From nobody Thu Sep 24 12:50:58 2026 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8E91751FCB8 for ; Wed, 23 Sep 2026 13:37:31 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.129.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790170653; cv=none; b=YcETHh6+kGmDo7FgKWS9w+bKweJn36JaDvPA1E/DLN2s55yhjn4EbeiCGotxzd6dTgohv0YRVDLRnL4FaSWStLcH49nPkjCtu/1R7jNQwbFChh+SPDRpFqK1x4cs1uLXs3+z34wmd7wI4DyKR+72Vw57FnFKDykGwVXu9pSIBKc= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790170653; c=relaxed/simple; bh=FWaRv3kf9APlFjcIzyaybvvNmgnIfAt26p/skW9RPu4=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=N2LIyv7OZLQbbE+TYBFbraVOD6hyxAsaA3qFxVUg9N+rzKWrDvHYadwQPmNdLeO/wo1SOvQJ2SuNsNXslEztYQ9C5UT8ABHhnecymQs8kSpu52EdEq9Nl3Im77uTUnjpciXQ++wJ1lC5stAVjQtkcjIOkvsOh6MJFkg3mekGggU= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=f/u0UuGv; arc=none smtp.client-ip=170.10.129.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="f/u0UuGv" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1790170650; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=s+c9Y0t5SKsPrOe0nx0dWN7zTgZlRH54f91QGpPHh3Y=; b=f/u0UuGvsUmyTgaHpkA6IVs83cw7zg+cyaw+ttoNhk+kvaOD41an1w1aAQu+t9Q+ETrGFa EEsvAoZxBfBiATNEUB3/Q/vpnQONJxighsA/rOOu86eRyoE7yqorw+186gZYxnSBGwJ4nt mJETcjvWa/o0x9C9c7hIpJtiNQNf7ec= Received: from mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-215-W9A4yalKMG6elUo2_AFlaQ-1; Wed, 23 Sep 2026 09:37:26 -0400 X-MC-Unique: W9A4yalKMG6elUo2_AFlaQ-1 X-Mimecast-MFC-AGG-ID: W9A4yalKMG6elUo2_AFlaQ_1790170643 Received: from mx-prod-int-10.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-10.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.95]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 2A084180074A; Wed, 23 Sep 2026 13:37:23 +0000 (UTC) Received: from warthog.com (unknown [10.44.32.54]) by mx-prod-int-10.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 159CE418; Wed, 23 Sep 2026 13:37:19 +0000 (UTC) From: David Howells To: netdev@vger.kernel.org Cc: David Howells , Marc Dionne , Jakub Kicinski , "David S. Miller" , Eric Dumazet , Paolo Abeni , Simon Horman , linux-afs@lists.infradead.org, linux-kernel@vger.kernel.org Subject: [PATCH net v11 01/17] rxrpc: Revert "rxrpc: rxperf: Fix missing decoding of terminal magic cookie" Date: Wed, 23 Sep 2026 14:36:48 +0100 Message-ID: <20260923133706.1496540-2-dhowells@redhat.com> In-Reply-To: <20260923133706.1496540-1-dhowells@redhat.com> References: <20260923133706.1496540-1-dhowells@redhat.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.6 on 10.30.177.95 Content-Type: text/plain; charset="utf-8" Revert commit c34d999ca3145d9fe858258cc3342ec493f47d2e: The rxperf RPCs seem to have a magic cookie at the end of the request that was failing to be taken account of by the unmarshalling of the request. Fix the rxperf code to expect this. Actually, this isn't true; it's just that other Rx implementations ignore the extra data in the request and so my test programs are sending too much data without noticeable consequence. Fixes: c34d999ca314 ("rxrpc: rxperf: Fix missing decoding of terminal magic= cookie") Signed-off-by: David Howells cc: Marc Dionne cc: Eric Dumazet cc: "David S. Miller" cc: Jakub Kicinski cc: Paolo Abeni cc: Simon Horman cc: linux-afs@lists.infradead.org --- net/rxrpc/rxperf.c | 12 ------------ 1 file changed, 12 deletions(-) diff --git a/net/rxrpc/rxperf.c b/net/rxrpc/rxperf.c index b8df6d22314d..f1f41151589c 100644 --- a/net/rxrpc/rxperf.c +++ b/net/rxrpc/rxperf.c @@ -483,18 +483,6 @@ static int rxperf_deliver_request(struct rxperf_call *= call) call->unmarshal++; fallthrough; case 2: - ret =3D rxperf_extract_data(call, true); - if (ret < 0) - return ret; - - /* Deal with the terminal magic cookie. */ - call->iov_len =3D 4; - call->kvec[0].iov_len =3D call->iov_len; - call->kvec[0].iov_base =3D call->tmp; - iov_iter_kvec(&call->iter, READ, call->kvec, 1, call->iov_len); - call->unmarshal++; - fallthrough; - case 3: ret =3D rxperf_extract_data(call, false); if (ret < 0) return ret; From nobody Thu Sep 24 12:50:58 2026 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id EF3D4489FB0 for ; Wed, 23 Sep 2026 13:37:34 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.133.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790170657; cv=none; b=HL7nUXmT+/p7UU0FecKdoOQcy3HI5Y/vPndB6U0CAFADbtUsCI8uezh+Oq1JO+yXMEXDTOwHW7vYf+V4QQquMcOXcfJKHYREnvyJOFTpD4xbalDa1JjTPrJaoB9bBPz4TS1hT/Tbcet8FTWv0HVsngqZyfjm1wYLSaPLTCHXsO8= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790170657; c=relaxed/simple; bh=rP8aHHu5Bkp8yoYoNyYcWejJ2NBAV1DEmgmqAtzlFQ4=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=RjivbhTYp3rfap6U6nSkbzZJWeOF2pn0feccuSNBCJmauZy0BnnI8MryLRsEZnyhAfD3eXdHFihIQIpaYrc08WpYnLHxup2bRq/bwQEaXrTnk2C66uwpk9jK1qrPLrYqyb9kQamc/1EtbR0ZDWWEQ9IKOPj2i2kBT+R0E5r4mJo= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=LyVAaVgg; arc=none smtp.client-ip=170.10.133.