , Simon Horman , linux-afs@lists.infradead.org, linux-kernel@vger.kernel.org, stable@kernel.org Subject: [PATCH net v9 09/14] rxrpc: Fix generation of notifications after call completion Date: Mon, 7 Sep 2026 12:37:36 +0100 Message-ID: <20260907113743.1453210-10-dhowells@redhat.com> In-Reply-To: <20260907113743.1453210-1-dhowells@redhat.com> References: <20260907113743.1453210-1-dhowells@redhat.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.93 Content-Type: text/plain; charset="utf-8" AF_RXRPC may generate a notification to the application after a call has completed because it generates one notification when rxrpc_input_split_jumbo() queues the final packet and completes the call and then generates another when rxrpc_input_split_jumbo() does the aggregated data receive notification at the end of the function. This might cause the AFS filesystem to malfunction because it tries to queue the afs_call for processing an extra time. Most of the time this happens quickly enough that the second queue_work skips, but sometimes this means that the call work may happen a second time with implications for afs_call lifetime management. Fix this by: (1) Create a lighter version of rxrpc_notify_socket() that's just used to requeue a call for rxrpc_recvmsg() without creating another notification. (2) Move rxrpc_notify_socket() to call_state.c and rename it to __rxrpc_notify_socket(). (3) Create a wrapper called rxrpc_notify_socket() that skips the notification if a call is completed. (4) Make rxrpc_set_call_completion() call __rxrpc_notify_socket() to avoid the skip-if-completed check. Also remove the comment on rxrpc_notify_socket() that said it added the call to a dummy queue to prevent further notification. Fixes: 2d1faf7a0ca3 ("rxrpc: Simplify skbuff accounting in receive path") Signed-off-by: David Howells cc: Marc Dionne cc: Eric Dumazet cc: "David S. Miller" cc: Jakub Kicinski cc: Paolo Abeni cc: Simon Horman cc: linux-afs@lists.infradead.org cc: stable@kernel.org --- include/trace/events/rxrpc.h | 1 + net/rxrpc/ar-internal.h | 2 +- net/rxrpc/call_state.c | 56 +++++++++++++++++++++++++++++++++++- net/rxrpc/recvmsg.c | 43 +++++++++------------------ 4 files changed, 71 insertions(+), 31 deletions(-) diff --git a/include/trace/events/rxrpc.h b/include/trace/events/rxrpc.h index a5c92592d8f9..52f8718cf725 100644 --- a/include/trace/events/rxrpc.h +++ b/include/trace/events/rxrpc.h @@ -343,6 +343,7 @@ EM(rxrpc_call_see_distribute_error, "SEE dist-err") \ EM(rxrpc_call_see_input, "SEE input ") \ EM(rxrpc_call_see_notify_released, "SEE nfy-rlsd") \ + EM(rxrpc_call_see_notify_skipped, "SEE nfy-skip") \ EM(rxrpc_call_see_recvmsg, "SEE recvmsg ") \ EM(rxrpc_call_see_recvmsg_requeue, "SEE recv-rqu") \ EM(rxrpc_call_see_recvmsg_requeue_first, "SEE recv-rqF") \ diff --git a/net/rxrpc/ar-internal.h b/net/rxrpc/ar-internal.h index a6f830c1621f..cb36a709f540 100644 --- a/net/rxrpc/ar-internal.h +++ b/net/rxrpc/ar-internal.h @@ -1110,6 +1110,7 @@ static inline bool rxrpc_is_client_call(const struct = rxrpc_call *call) /* * call_state.c */ +void rxrpc_notify_socket(struct rxrpc_call *call); bool rxrpc_set_call_completion(struct rxrpc_call *call, enum rxrpc_call_completion compl, u32 abort_code, @@ -1442,7 +1443,6 @@ extern const struct seq_operations rxrpc_local_seq_op= s; /* * recvmsg.c */ -void rxrpc_notify_socket(struct rxrpc_call *); int rxrpc_recvmsg(struct socket *, struct msghdr *, size_t, int); =20 /* diff --git a/net/rxrpc/call_state.c b/net/rxrpc/call_state.c index 6afb54373ebb..364810c65276 100644 --- a/net/rxrpc/call_state.c +++ b/net/rxrpc/call_state.c @@ -7,6 +7,60 @@ =20 #include "ar-internal.h" =20 +/* + * Post a call for attention by the socket or kernel service. + */ +static void __rxrpc_notify_socket(struct rxrpc_call *call) +{ + struct rxrpc_sock *rx; + struct sock *sk; + unsigned long flags; + + if (test_bit(RXRPC_CALL_RELEASED, &call->flags)) { + rxrpc_see_call(call, rxrpc_call_see_notify_released); + return; + } + + rcu_read_lock(); + + rx =3D rcu_dereference(call->socket); + sk =3D &rx->sk; + if (rx && sk->sk_state < RXRPC_CLOSE) { + if (call->notify_rx) { + spin_lock_irqsave(&call->notify_lock, flags); + call->notify_rx(sk, call, call->user_call_ID); + spin_unlock_irqrestore(&call->notify_lock, flags); + } else { + spin_lock_irqsave(&rx->recvmsg_lock, flags); + if (list_empty(&call->recvmsg_link)) { + rxrpc_get_call(call, rxrpc_call_get_notify_socket); + list_add_tail(&call->recvmsg_link, &rx->recvmsg_q); + } + spin_unlock_irqrestore(&rx->recvmsg_lock, flags); + + if (!sock_flag(sk, SOCK_DEAD)) { + _debug("call %ps", sk->sk_data_ready); + sk->sk_data_ready(sk); + } + } + } + + rcu_read_unlock(); +} + +/* + * Post a call for attention by the socket or kernel service. + */ +void rxrpc_notify_socket(struct rxrpc_call *call) +{ + if (rxrpc_call_is_complete(call)) { + rxrpc_see_call(call, rxrpc_call_see_notify_skipped); + return; + } + + __rxrpc_notify_socket(call); +} + /* * Transition a call to the complete state. */ @@ -25,7 +79,7 @@ bool rxrpc_set_call_completion(struct rxrpc_call *call, rxrpc_set_call_state(call, RXRPC_CALL_COMPLETE); trace_rxrpc_call_complete(call); wake_up(&call->waitq); - rxrpc_notify_socket(call); + __rxrpc_notify_socket(call); return true; } =20 diff --git a/net/rxrpc/recvmsg.c b/net/rxrpc/recvmsg.c index 56fa324d0962..28b2148b5693 100644 --- a/net/rxrpc/recvmsg.c +++ b/net/rxrpc/recvmsg.c @@ -17,14 +17,12 @@ #include "ar-internal.h" =20 /* - * Post a call for attention by the socket or kernel service. Further - * notifications are suppressed by putting recvmsg_link on a dummy queue. + * Requeue a call for recvmsg() to pick up. */ -void rxrpc_notify_socket(struct rxrpc_call *call) +static void rxrpc_requeue_call(struct socket *sock, struct rxrpc_call *cal= l) { - struct rxrpc_sock *rx; - struct sock *sk; - unsigned long flags; + struct rxrpc_sock *rx =3D rxrpc_sk(sock->sk); + struct sock *sk =3D &rx->sk; =20 _enter("%d", call->debug_id); =20 @@ -33,31 +31,18 @@ void rxrpc_notify_socket(struct rxrpc_call *call) return; } =20 - rcu_read_lock(); - - rx =3D rcu_dereference(call->socket); - sk =3D &rx->sk; - if (rx && sk->sk_state < RXRPC_CLOSE) { - if (call->notify_rx) { - spin_lock_irqsave(&call->notify_lock, flags); - call->notify_rx(sk, call, call->user_call_ID); - spin_unlock_irqrestore(&call->notify_lock, flags); - } else { - spin_lock_irqsave(&rx->recvmsg_lock, flags); - if (list_empty(&call->recvmsg_link)) { - rxrpc_get_call(call, rxrpc_call_get_notify_socket); - list_add_tail(&call->recvmsg_link, &rx->recvmsg_q); - } - spin_unlock_irqrestore(&rx->recvmsg_lock, flags); + spin_lock_irq(&rx->recvmsg_lock); + if (list_empty(&call->recvmsg_link)) { + rxrpc_get_call(call, rxrpc_call_get_notify_socket); + list_add_tail(&call->recvmsg_link, &rx->recvmsg_q); + } + spin_unlock_irq(&rx->recvmsg_lock); =20 - if (!sock_flag(sk, SOCK_DEAD)) { - _debug("call %ps", sk->sk_data_ready); - sk->sk_data_ready(sk); - } - } + if (!sock_flag(sk, SOCK_DEAD)) { + _debug("call %ps", sk->sk_data_ready); + sk->sk_data_ready(sk); } =20 - rcu_read_unlock(); _leave(""); } =20 @@ -562,7 +547,7 @@ int rxrpc_recvmsg(struct socket *sock, struct msghdr *m= sg, size_t len, =20 if (!(flags & MSG_PEEK) && !skb_queue_empty(&call->recvmsg_queue)) - rxrpc_notify_socket(call); + rxrpc_requeue_call(sock, call); goto not_yet_complete; =20 call_failed: From nobody Fri Sep 25 23:53:30 2026 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E1D8E4A1E1C for ; Mon, 7 Sep 2026 11:38:47 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.129.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788781130; cv=none; b=BGjrL1DZRVhUEGo/avAz7Azvfx6N8DiAAe4HVd6rYelHahyssU6nLXdT/06lxhMNhuSyCyafK7QJ/aDSSUpnVh7r5/8wWTR+dd5yhGQTH0h428oZGlGtWSaLEcbfFVhGCGMlZ0aqVF+btiYLRZcA5RteWDWz+wmqZXIK/1vcGp4= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788781130; c=relaxed/simple; bh=H8CelOzBhdyJycz+48X32xmmg9a1hcbq/jHJ8CGuWNY=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=nW2HHZ6av/By81c5ns3gPbdC3kmTt4RLRyCItmBixp9GP0J+BxykRSDxR1BVAVva2w/u56eMx7KvW1W/yI1b5Gu+s0pLLG61Tcsug2TOaBAJf0FZaHrV8UQGbdsPoT+Ns9Ei00lEhLx1a1RWBT0wAwSE8I6Efm1i7f6ig09AfA8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=W+rdNoxK; arc=none smtp.client-ip=170.10.129.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="W+rdNoxK" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1788781126; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=MCtf6xRVznBmbNbbW++7i1w457e6VKnTXFN367d2vAQ=; b=W+rdNoxKDqlJ105BQrZddq3zCU5djm3vfsXeFjQwdfh/u3X10UFVoP9D5AyZ6drNP5G7GC YtmwdzgCoZfy7vLkjZ6XcxQeE2EUYGKwo8KSf0iMvCJgJuPKxtjutE13WV2m6UlHWpEQ1s xs9z55Mch+BRkPwwYo1F1cDJw6bt434= Received: from mx-prod-mc-05.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-297-yjjAAUx8NEKwFfGsxt4i4A-1; Mon, 07 Sep 2026 07:38:43 -0400 X-MC-Unique: yjjAAUx8NEKwFfGsxt4i4A-1 X-Mimecast-MFC-AGG-ID: yjjAAUx8NEKwFfGsxt4i4A_1788781122 Received: from mx-prod-int-08.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-08.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.111]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-05.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 02F921954AFF; Mon, 7 Sep 2026 11:38:42 +0000 (UTC) Received: from warthog.com (unknown [10.44.32.158]) by mx-prod-int-08.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id E45C71800257; Mon, 7 Sep 2026 11:38:38 +0000 (UTC) From: David Howells To: netdev@vger.kernel.org Cc: David Howells , Marc Dionne , Jakub Kicinski , "David S. Miller" , Eric Dumazet , Paolo Abeni , Simon Horman , linux-afs@lists.infradead.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org Subject: [PATCH net v9 10/14] rxrpc: Fix RxGK key parser to check enctype is supported Date: Mon, 7 Sep 2026 12:37:37 +0100 Message-ID: <20260907113743.1453210-11-dhowells@redhat.com> In-Reply-To: <20260907113743.1453210-1-dhowells@redhat.com> References: <20260907113743.1453210-1-dhowells@redhat.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.111 Content-Type: text/plain; charset="utf-8" Fix the parser of RxGK keys supplied by userspace to check that the specified encryption type is supported. Fixes: 0ca100ff4df6 ("rxrpc: Add YFS RxGK (GSSAPI) security class") Link: https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260824091645.41= 5423-1-dhowells%40redhat.com Signed-off-by: David Howells cc: Marc Dionne cc: Eric Dumazet cc: "David S. Miller" cc: Jakub Kicinski cc: Paolo Abeni cc: Simon Horman cc: linux-afs@lists.infradead.org cc: stable@vger.kernel.org --- net/rxrpc/key.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/net/rxrpc/key.c b/net/rxrpc/key.c index a0aa78d89289..30d6db052c21 100644 --- a/net/rxrpc/key.c +++ b/net/rxrpc/key.c @@ -172,6 +172,7 @@ static int rxrpc_preparse_xdr_yfs_rxgk(struct key_prepa= rsed_payload *prep, const __be32 *ticket, *key; s64 tmp; size_t raw_keylen, raw_tktlen, keylen, tktlen; + int ret =3D -EKEYREJECTED; =20 _enter(",{%x,%x,%x,%x},%x", ntohl(xdr[0]), ntohl(xdr[1]), ntohl(xdr[2]), ntohl(xdr[3]), @@ -229,6 +230,11 @@ static int rxrpc_preparse_xdr_yfs_rxgk(struct key_prep= arsed_payload *prep, token->rxgk->key.data =3D token->rxgk->_key; token->rxgk->ticket.len =3D raw_tktlen; =20 + if (!crypto_krb5_find_enctype(token->rxgk->enctype)) { + ret =3D -ENOPKG; + goto reject_token; + } + if (token->rxgk->endtime !=3D 0) { expiry =3D rxrpc_s64_to_time64(token->rxgk->endtime); if (expiry < 0) @@ -280,7 +286,7 @@ static int rxrpc_preparse_xdr_yfs_rxgk(struct key_prepa= rsed_payload *prep, kfree(token->rxgk); kfree(token); reject: - return -EKEYREJECTED; + return ret; expired: kfree(token->rxgk); kfree(token); From nobody Fri Sep 25 23:53:30 2026 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A4B304A5C49 for ; Mon, 7 Sep 2026 11:38:52 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.133.