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="LyVAaVgg" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1790170653; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=D6J8zcfjJGXzyEQooABwNDMn3L1SBB4UGC/mafu55wA=; b=LyVAaVgg9D5Bass+I7SRmrHPutpYLlsY3pRywuVVakW1FOU9V/EI7IglV6vJ+N8ydNMrba h8U74/IeCmjf6Gfx2Tt0iHyGZiO7GGg+Tg7Xexz0VHA0LSmpKQ8RSCNRhCuTlMh0KdgdKH 2sXybeoxDFBsYRJLP0jycjgdPnwP/8M= Received: from mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-558-TObKH2AWNTS8I9FtVwtQ_A-1; Wed, 23 Sep 2026 09:37:30 -0400 X-MC-Unique: TObKH2AWNTS8I9FtVwtQ_A-1 X-Mimecast-MFC-AGG-ID: TObKH2AWNTS8I9FtVwtQ_A_1790170649 Received: from mx-prod-int-06.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-06.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.93]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id C5E6018011FE; Wed, 23 Sep 2026 13:37:28 +0000 (UTC) Received: from warthog.com (unknown [10.44.32.54]) by mx-prod-int-06.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id B679A1800473; Wed, 23 Sep 2026 13:37:24 +0000 (UTC) From: David Howells To: netdev@vger.kernel.org Cc: David Howells , Marc Dionne , Jakub Kicinski , "David S. Miller" , Eric Dumazet , Paolo Abeni , Simon Horman , linux-afs@lists.infradead.org, linux-kernel@vger.kernel.org, Jeffrey Altman Subject: [PATCH net v11 02/17] rxrpc: Fix rxperf test rxgk key kvno to be 0 Date: Wed, 23 Sep 2026 14:36:49 +0100 Message-ID: <20260923133706.1496540-3-dhowells@redhat.com> In-Reply-To: <20260923133706.1496540-1-dhowells@redhat.com> References: <20260923133706.1496540-1-dhowells@redhat.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.93 Content-Type: text/plain; charset="utf-8" Fix the test rxgk keys in the rxperf test server to have kvno 0 to match other implementations. Fixes: aa2199088a39 ("rxrpc: rxperf: Add test RxGK server keys") Signed-off-by: David Howells cc: Marc Dionne cc: Jeffrey Altman cc: Eric Dumazet cc: "David S. Miller" cc: Jakub Kicinski cc: Paolo Abeni cc: Simon Horman cc: linux-afs@lists.infradead.org --- net/rxrpc/rxperf.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/rxrpc/rxperf.c b/net/rxrpc/rxperf.c index f1f41151589c..26f97e1dd388 100644 --- a/net/rxrpc/rxperf.c +++ b/net/rxrpc/rxperf.c @@ -586,7 +586,7 @@ static int rxperf_add_yfs_rxgk_key(struct key *keyring,= u32 enctype) for (int i =3D 0; i < krb5->key_len; i++) key[i] =3D i; =20 - sprintf(name, "%u:6:1:%u", RX_PERF_SERVICE, enctype); + sprintf(name, "%u:6:0:%u", RX_PERF_SERVICE, enctype); =20 kref =3D key_create_or_update(make_key_ref(keyring, true), "rxrpc_s", name, From nobody Thu Sep 24 12:50:58 2026 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8C99E51FCB8 for ; Wed, 23 Sep 2026 13:37:40 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.129.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790170665; cv=none; b=WiRBDVQzNG8fURj/kMn5qOAoPDypgF2+mH07GpbAYLNuIFMNtn/Hqh7C81M6m58twof6ItGPwVK84Qm/TaOFVbRQq5yuF1+h+6d774KCoLY0dHhvBtSOyKSEx0xQUBaLn9VJbmCftct2DLIGut+FxNifHOPpgr7QojQ+lS1mkD0= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790170665; c=relaxed/simple; bh=5VX9gYYEf/sTJG4nfVy4FwufwOgJyzH6XIvquctxgfw=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=eQ58710PaVJuY6dMui6ziMr2U26kvABQ0/U+qPbCjMN9HQgMME1PsEqQw7cD33x3ux20ku7NBu6fwcbgKHdNgNRCPFuasywr6VsI91qmXV9ThDJ8VyXrYX+UGeV/hXLPCJN5m2Avjl86EoMW+e8Khiwwzx8iXz0B9IrwhFNfR+U= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=blySBfim; arc=none smtp.client-ip=170.10.129.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="blySBfim" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1790170659; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=sLsrlWFNUE9H47XWQfC/ZAY1xGRSJRlALO3fmSh23ts=; b=blySBfimnS6cGMfPbB8aWUwBJGn8q99uLZDPTsFhvgyPSdO8oqIDlERHN6FY7DP7t9cfAy asKFP5ROjHZxfF3Bc1LbQXPh+Z4KJ+KpzAc87hF0/EvLKNUR1FomUJTIxM8XQ0psxtZMIY 8vw/aTHSqRltclwAycIH0PR9kRUMe5M= Received: from mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-441-oFg0MO4ZMoOLqc6Lu5bIrQ-1; Wed, 23 Sep 2026 09:37:35 -0400 X-MC-Unique: oFg0MO4ZMoOLqc6Lu5bIrQ-1 X-Mimecast-MFC-AGG-ID: oFg0MO4ZMoOLqc6Lu5bIrQ_1790170654 Received: from mx-prod-int-08.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-08.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.111]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 1FD781944EB3; Wed, 23 Sep 2026 13:37:34 +0000 (UTC) Received: from warthog.com (unknown [10.44.32.54]) by mx-prod-int-08.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 73DD8180034C; Wed, 23 Sep 2026 13:37:30 +0000 (UTC) From: David Howells To: netdev@vger.kernel.org Cc: David Howells , Marc Dionne , Jakub Kicinski , "David S. Miller" , Eric Dumazet , Paolo Abeni , Simon Horman , linux-afs@lists.infradead.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org Subject: [PATCH net v11 03/17] rxrpc: Fix update of call->tx_pending without holding lock Date: Wed, 23 Sep 2026 14:36:50 +0100 Message-ID: <20260923133706.1496540-4-dhowells@redhat.com> In-Reply-To: <20260923133706.1496540-1-dhowells@redhat.com> References: <20260923133706.1496540-1-dhowells@redhat.