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788781134; cv=none; b=D02uLBNqvbsovytGtUl3VjXR/gCiWmlxkJEXdDwUgkjs5FcXjxYHoJZJ7nDla7a71bQP+KDTZXuDPmZWncebxX44WCY4eRHrf9nED1MBeDFP5V1/GWPO2qHqxqTeEduqIH171buC98jVL9M4GKUKjwW+C0PrWFfbB1whEXIU9bM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788781134; c=relaxed/simple; bh=4rulRz/ACvzdMV65PymqWxPemkbqAcLLi8c99C7xCYs=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=if9VpLp5aQGOVAxP9f0Dstm0N7MZSnxsC2MjufvtyEk3TgBjTXlxATmfLgdJDpFiTAPjF2tp5cbjFrm4/j53711FGExDobwXI8+Pb4dPeW2hgsRtHWouLvgYoWmJWPj8WNfIqx7UyEN+fxnhSo/YgWiHFA4F9t+d0BdNJe8hdlg= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=JhN0uDR3; arc=none smtp.client-ip=170.10.133.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="JhN0uDR3" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1788781131; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=fPG3JCWqVjH93XC+uYutRtQ5wp+gmwXzPifpp4N5UQY=; b=JhN0uDR3IhLOlWU+uDWVAj4/mtXrC00B7Eknn3771gBkBr/SiVKJpNz4oD2tk1MWnc81zs nGkjkd00fA4HNvRDHungdljbA4FlCneELLuKeMHSXZw0eAFKPnR/c32gXAGV3OQ6MGQHlG wUwn8ASxjZhC+132jcn3Og3c5MmwRm8= Received: from mx-prod-mc-01.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-474-oAm3Z8qOPM-i-l067vioqA-1; Mon, 07 Sep 2026 07:38:48 -0400 X-MC-Unique: oAm3Z8qOPM-i-l067vioqA-1 X-Mimecast-MFC-AGG-ID: oAm3Z8qOPM-i-l067vioqA_1788781126 Received: from mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.4]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-01.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id A116F19540DB; Mon, 7 Sep 2026 11:38:46 +0000 (UTC) Received: from warthog.com (unknown [10.44.32.158]) by mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 8901130001A2; Mon, 7 Sep 2026 11:38:43 +0000 (UTC) From: David Howells To: netdev@vger.kernel.org Cc: David Howells , Marc Dionne , Jakub Kicinski , "David S. Miller" , Eric Dumazet , Paolo Abeni , Simon Horman , linux-afs@lists.infradead.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org Subject: [PATCH net v9 11/14] afs: Fix creation of RxGK CM channel token to have right size Date: Mon, 7 Sep 2026 12:37:38 +0100 Message-ID: <20260907113743.1453210-12-dhowells@redhat.com> In-Reply-To: <20260907113743.1453210-1-dhowells@redhat.com> References: <20260907113743.1453210-1-dhowells@redhat.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.4 Content-Type: text/plain; charset="utf-8" Fix afs_create_yfs_cm_token() so that it calculates the token size correctly, remembering to add in the 4 bytes of the level. Fixes: d98c317fd9aa ("afs: Use rxgk RESPONSE to pass token for callback cha= nnel") Link: https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260824091645.41= 5423-1-dhowells%40redhat.com Signed-off-by: David Howells cc: Marc Dionne cc: Eric Dumazet cc: "David S. Miller" cc: Jakub Kicinski cc: Paolo Abeni cc: Simon Horman cc: linux-afs@lists.infradead.org cc: stable@vger.kernel.org --- fs/afs/cm_security.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/afs/cm_security.c b/fs/afs/cm_security.c index 103168c70dd4..5eeeef761cf3 100644 --- a/fs/afs/cm_security.c +++ b/fs/afs/cm_security.c @@ -235,7 +235,7 @@ static int afs_create_yfs_cm_token(struct sk_buff *chal= lenge, * struct RXGK_AuthName identities<>; * }; */ - toksize =3D keysize + 8 + 4 + 4 + 8 + xdr_len_object(authsize); + toksize =3D keysize + 4 + 8 + 4 + 4 + 8 + xdr_len_object(authsize); =20 offset =3D 0; encsize =3D crypto_krb5_how_much_buffer(token_krb5, KRB5_ENCRYPT_MODE, to= ksize, &offset); From nobody Fri Sep 25 23:53:30 2026 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id ECB99483BF7 for ; Mon, 7 Sep 2026 11:38:55 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.129.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788781137; cv=none; b=Dg6p0yDE42dYY0P+aIy6jHYKqEstQtgAIpm0utUNSJRi6jT5NvANzfKF9/8vMPjGFcUTBDe9uTmWXREL2mKNiHd3LG8pYk7tTRwXO/4p81AIZc7CIu88gcOH3BrScgT0d2rK/+4GLy57gq+hhZunDsQwy0i8aZBpG7eEMpIvTdc= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788781137; c=relaxed/simple; bh=Nzi/FqImYPqXJEs6LFrx+Ut98+MzVTc2UR4XsymYE1A=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=dCS1NrmG9nT7hyDbudLrh9H3eD3RiftQ9LG8U2EzZajNbm83D913+qEAgmr0pi0s/NC1EZEX7KdU7gVsXm3SHcKEuWx/G+INUeU1hyWnkWaBSsqpu3rnVk/wxtETRb37Ga7qPn2iPx8JYBrIYBYYQ15R2VQWxnLH319T1CKOqxA= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=ED3w4k/o; arc=none smtp.client-ip=170.10.129.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="ED3w4k/o" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1788781135; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=LDbA/tBSiTsaFEYItL2PrPsX/0bFDHesm+RDDbpSdww=; b=ED3w4k/obAAl7xlqnXf39pfUfl9c3QL32x9z6IAyhpCD33lEE9roZ5QVYxyq5HMzXR0FOG epoliCoG2nj0GBjaHqES+QA6hFIOSQvSV5yrcPDfxKhNDVnYssQKoMVhMaoWE4wqydZlkU ySuIYf7Q2rXRHn7fdv+dfiqLMYdEAkM= Received: from mx-prod-mc-05.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-1-ft0pyjulOKOv4D0kkoa0Rg-1; Mon, 07 Sep 2026 07:38:53 -0400 X-MC-Unique: ft0pyjulOKOv4D0kkoa0Rg-1 X-Mimecast-MFC-AGG-ID: ft0pyjulOKOv4D0kkoa0Rg_1788781132 Received: from mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.12]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-05.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id E8AE819560B6; Mon, 7 Sep 2026 11:38:51 +0000 (UTC) Received: from warthog.com (unknown [10.44.32.158]) by mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 335D11955F0E; Mon, 7 Sep 2026 11:38:47 +0000 (UTC) From: David Howells To: netdev@vger.kernel.org Cc: David Howells , Marc Dionne , Jakub Kicinski , "David S. Miller" , Eric Dumazet , Paolo Abeni , Simon Horman , linux-afs@lists.infradead.org, linux-kernel@vger.kernel.org, Jeffrey Altman , Jarkko Sakkinen , keyrings@vger.kernel.org, stable@kernel.org Subject: [PATCH net v9 12/14] afs: Fix lack of setting call->server when doing FS.InlineBulkStatus Date: Mon, 7 Sep 2026 12:37:39 +0100 Message-ID: <20260907113743.1453210-13-dhowells@redhat.com> In-Reply-To: <20260907113743.1453210-1-dhowells@redhat.com> References: <20260907113743.1453210-1-dhowells@redhat.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.0 on 10.30.177.12 Content-Type: text/plain; charset="utf-8" Fix afs_make_op_call to set call->server. This will prevent afs_done_fs_inline_bulk_status() from oopsing if the server does not support the FS.InlineBulkStatus RPC due to call->server not being set. Note that this requires afs_make_op_call() to be moved so that it can use afs_use_server(); the server is un-used by afs_free_server(). Fixes: e49c7b2f6de7 ("afs: Build an abstraction around an "operation" conce= pt") Link: https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260824091645.41= 5423-1-dhowells%40redhat.com Signed-off-by: David Howells cc: Marc Dionne cc: Jeffrey Altman cc: Eric Dumazet cc: "David S. Miller" cc: Jakub Kicinski cc: Paolo Abeni cc: Simon Horman cc: Jarkko Sakkinen cc: linux-afs@lists.infradead.org cc: keyrings@vger.kernel.org cc: stable@kernel.org --- fs/afs/internal.h | 33 +++++++++++++++++---------------- include/trace/events/afs.h | 1 + 2 files changed, 18 insertions(+), 16 deletions(-) diff --git a/fs/afs/internal.h b/fs/afs/internal.h index 290873bac89b..65a0866cd8b8 100644 --- a/fs/afs/internal.h +++ b/fs/afs/internal.h @@ -1416,22 +1416,6 @@ static inline void afs_see_call(struct afs_call *cal= l, enum afs_call_trace why) __builtin_return_address(0)); } =20 -static inline void afs_make_op_call(struct afs_operation *op, struct afs_c= all *call, - gfp_t gfp) -{ - struct afs_addr_list *alist =3D op->estate->addresses; - - op->call =3D afs_get_call(call, afs_call_trace_get); - op->type =3D call->type; - call->op =3D op; - call->key =3D op->key; - call->intr =3D !