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.111 Content-Type: text/plain; charset="utf-8" Currently, rxrpc_send_data() updates call->tx_pending just before it returns - but it won't be holding the call->user_mutex when it does this if a wait was interrupted by a signal. This would allow a parallel sendmsg() to race. Further, both the callers of rxrpc_send_data() call it with the lock held, and then it returns an indication through the parameter list to say whether it has dropped the lock or not - after which the callers both just drop the lock if it's still held. Fix this by: (1) Moving the release of call->user_mutex down into rxrpc_send_data() and get rid of the indicator parameter. This makes it easier to see where the lock is held. (2) After waiting, if the attempt to reacquire the mutex is interrupted, just return directly there rather than going to out_unlock (3) Restricting the txb variable to inside the buffering loop and leaving ->tx_pending set until we've queued the buffer. Note that there's a slight change in behaviour in that wait_for_space failure now doesn't check for completion because it doesn't hold the call user_mutex. The caller, however, should re-issue the send and pick up any error at a second attempt. Fixes: b0f571ecd794 ("rxrpc: Fix locking in rxrpc's sendmsg") Closes: https://sashiko.dev/#/patchset/20260702144919.172295-1-dhowells%40r= edhat.com Signed-off-by: David Howells cc: Marc Dionne cc: Eric Dumazet cc: "David S. Miller" cc: Jakub Kicinski cc: Paolo Abeni cc: Simon Horman cc: linux-afs@lists.infradead.org cc: stable@vger.kernel.org --- net/rxrpc/sendmsg.c | 63 +++++++++++++++++++++------------------------ 1 file changed, 29 insertions(+), 34 deletions(-) diff --git a/net/rxrpc/sendmsg.c b/net/rxrpc/sendmsg.c index ed2c9a51005a..fb8d48418882 100644 --- a/net/rxrpc/sendmsg.c +++ b/net/rxrpc/sendmsg.c @@ -320,10 +320,9 @@ static int rxrpc_alloc_txqueue(struct sock *sk, struct= rxrpc_call *call) static int rxrpc_send_data(struct rxrpc_sock *rx, struct rxrpc_call *call, struct msghdr *msg, size_t len, - rxrpc_notify_end_tx_t notify_end_tx, - bool *_dropped_lock) + rxrpc_notify_end_tx_t notify_end_tx) + __releases(&call->user_mutex) { - struct rxrpc_txbuf *txb; struct sock *sk =3D &rx->sk; enum rxrpc_call_state state; long timeo; @@ -334,30 +333,26 @@ static int rxrpc_send_data(struct rxrpc_sock *rx, trace_rxrpc_abort(call->debug_id, rxrpc_sendmsg_late_send, call->cid, call->call_id, call->rx_consumed, 0, -EPROTO); - return -EPROTO; + ret =3D -EPROTO; + goto out_unlock; } =20 timeo =3D sock_sndtimeo(sk, msg->msg_flags & MSG_DONTWAIT); =20 ret =3D rxrpc_wait_to_be_connected(call, &timeo); if (ret < 0) - return ret; + goto out_unlock; =20 if (call->conn->state =3D=3D RXRPC_CONN_CLIENT_UNSECURED) { ret =3D rxrpc_init_client_conn_security(call->conn); if (ret < 0) - return ret; + goto out_unlock; } =20 /* this should be in poll */ sk_clear_bit(SOCKWQ_ASYNC_NOSPACE, sk); =20 reload: - txb =3D call->tx_pending; - call->tx_pending =3D NULL; - if (txb) - rxrpc_see_txbuf(txb, rxrpc_txbuf_see_send_more); - ret =3D -EPIPE; if (sk->sk_shutdown & SEND_SHUTDOWN) goto maybe_error; @@ -386,6 +381,8 @@ static int rxrpc_send_data(struct rxrpc_sock *rx, } =20 do { + struct rxrpc_txbuf *txb =3D call->tx_pending; + if (!txb) { size_t remain; =20 @@ -411,6 +408,9 @@ static int rxrpc_send_data(struct rxrpc_sock *rx, ret =3D -ENOMEM; goto maybe_error; } + call->tx_pending =3D txb; + } else { + rxrpc_see_txbuf(txb, rxrpc_txbuf_see_send_more); } =20 _debug("append"); @@ -445,9 +445,9 @@ static int rxrpc_send_data(struct rxrpc_sock *rx, =20 ret =3D call->security->secure_packet(call, txb); if (ret < 0) - goto out; + goto out_unlock; rxrpc_queue_packet(rx, call, txb, notify_end_tx); - txb =3D NULL; + call->tx_pending =3D NULL; } } while (msg_data_left(msg) > 0); =20 @@ -456,45 +456,46 @@ static int rxrpc_send_data(struct rxrpc_sock *rx, if (rxrpc_call_is_complete(call) && call->error < 0) ret =3D call->error; -out: - call->tx_pending =3D txb; +out_unlock: + mutex_unlock(&call->user_mutex); _leave(" =3D %d", ret); return ret; =20 call_terminated: - rxrpc_put_txbuf(txb, rxrpc_txbuf_put_send_aborted); - _leave(" =3D %d", call->error); - return call->error; + ret =3D call->error; + goto out_unlock; =20 maybe_error: if (copied) goto success; - goto out; + goto out_unlock; =20 efault: ret =3D -EFAULT; - goto out; + goto out_unlock; =20 wait_for_space: ret =3D -EAGAIN; if (msg->msg_flags & MSG_DONTWAIT) goto maybe_error; mutex_unlock(&call->user_mutex); - *_dropped_lock =3D true; + ret =3D rxrpc_wait_for_tx_window(rx, call, &timeo, msg->msg_flags & MSG_WAITALL); if (ret < 0) - goto maybe_error; + goto out_nolock; if (call->interruptibility =3D=3D RXRPC_INTERRUPTIBLE) { if (mutex_lock_interruptible(&call->user_mutex) < 0) { ret =3D sock_intr_errno(timeo); - goto maybe_error; + goto out_nolock; } } else { mutex_lock(&call->user_mutex); } - *_dropped_lock =3D false; goto reload; +out_nolock: + _leave(" =3D %d [intr]", ret); + return copied ?: ret; } =20 /* @@ -660,7 +661,6 @@ rxrpc_new_client_call_for_sendmsg(struct rxrpc_sock *rx= , struct msghdr *msg, int rxrpc_do_sendmsg(struct rxrpc_sock *rx, struct msghdr *msg, size_t len) { struct rxrpc_call *call; - bool dropped_lock =3D false; int ret; =20 struct rxrpc_send_params p =3D { @@ -769,16 +769,15 @@ int rxrpc_do_sendmsg(struct rxrpc_sock *rx, struct ms= ghdr *msg, size_t len) ret =3D 0; break; case RXRPC_CMD_SEND_DATA: - ret =3D rxrpc_send_data(rx, call, msg, len, NULL, &dropped_lock); - break; + ret =3D rxrpc_send_data(rx, call, msg, len, NULL); + goto error_put; default: ret =3D -EINVAL; break; } =20 out_put_unlock: - if (!dropped_lock) - mutex_unlock(&call->user_mutex); + mutex_unlock(&call->user_mutex); error_put: rxrpc_put_call(call, rxrpc_call_put_sendmsg); _leave(" =3D %d", ret); @@ -808,7 +807,6 @@ int rxrpc_kernel_send_data(struct socket *sock, struct = rxrpc_call *call, struct msghdr *msg, size_t len, rxrpc_notify_end_tx_t notify_end_tx) { - bool dropped_lock =3D false; int ret; =20 _enter("{%d},", call->debug_id); @@ -819,12 +817,9 @@ int rxrpc_kernel_send_data(struct socket *sock, struct= rxrpc_call *call, mutex_lock(&call->user_mutex); =20 ret =3D rxrpc_send_data(rxrpc_sk(sock->sk), call, msg, len, - notify_end_tx, &dropped_lock); + notify_end_tx); if (ret =3D=3D -ESHUTDOWN) ret =3D call->error; - - if (!dropped_lock) - mutex_unlock(&call->user_mutex); _leave(" =3D %d", ret); return ret; } From nobody Thu Sep 24 12:50:58 2026 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B22624F4D13 for ; Wed, 23 Sep 2026 13:37:44 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.133.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790170667; cv=none; b=uXbmmJZRx3YoO6NByRdeKH1X1Vxm1l8qkexokS6qZ0Xlw/21jolX0x5fDg/cMdGFlpPyw2r/abSAf3hTgC1WD/YZS2L51VZomlwJPPpmTD/SzRumTLXfRrCp+SniPyDVPSwHkIV12ZvqH6/wbWLpNr7kwkl6Bbzuxyp2bh4TUXw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790170667; c=relaxed/simple; bh=zfdpDA59IEhBCeGa39n7aVsznlZLkrtMeCvgU8uMkS0=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=av4UBGsMPwQEzUXi3n7csozv1oBGIxEHKKU5BQ+CDhkilz81jgKKaD3tZNZLKMaDHDkmETTmm9fhjwxygzURwzsFWD8CiPagQKOygNlh8KCLT7XRzbAOs2Wpi3/dp6g9yjA1Sr9+yHO+CulbyT6aV+X7acjEH6Se6pTOZJVhGf4= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=NqHT6Vzn; arc=none smtp.client-ip=170.10.133.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="NqHT6Vzn" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1790170663; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=zhCHHYzmch/OmCXaeSUg+j/iXPRsToQpoCTzhlFpdvs=; b=NqHT6Vznbj7kFgNsXaT86VVneMIKaveTPDzcKD78micqXg+IZFSI6uASWErjQLbuLVB5cG VB6ztG4QfDqBM/EDvoD/PbbrXbNvS4uODhkWHeUOznw0UbA0INL9eEnprfAA+HQa1N/P4T cWvnO/PoMvYuo1plUeoyfvz10EC8kf0= Received: from mx-prod-mc-05.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-198-hjUY7RjSMA2cenljy7sLIg-1; Wed, 23 Sep 2026 09:37:41 -0400 X-MC-Unique: hjUY7RjSMA2cenljy7sLIg-1 X-Mimecast-MFC-AGG-ID: hjUY7RjSMA2cenljy7sLIg_1790170660 Received: from mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.17]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-05.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id CF063195410A; Wed, 23 Sep 2026 13:37:39 +0000 (UTC) Received: from warthog.com (unknown [10.44.32.54]) by mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 7C5D119539A7; Wed, 23 Sep 2026 13:37:36 +0000 (UTC) From: David Howells To: netdev@vger.kernel.org Cc: David Howells , Marc Dionne , Jakub Kicinski , "David S. Miller" , Eric Dumazet , Paolo Abeni , Simon Horman , linux-afs@lists.infradead.org, linux-kernel@vger.kernel.org, David Laight , stable@vger.kernel.org Subject: [PATCH net v11 04/17] rxrpc: Fix lack of short-send handling in rxrpc_kernel_send_data() Date: Wed, 23 Sep 2026 14:36:51 +0100 Message-ID: <20260923133706.1496540-5-dhowells@redhat.com> In-Reply-To: <20260923133706.1496540-1-dhowells@redhat.com> References: <20260923133706.1496540-1-dhowells@redhat.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.0 on 10.30.177.17 Content-Type: text/plain; charset="utf-8" Fix rxrpc_kernel_send_data() to loop around if it detects a short send. David Laight suggested doing it here rather than wrapping all the calls in loops. Further, remove the len argument and use the iterator count instead and return 0 on success, not the amount copied. Note this is also a prerequisite for changing the way rxrpc_send_data() works to return a short send rather than an error if some data was buffered. Fixes: 651350d10f93 ("[AF_RXRPC]: Add an interface to the AF_RXRPC module f= or the AFS filesystem to use") Link: https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260824091645.41= 5423-1-dhowells%40redhat.com Suggested-by: David Laight Signed-off-by: David Howells cc: Marc Dionne cc: Eric Dumazet cc: "David S. Miller" cc: Jakub Kicinski cc: Paolo Abeni cc: Simon Horman cc: linux-afs@lists.infradead.org cc: stable@vger.kernel.org --- Documentation/networking/rxrpc.rst | 6 ++++-- fs/afs/rxrpc.c | 32 ++++++++++++------------------ include/net/af_rxrpc.h | 5 ++--- net/rxrpc/rxperf.c | 25 ++++++++++------------- net/rxrpc/sendmsg.c | 27 +++++++++++++++++-------- 5 files changed, 48 insertions(+), 47 deletions(-) diff --git a/Documentation/networking/rxrpc.rst b/Documentation/networking/= rxrpc.rst index 8926dab8e2e6..01ad12fdf305 100644 --- a/Documentation/networking/rxrpc.rst +++ b/Documentation/networking/rxrpc.rst @@ -870,7 +870,6 @@ The kernel interface functions are as follows: int rxrpc_kernel_send_data(struct socket *sock, struct rxrpc_call *call, struct msghdr *msg, - size_t len, rxrpc_notify_end_tx_t notify_end_rx); =20 This is used to supply either the request part of a client call or the @@ -880,13 +879,16 @@ The kernel interface functions are as follows: MSG_MORE if there will be subsequent data sends for this call. =20 The msg must not specify a destination address, control data or any f= lags - other than MSG_MORE. len is the total amount of data to transmit. + other than MSG_MORE. =20 notify_end_rx can be NULL or it can be used to specify a function to = be called when the call changes state to end the Tx phase. This functio= n is called with a spinlock held to prevent the last DATA packet from being transmitted until the function returns. =20 + It returns 0 if all the data is queued and a negative error code on + failure. + (#) Receive data from a call:: =20 int rxrpc_kernel_recv_data(struct socket *sock, diff --git a/fs/afs/rxrpc.c b/fs/afs/rxrpc.c index d82916657a3d..bcb8bb15d471 100644 --- a/fs/afs/rxrpc.c +++ b/fs/afs/rxrpc.c @@ -412,8 +412,7 @@ void afs_make_call(struct afs_call *call, gfp_t gfp) msg.msg_controllen =3D 0; msg.msg_flags =3D MSG_WAITALL | (call->write_iter ? MSG_MORE : 0); =20 - ret =3D rxrpc_kernel_send_data(call->net->socket, rxcall, - &msg, call->request_size, + ret =3D rxrpc_kernel_send_data(call->net->socket, rxcall, &msg, afs_notify_end_request_tx); if (ret < 0) goto error_do_abort; @@ -425,7 +424,6 @@ void afs_make_call(struct afs_call *call, gfp_t gfp) =20 ret =3D rxrpc_kernel_send_data(call->net->socket, call->rxcall, &msg, - iov_iter_count(&msg.msg_iter), afs_notify_end_request_tx); *call->write_iter =3D msg.msg_iter; =20 @@ -871,7 +869,7 @@ void afs_send_empty_reply(struct afs_call *call) msg.msg_controllen =3D 0; msg.msg_flags =3D 0; =20 - switch (rxrpc_kernel_send_data(net->socket, call->rxcall, &msg, 0, + switch (rxrpc_kernel_send_data(net->socket, call->rxcall, &msg, afs_notify_end_reply_tx)) { case 0: _leave(" [replied]"); @@ -897,7 +895,7 @@ void afs_send_simple_reply(struct afs_call *call, const= void *buf, size_t len) struct afs_net *net =3D call->net; struct msghdr msg; struct kvec iov[1]; - int n; + int ret; =20 _enter(""); =20 @@ -912,21 +910,17 @@ void afs_send_simple_reply(struct afs_call *call, con= st void *buf, size_t len) msg.msg_controllen =3D 0; msg.msg_flags =3D 0; =20 - n =3D rxrpc_kernel_send_data(net->socket, call->rxcall, &msg, len, - afs_notify_end_reply_tx); - if (n >=3D 0) { - /* Success */ - _leave(" [replied]"); - return; - } - - if (n =3D=3D -ENOMEM) { - _debug("oom"); - rxrpc_kernel_abort_call(net->socket, call->rxcall, - RXGEN_SS_MARSHAL, -ENOMEM, - afs_abort_oom); + ret =3D rxrpc_kernel_send_data(net->socket, call->rxcall, &msg, + afs_notify_end_reply_tx); + if (ret < 0) { + if (ret =3D=3D -ENOMEM) { + _debug("oom"); + rxrpc_kernel_abort_call(net->socket, call->rxcall, + RXGEN_SS_MARSHAL, -ENOMEM, + afs_abort_oom); + } + _leave(" [error]"); } - _leave(" [error]"); } =20 /* diff --git a/include/net/af_rxrpc.h b/include/net/af_rxrpc.h index 0fb4c41c9bbf..f3980348ed34 100644 --- a/include/net/af_rxrpc.h +++ b/include/net/af_rxrpc.h @@ -64,9 +64,8 @@ struct rxrpc_call *rxrpc_kernel_begin_call(struct socket = *sock, bool upgrade, enum rxrpc_interruptibility interruptibility, unsigned int debug_id); -int rxrpc_kernel_send_data(struct socket *, struct rxrpc_call *, - struct msghdr *, size_t, - rxrpc_notify_end_tx_t); +int rxrpc_kernel_send_data(struct socket *sock, struct rxrpc_call *call, + struct msghdr *msg, rxrpc_notify_end_tx_t notify_end_tx); int rxrpc_kernel_recv_data(struct socket *, struct rxrpc_call *, struct iov_iter *, size_t *, bool, u32 *, u16 *); bool rxrpc_kernel_abort_call(struct socket *, struct rxrpc_call *, diff --git a/net/rxrpc/rxperf.c b/net/rxrpc/rxperf.c index 26f97e1dd388..981c0596c774 100644 --- a/net/rxrpc/rxperf.c +++ b/net/rxrpc/rxperf.c @@ -501,8 +501,8 @@ static int rxperf_process_call(struct rxperf_call *call) struct msghdr msg =3D {}; struct bio_vec bv; struct kvec iov[1]; - ssize_t n; size_t reply_len =3D call->reply_len, len; + int ret; =20 rxrpc_kernel_set_tx_length(rxperf_socket, call->rxcall, reply_len + sizeof(rxperf_magic_cookie)); @@ -512,13 +512,11 @@ static int rxperf_process_call(struct rxperf_call *ca= ll) bvec_set_page(&bv, ZERO_PAGE(0), len, 0); iov_iter_bvec(&msg.msg_iter, WRITE, &bv, 1, len); msg.msg_flags =3D MSG_MORE; - n =3D rxrpc_kernel_send_data(rxperf_socket, call->rxcall, &msg, - len, rxperf_notify_end_reply_tx); - if (n < 0) - return n; - if (n =3D=3D 0) - return -EIO; - reply_len -=3D n; + ret =3D rxrpc_kernel_send_data(rxperf_socket, call->rxcall, &msg, + rxperf_notify_end_reply_tx); + if (ret < 0) + return ret; + reply_len -=3D len; } =20 len =3D sizeof(rxperf_magic_cookie); @@ -526,16 +524,13 @@ static int rxperf_process_call(struct rxperf_call *ca= ll) iov[0].iov_len =3D len; iov_iter_kvec(&msg.msg_iter, WRITE, iov, 1, len); msg.msg_flags =3D 0; - n =3D rxrpc_kernel_send_data(rxperf_socket, call->rxcall, &msg, len, - rxperf_notify_end_reply_tx); - if (n >=3D 0) - return 0; /* Success */ - - if (n =3D=3D -ENOMEM) + ret =3D rxrpc_kernel_send_data(rxperf_socket, call->rxcall, &msg, + rxperf_notify_end_reply_tx); + if (ret =3D=3D -ENOMEM) rxrpc_kernel_abort_call(rxperf_socket, call->rxcall, RXGEN_SS_MARSHAL, -ENOMEM, rxperf_abort_oom); - return n; + return ret; } =20 /* diff --git a/net/rxrpc/sendmsg.c b/net/rxrpc/sendmsg.c index fb8d48418882..393a2dcfda07 100644 --- a/net/rxrpc/sendmsg.c +++ b/net/rxrpc/sendmsg.c @@ -793,7 +793,6 @@ int rxrpc_do_sendmsg(struct rxrpc_sock *rx, struct msgh= dr *msg, size_t len) * @sock: The socket the call is on * @call: The call to send data through * @msg: The data to send - * @len: The amount of data to send * @notify_end_tx: Notification that the last packet is queued. * * Allow a kernel service to send data on a call. The call must be in an = state @@ -804,8 +803,7 @@ int rxrpc_do_sendmsg(struct rxrpc_sock *rx, struct msgh= dr *msg, size_t len) * Return: %0 if successful and a negative error code otherwise. */ int rxrpc_kernel_send_data(struct socket *sock, struct rxrpc_call *call, - struct msghdr *msg, size_t len, - rxrpc_notify_end_tx_t notify_end_tx) + struct msghdr *msg, rxrpc_notify_end_tx_t notify_end_tx) { int ret; =20 @@ -814,12 +812,25 @@ int rxrpc_kernel_send_data(struct socket *sock, struc= t rxrpc_call *call, ASSERTCMP(msg->msg_name, =3D=3D, NULL); ASSERTCMP(msg->msg_control, =3D=3D, NULL); =20 - mutex_lock(&call->user_mutex); + for (;;) { + mutex_lock(&call->user_mutex); + + ret =3D rxrpc_send_data(rxrpc_sk(sock->sk), call, msg, + msg_data_left(msg), notify_end_tx); + if (ret =3D=3D -ESHUTDOWN) + ret =3D call->error; + if (ret < 0) + break; + if (msg_data_left(msg) =3D=3D 0) { + ret =3D 0; + break; + } + if (ret =3D=3D 0) { + ret =3D -EIO; + break; + } + } =20 - ret =3D rxrpc_send_data(rxrpc_sk(sock->sk), call, msg, len, - notify_end_tx); - if (ret =3D=3D -ESHUTDOWN) - ret =3D call->error; _leave(" =3D %d", ret); return ret; } From nobody Thu Sep 24 12:50:58 2026 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id DB8C952D2CC for ; Wed, 23 Sep 2026 13:37:50 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.133.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790170674; cv=none; b=KL6V5zFSEqoevWGRVX0xNuC5X5/9GgAawhtA7luvjJIv57GRStWasRuS0qHAVwomNR81Dq0/QecX//NlwnY/ONQrUZ4V1Au1+x1M9LlXwz0QIPfsjk4dGGNdW484G7L2p7zxRduxwbaUFeJdUcqP18R93giBZ5SeCaQa8wDghMM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790170674; c=relaxed/simple; bh=+Pn4ju5TRCsvM9gqKdzh62yZY/xrr82TkeX1xU9X2T4=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=ARhHpb/a+7FFXf3kkKO9Svw15t+2k8cR/g/GYYKqjW71gowZS46pdxpeDqY8+PRNxQF4wvv3Dw8wRUGMmxCRnwUwRJu0XQ2A6zEaKH3DHGyKEjq6nSRyumILqYSdHjKGIaaQsJ8QIbUBVmp9fwtq1tO9VkYUiq/p//e0arfIg6s= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=OBVdL0yd; arc=none smtp.client-ip=170.10.133.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="OBVdL0yd" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1790170669; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=jgK/CriZFL/NcGU7FyJJAXJLBa3A8wGwZcT2aKCz7qI=; b=OBVdL0ydiawLqx4/NcED2DsVnSMGqbihaLEfyR6rkTYvCIxJZFNl4cItAEFo1GuD9wChuf 94P9DZbHMkBlyfC3fvi8JfC3O0mF+B5rRLwiU7NUB7Kbqf+AjVj0KX/zme/vQPMcVUkkUn yjxCFT9GDCrtD5SWMbILSS0Ez5WEvro= Received: from mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-628-zZipyRA0MgCT5H81YSg0jw-1; Wed, 23 Sep 2026 09:37:46 -0400 X-MC-Unique: zZipyRA0MgCT5H81YSg0jw-1 X-Mimecast-MFC-AGG-ID: zZipyRA0MgCT5H81YSg0jw_1790170664 Received: from mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.17]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 93CF41800668; Wed, 23 Sep 2026 13:37:44 +0000 (UTC) Received: from warthog.com (unknown [10.44.32.54]) by mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 7E0B019539A7; Wed, 23 Sep 2026 13:37:41 +0000 (UTC) From: David Howells To: netdev@vger.kernel.org Cc: David Howells , Marc Dionne , Jakub Kicinski , "David S. Miller" , Eric Dumazet , Paolo Abeni , Simon Horman , linux-afs@lists.infradead.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org Subject: [PATCH net v11 05/17] afs: Fix afs to abort the rxrpc call on send error Date: Wed, 23 Sep 2026 14:36:52 +0100 Message-ID: <20260923133706.1496540-6-dhowells@redhat.com> In-Reply-To: <20260923133706.1496540-1-dhowells@redhat.com> References: <20260923133706.1496540-1-dhowells@redhat.