(op->flags & AFS_OPERATION_UNINTR); - call->peer =3D rxrpc_kernel_get_peer(alist->addrs[op->addr_index].peer); - call->service_id =3D op->server->service_id; - afs_make_call(call, gfp); - afs_put_call(call); -} - static inline void afs_extract_begin(struct afs_call *call, void *buf, siz= e_t size) { call->iov_len =3D size; @@ -1763,6 +1747,23 @@ static inline struct inode *AFS_VNODE_TO_I(struct af= s_vnode *vnode) return &vnode->netfs.inode; } =20 +static inline void afs_make_op_call(struct afs_operation *op, struct afs_c= all *call, + gfp_t gfp) +{ + struct afs_addr_list *alist =3D op->estate->addresses; + + op->call =3D afs_get_call(call, afs_call_trace_get); + op->type =3D call->type; + call->op =3D op; + call->server =3D afs_use_server(op->server, false, afs_server_trace_use_c= all); + call->key =3D op->key; + call->intr =3D !(op->flags & AFS_OPERATION_UNINTR); + call->peer =3D rxrpc_kernel_get_peer(alist->addrs[op->addr_index].peer); + call->service_id =3D op->server->service_id; + afs_make_call(call, gfp); + afs_put_call(call); +} + /* * Note that a dentry got changed. We need to set d_fsdata to the data ve= rsion * number derived from the result of the operation. It doesn't matter if diff --git a/include/trace/events/afs.h b/include/trace/events/afs.h index 1b3c48b5591d..04b0bb682b81 100644 --- a/include/trace/events/afs.h +++ b/include/trace/events/afs.h @@ -148,6 +148,7 @@ enum yfs_cm_operation { EM(afs_server_trace_unuse_slist_isort, "UNU isort") \ EM(afs_server_trace_update, "UPDATE ") \ EM(afs_server_trace_use_by_uuid, "USE uuid ") \ + EM(afs_server_trace_use_call, "USE call ") \ EM(afs_server_trace_use_cm_call, "USE cm-cl") \ EM(afs_server_trace_use_get_caps, "USE gcaps") \ EM(afs_server_trace_use_give_up_cb, "USE gvupc") \ From nobody Fri Sep 25 23:53:30 2026 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9A769486E7D for ; Mon, 7 Sep 2026 11:39:04 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.133.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788781146; cv=none; b=ncqq6sqE5ZBP2q71u653cQXKNsTpb1Sq0m9oGzSfDHIGs1Rk/Garj5sJz4homo48g7avuc8H3Lh02zduXwT067HpQZaUNZYG2zd78J6d93MP/2YYcXe8ZgBeY3ZVrxdIR06ApBTFK0QveLTBi73IT4Bap0w6tbg2StkLoHjM80A= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788781146; c=relaxed/simple; bh=hNd6bIyFAvlFxc6hjuFcDqVwVqg86Zvx1YHzqvt4tLo=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=K+Ei0Y9j5r3LQoteXFpuKTtQjHhGL60+c1SyTKzJbK59X1Hbd1eqywnD7lR2hr8olGitL09G9xjIXfXt34toN5ZybLYB0sbYkgs5IM45kALGRys8EtmAM320/SFbZzDuf3Ykjs8PQTWIB+C6fjBVf1R2a6VR6UsuVK80MesiomE= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=Nch8TyND; arc=none smtp.client-ip=170.10.133.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="Nch8TyND" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1788781143; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=HHCKmh+GTex17viqHU7+p3b1kZPrhM46bDIsKbGkEho=; b=Nch8TyNDlnwLos5cevYWHtv6Dk8AHrv6EQM1q10NAs8gzZC+VPgYEV7tyqGPk6Z/CvUrlE tyDs7uG8Y2PSOMymOWqdeWGi6B52Ms5ceX/J/dkQrJTIzPLMIPUIuhHcHeMqqAoplw+iiB 6cE7g5p9iRolU8Ddc5CSGvt+FSENxgI= Received: from mx-prod-mc-05.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-264-3OA5z2N7Niam5fyVXGe7bA-1; Mon, 07 Sep 2026 07:38:59 -0400 X-MC-Unique: 3OA5z2N7Niam5fyVXGe7bA-1 X-Mimecast-MFC-AGG-ID: 3OA5z2N7Niam5fyVXGe7bA_1788781138 Received: from mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.4]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-05.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id CC0BD19540DE; Mon, 7 Sep 2026 11:38:57 +0000 (UTC) Received: from warthog.com (unknown [10.44.32.158]) by mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 89F2530001A2; Mon, 7 Sep 2026 11:38:53 +0000 (UTC) From: David Howells To: netdev@vger.kernel.org Cc: David Howells , Marc Dionne , Jakub Kicinski , "David S. Miller" , Eric Dumazet , Paolo Abeni , Simon Horman , linux-afs@lists.infradead.org, linux-kernel@vger.kernel.org, Seungwon Bae , stable@vger.kernel.org Subject: [PATCH net v9 13/14] rxrpc: fix use-after-free in rxrpc_poke_conn() Date: Mon, 7 Sep 2026 12:37:40 +0100 Message-ID: <20260907113743.1453210-14-dhowells@redhat.com> In-Reply-To: <20260907113743.1453210-1-dhowells@redhat.com> References: <20260907113743.1453210-1-dhowells@redhat.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.4 Content-Type: text/plain; charset="utf-8" From: Seungwon Bae rxrpc_poke_conn() takes a reference on the connection with no liveness check, unlike its sibling rxrpc_queue_conn() which gates on atomic_read(&conn->active) >=3D 0. The per-connection timer is armed with no reference held for it, and rxrpc_put_connection() cancels it with a non-synchronous timer_delete() only after the refcount reaches 0. refcount_t saturates rather than resurrecting, so the connection can be kfree()d while still linked in local->conn_attend_q (nothing in teardown unlinks attend_link). The rxrpc I/O thread then performs a UAF write (list_del_init) plus UAF reads and indirect calls through conn->security. Reproduced on a KASAN + PREEMPT kernel: 56 "refcount_t: addition on 0" saturations at load, escalating to BUG: KASAN: slab-use-after-free in rxrpc_io_thread Write of size 8 AF_RXRPC socket creation (rxrpc_create) has no capability check, so this is reachable by an unprivileged user. Guard rxrpc_poke_conn() with the same liveness/refcount check the sibling rxrpc_queue_conn() uses before taking the poke reference, so a connection past its last-active point is not poked/requeued after teardown began. Verified before/after on KASAN+PREEMPT at equal timer volume: 56 saturations + 15 KASAN reports unpatched vs 0 and 0 patched. Fixes: f2cce89a074e ("rxrpc: Implement a mechanism to send an event notific= ation to a connection") Signed-off-by: Seungwon Bae Signed-off-by: David Howells cc: Marc Dionne cc: Eric Dumazet cc: "David S. Miller" cc: Jakub Kicinski cc: Paolo Abeni cc: Simon Horman cc: linux-afs@lists.infradead.org cc: stable@vger.kernel.org --- net/rxrpc/conn_object.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/net/rxrpc/conn_object.c b/net/rxrpc/conn_object.c index 0ece717db0f8..1be50e0c9cee 100644 --- a/net/rxrpc/conn_object.c +++ b/net/rxrpc/conn_object.c @@ -34,7 +34,10 @@ void rxrpc_poke_conn(struct rxrpc_connection *conn, enum= rxrpc_conn_trace why) spin_lock_irq(&local->lock); busy =3D !list_empty(&conn->attend_link); if (!busy) { - rxrpc_get_connection(conn, why); + if (!rxrpc_get_connection_maybe(conn, why)) { + spin_unlock_irq(&local->lock); + return; + } list_add_tail(&conn->attend_link, &local->conn_attend_q); } spin_unlock_irq(&local->lock); From nobody Fri Sep 25 23:53:30 2026 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 33DED4ADD8C for ; Mon, 7 Sep 2026 11:39:08 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.133.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788781149; cv=none; b=e6ZJn1BxpaAzJv7sBoCTVlNp1C7i7C2SCn0dt7Gce6P8HPkaAqiaUarQSyB8vNDXcFwZmzl0BF4KfqCFflEq2cqDauFmVPr1kPW/M5I1uUSbfJfIXVxD6brj9H+vca/rtYB0I/EscBeYQiK1IZgfCuVWf48/cQ9vyCLealibNzo= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788781149; c=relaxed/simple; bh=dq6JvsI/jNN+xx3oqp5h32L/PtDtEz2jrI6gO+wTr7w=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=pGvtl3EYj0mSRPAH+nIgRll/gSrG7A3hViAPUzZqHniC2qjsdjuOU7mP6gVpMSFp/TbkNDYbKD4/hUMIhzsSmW4M+uFYJn9cSnTuKslaK8OfSxOe1K6BHDcUbUEDZOxaQUEc+YMhFrteB7zjtEn0J8+QnvA/NFmPCUf711QQGn8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=MaTtEw/J; arc=none smtp.client-ip=170.10.133.