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.0 on 10.30.177.17 Content-Type: text/plain; charset="utf-8" Fix afs_send_empty_reply() and afs_send_simple_reply() to always try to abort the rxrpc call rather than just aborting on -ENOMEM and otherwise abandoning it. If the call is already complete due to network failure or a received abort, this will do nothing. Also make afs_make_call() always abort on send error; again, it does nothing if the rxrpc call is already dead. Fixes: 08e0e7c82eea ("[AF_RXRPC]: Make the in-kernel AFS filesystem use AF_= RXRPC.") Link: https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260824091645.41= 5423-1-dhowells%40redhat.com Signed-off-by: David Howells cc: Marc Dionne cc: Eric Dumazet cc: "David S. Miller" cc: Jakub Kicinski cc: Paolo Abeni cc: Simon Horman cc: linux-afs@lists.infradead.org cc: stable@vger.kernel.org --- fs/afs/rxrpc.c | 36 +++++++++++------------------------- include/trace/events/rxrpc.h | 2 +- 2 files changed, 12 insertions(+), 26 deletions(-) diff --git a/fs/afs/rxrpc.c b/fs/afs/rxrpc.c index bcb8bb15d471..c38458157ecc 100644 --- a/fs/afs/rxrpc.c +++ b/fs/afs/rxrpc.c @@ -441,10 +441,8 @@ void afs_make_call(struct afs_call *call, gfp_t gfp) return; =20 error_do_abort: - if (ret !=3D -ECONNABORTED) - rxrpc_kernel_abort_call(call->net->socket, rxcall, - RX_USER_ABORT, ret, - afs_abort_send_data_error); + rxrpc_kernel_abort_call(call->net->socket, rxcall, + RX_USER_ABORT, ret, afs_abort_send_data_error); if (call->async) { afs_see_call(call, afs_call_trace_async_abort); return; @@ -857,6 +855,7 @@ void afs_send_empty_reply(struct afs_call *call) { struct afs_net *net =3D call->net; struct msghdr msg; + int ret; =20 _enter(""); =20 @@ -869,22 +868,12 @@ void afs_send_empty_reply(struct afs_call *call) msg.msg_controllen =3D 0; msg.msg_flags =3D 0; =20 - switch (rxrpc_kernel_send_data(net->socket, call->rxcall, &msg, - afs_notify_end_reply_tx)) { - case 0: - _leave(" [replied]"); - return; - - case -ENOMEM: - _debug("oom"); + ret =3D rxrpc_kernel_send_data(net->socket, call->rxcall, &msg, + afs_notify_end_reply_tx); + if (ret < 0) rxrpc_kernel_abort_call(net->socket, call->rxcall, - RXGEN_SS_MARSHAL, -ENOMEM, - afs_abort_oom); - fallthrough; - default: - _leave(" [error]"); - return; - } + RXGEN_SS_MARSHAL, ret, + afs_abort_send_error); } =20 /* @@ -913,12 +902,9 @@ void afs_send_simple_reply(struct afs_call *call, cons= t void *buf, size_t len) ret =3D rxrpc_kernel_send_data(net->socket, call->rxcall, &msg, afs_notify_end_reply_tx); if (ret < 0) { - if (ret =3D=3D -ENOMEM) { - _debug("oom"); - rxrpc_kernel_abort_call(net->socket, call->rxcall, - RXGEN_SS_MARSHAL, -ENOMEM, - afs_abort_oom); - } + rxrpc_kernel_abort_call(net->socket, call->rxcall, + RXGEN_SS_MARSHAL, ret, + afs_abort_send_error); _leave(" [error]"); } } diff --git a/include/trace/events/rxrpc.h b/include/trace/events/rxrpc.h index 704a10de6670..554dfb777b93 100644 --- a/include/trace/events/rxrpc.h +++ b/include/trace/events/rxrpc.h @@ -20,10 +20,10 @@ /* AFS errors */ \ EM(afs_abort_general_error, "afs-error") \ EM(afs_abort_interrupted, "afs-intr") \ - EM(afs_abort_oom, "afs-oom") \ EM(afs_abort_op_not_supported, "afs-op-notsupp") \ EM(afs_abort_probeuuid_negative, "afs-probeuuid-neg") \ EM(afs_abort_send_data_error, "afs-send-data") \ + EM(afs_abort_send_error, "afs-send-error") \ EM(afs_abort_unmarshal_error, "afs-unmarshal") \ EM(afs_abort_unsupported_sec_class, "afs-unsup-sec-class") \ /* rxperf errors */ \ From nobody Thu Sep 24 12:50:58 2026 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B84414A4409 for ; Wed, 23 Sep 2026 13:37:56 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.133.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790170678; cv=none; b=qIPfe8uEzpiIed4vSCP76++II8P/1EjGrJroYxUhJ99Xm+ok0rJLzXUhb6LR57SX8epzdeFN888VpWhfu4/oWfrOPjPeaM43NoOtK0op5FS3xjbi5H7iaQXz762TmHjcsHUTxNn1FgDyx6IbZquzOIZs9gzn5uZMa2fpp6l3abw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790170678; c=relaxed/simple; bh=kDBIIl45O2T4d/byIUEpXWwSeAMYt0uG962XhCRLDj8=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=W7bxxwP/Z+SmlnR+BxtnhJueknd+SIGjQdVv06nxBAkt72MZcxoO8yLIqMwqkpsT/AHi0a2jJeoO2tb9/tBpdNAQVEYmMBI1KFwIl2fz5qtXk2AkMkNA57zhFvLXyX81cmtOgB+ESCdNdUz/GAtYMbyh4hYnMxTebVGin5dCSEU= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=OWUXBTh4; arc=none smtp.client-ip=170.10.133.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="OWUXBTh4" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1790170675; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=MD1FRdLLly2uzv/0FzyzmeRbgozglo3oqKTacqAml0E=; b=OWUXBTh40kroqluC/c0VVvwX8Gj9cMu3ztK5XQkA2HWyn33n+u5Ol5QDUvyqriMuwBgF6U jJoYjCqFvCNbe8mldev7jQznmcuN0JAOdH2MN1T4kOTJaYOIWPxpQrhFe4cPhRGdK+cKxZ RnP/I1bcWG1m215QgUdXn9GiuD34lSg= Received: from mx-prod-mc-01.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-52-fKylWocIO0mjEDaG2hGNfQ-1; Wed, 23 Sep 2026 09:37:50 -0400 X-MC-Unique: fKylWocIO0mjEDaG2hGNfQ-1 X-Mimecast-MFC-AGG-ID: fKylWocIO0mjEDaG2hGNfQ_1790170669 Received: from mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.12]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-01.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 319A8193E8C0; Wed, 23 Sep 2026 13:37:49 +0000 (UTC) Received: from warthog.com (unknown [10.44.32.54]) by mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 4010A1956042; Wed, 23 Sep 2026 13:37:46 +0000 (UTC) From: David Howells To: netdev@vger.kernel.org Cc: David Howells , Marc Dionne , Jakub Kicinski , "David S. Miller" , Eric Dumazet , Paolo Abeni , Simon Horman , linux-afs@lists.infradead.org, linux-kernel@vger.kernel.org Subject: [PATCH net v11 06/17] rxrpc: Fix aborting in rxperf test server Date: Wed, 23 Sep 2026 14:36:53 +0100 Message-ID: <20260923133706.1496540-7-dhowells@redhat.com> In-Reply-To: <20260923133706.1496540-1-dhowells@redhat.com> References: <20260923133706.1496540-1-dhowells@redhat.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.0 on 10.30.177.12 Content-Type: text/plain; charset="utf-8" Fix rxperf_process_call() to always abort if it gets a send error rather than only aborting on ENOMEM. Fixes: 75bfdbf2fca3 ("rxrpc: Implement an in-kernel rxperf server for testi= ng purposes") Link: https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260824091645.41= 5423-1-dhowells%40redhat.com Signed-off-by: David Howells cc: Marc Dionne cc: Eric Dumazet cc: "David S. Miller" cc: Jakub Kicinski cc: Paolo Abeni cc: Simon Horman cc: linux-afs@lists.infradead.org --- include/trace/events/rxrpc.h | 2 +- net/rxrpc/rxperf.c | 11 ++++++----- 2 files changed, 7 insertions(+), 6 deletions(-) diff --git a/include/trace/events/rxrpc.h b/include/trace/events/rxrpc.h index 554dfb777b93..56dc9b614071 100644 --- a/include/trace/events/rxrpc.h +++ b/include/trace/events/rxrpc.h @@ -28,8 +28,8 @@ EM(afs_abort_unsupported_sec_class, "afs-unsup-sec-class") \ /* rxperf errors */ \ EM(rxperf_abort_general_error, "rxperf-error") \ - EM(rxperf_abort_oom, "rxperf-oom") \ EM(rxperf_abort_op_not_supported, "rxperf-op-notsupp") \ + EM(rxperf_abort_send_error, "rxperf-send-error") \ EM(rxperf_abort_unmarshal_error, "rxperf-unmarshal") \ /* RxKAD security errors */ \ EM(rxkad_abort_1_short_check, "rxkad1-short-check") \ diff --git a/net/rxrpc/rxperf.c b/net/rxrpc/rxperf.c index 981c0596c774..823eedc5d16f 100644 --- a/net/rxrpc/rxperf.c +++ b/net/rxrpc/rxperf.c @@ -515,7 +515,7 @@ static int rxperf_process_call(struct rxperf_call *call) ret =3D rxrpc_kernel_send_data(rxperf_socket, call->rxcall, &msg, rxperf_notify_end_reply_tx); if (ret < 0) - return ret; + goto send_error; reply_len -=3D len; } =20 @@ -526,10 +526,11 @@ static int rxperf_process_call(struct rxperf_call *ca= ll) msg.msg_flags =3D 0; ret =3D rxrpc_kernel_send_data(rxperf_socket, call->rxcall, &msg, rxperf_notify_end_reply_tx); - if (ret =3D=3D -ENOMEM) - rxrpc_kernel_abort_call(rxperf_socket, call->rxcall, - RXGEN_SS_MARSHAL, -ENOMEM, - rxperf_abort_oom); + if (ret =3D=3D 0) + return 0; +send_error: + rxrpc_kernel_abort_call(rxperf_socket, call->rxcall, RXGEN_SS_MARSHAL, + ret, rxperf_abort_send_error); return ret; } From nobody Thu Sep 24 12:50:58 2026 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8F2E6531630 for ; Wed, 23 Sep 2026 13:37:58 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.129.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790170680; cv=none; b=nhC+UJFlm5M2Cfu8OxsjLBFo43cHHzBUdgNaDKDGCTLU54IHDGRErMMJiYMKwlisUuyQwD9KBjJ5HFL28gFJtC03DN35G3K3sklanyDp7AiS/KWZISIssemlpBcwVTO5/g+EO47a+uORGoCuXhba7JMx/w47Eq6UT64qdRNORn0= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790170680; c=relaxed/simple; bh=AjXk0+Gd7Yn5j59yY4obwLS/qlnsblLHy5mN83d/hxs=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=hGydtuZkECe95qa+DOjBVxsfwFPh9WkDMmNJ/mw+rqQi/8l7GyrYHcIlHb5aRLLBd1mEc9OwotBx+yV07PNs1StebIwwp6/m+Nay9NKweSVDufVOxeMaJqC+OrewQWwP+qYfoXrNYWKQzYdfUbark5daq/HnwFSnnny6CH3m9Ks= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=DYV0eMFq; arc=none smtp.client-ip=170.10.129.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="DYV0eMFq" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1790170677; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=HOs69U6h5WkhhdZxfYBFLqDvSQjOycABGZRHcs8pqaI=; b=DYV0eMFqaOQ9mFyDqyMjWzxJWr2lJtM01qokX/qk5aBj57BKs3eJ1nLJBia4u8kSA1ghHD VGahSFZ/StMbt5AJj62MEAQ1svWlVa2uj1QG6bt07q7ozhVHlbg4O2LfDiX+c58/7vIyqc sQmKnpst55MHQqL2TJuYcqln4StOmhc= Received: from mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-435-pmkGBa7-O02w3cfHhJYFmg-1; Wed, 23 Sep 2026 09:37:55 -0400 X-MC-Unique: pmkGBa7-O02w3cfHhJYFmg-1 X-Mimecast-MFC-AGG-ID: pmkGBa7-O02w3cfHhJYFmg_1790170674 Received: from mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.17]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id D287E180257F; Wed, 23 Sep 2026 13:37:53 +0000 (UTC) Received: from warthog.com (unknown [10.44.32.54]) by mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id BC77119539A7; Wed, 23 Sep 2026 13:37:50 +0000 (UTC) From: David Howells To: netdev@vger.kernel.org Cc: David Howells , Marc Dionne , Jakub Kicinski , "David S. Miller" , Eric Dumazet , Paolo Abeni , Simon Horman , linux-afs@lists.infradead.org, linux-kernel@vger.kernel.org, Jeffrey Altman Subject: [PATCH net v11 07/17] rxrpc: Fix sendmsg length Date: Wed, 23 Sep 2026