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="MaTtEw/J" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1788781147; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=7bnZX78xLpA1SrjplgD6zRqvHIJMbFWF4J8SNmE5f/c=; b=MaTtEw/JH2jNVErzqMPLkSZopbGSBC+o6HrVxl+dp6ztQ15u5OQTaD57HrDmkt15WwzZfS jq3QyuRSsC45PouJ4rPnYrr1E5gU0aGka5K5Iz6F2FHx6zplCc3QE8TwhHW4AE+TB9116x +EPDOUpVUAfVhIvmijX9zlZAnmFNLOk= Received: from mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-436-7O9EPnsDOuaN2S2plpZ7wA-1; Mon, 07 Sep 2026 07:39:04 -0400 X-MC-Unique: 7O9EPnsDOuaN2S2plpZ7wA-1 X-Mimecast-MFC-AGG-ID: 7O9EPnsDOuaN2S2plpZ7wA_1788781142 Received: from mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.17]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id A70201828AD4; Mon, 7 Sep 2026 11:39:02 +0000 (UTC) Received: from warthog.com (unknown [10.44.32.158]) by mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 6234D1956042; Mon, 7 Sep 2026 11:38:59 +0000 (UTC) From: David Howells To: netdev@vger.kernel.org Cc: David Howells , Marc Dionne , Jakub Kicinski , "David S. Miller" , Eric Dumazet , Paolo Abeni , Simon Horman , linux-afs@lists.infradead.org, linux-kernel@vger.kernel.org, Chengfeng Ye , stable@vger.kernel.org Subject: [PATCH net v9 14/14] rxrpc: Take write lock when publishing the initial RxGK key Date: Mon, 7 Sep 2026 12:37:41 +0100 Message-ID: <20260907113743.1453210-15-dhowells@redhat.com> In-Reply-To: <20260907113743.1453210-1-dhowells@redhat.com> References: <20260907113743.1453210-1-dhowells@redhat.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.0 on 10.30.177.17 Content-Type: text/plain; charset="utf-8" From: Chengfeng Ye rxgk_rekey() updates the transport-key ring under security_use_lock, and rxgk_get_key() takes a reference under the corresponding read lock. The initial publication in rxgk_init_connection_security() writes conn->rxgk.enctype and conn->rxgk.keys[] without the write lock. On a client connection, a second sendmsg can observe RXRPC_CONN_CLIENT through a lockless load of conn->state, skip rxrpc_init_client_conn_security(), and call rxgk_get_key() without ever acquiring security_lock. Because the initializer never took the write lock, the reader's read lock provides neither exclusion nor a matching acquire-release pair. Concurrent RxGK key consumers were observed in a two-sender workload. KCSAN reported: BUG: KCSAN: data-race in rxgk_get_key / rxgk_secure_packet write to 0xffff8aef4023c318 of 8 bytes by task 1968 on cpu 0: rxgk_secure_packet+0x46c/0x820 rxrpc_send_data+0x562/0x1a20 rxrpc_do_sendmsg+0x976/0xa80 rxrpc_sendmsg+0x20f/0x2a0 read to 0xffff8aef4023c318 of 8 bytes by task 1969 on cpu 1: rxgk_get_key+0x209/0x5e0 rxgk_alloc_txbuf+0xa4/0x2a0 rxrpc_send_data+0x8e2/0x1a20 rxrpc_do_sendmsg+0x976/0xa80 rxrpc_sendmsg+0x20f/0x2a0 value changed: 0x7fffffffffffffff -> 0x7fffffffffffffee That report is on the key context's byte counter rather than the initial publication, but it shows that lookup and secured transmit already overlap on the same connection. Take security_use_lock for writing while publishing the initial enctype and transport key, matching the locking used when rekeying. Fixes: 9d1d2b59341f ("rxrpc: rxgk: Implement the yfs-rxgk security class (G= SSAPI)") Signed-off-by: Chengfeng Ye Signed-off-by: David Howells cc: Marc Dionne cc: Eric Dumazet cc: "David S. Miller" cc: Jakub Kicinski cc: Paolo Abeni cc: Simon Horman cc: linux-afs@lists.infradead.org cc: stable@vger.kernel.org --- net/rxrpc/rxgk.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/rxrpc/rxgk.c b/net/rxrpc/rxgk.c index 77a67ace1d24..b49221f57f67 100644 --- a/net/rxrpc/rxgk.c +++ b/net/rxrpc/rxgk.c @@ -251,8 +251,10 @@ static int rxgk_init_connection_security(struct rxrpc_= connection *conn, GFP_NOFS); if (IS_ERR(gk)) return PTR_ERR(gk); + write_lock(&conn->security_use_lock); conn->rxgk.enctype =3D gk->krb5->etype; conn->rxgk.keys[gk->key_number & 3] =3D gk; + write_unlock(&conn->security_use_lock); =20 switch (conn->security_level) { case RXRPC_SECURITY_PLAIN: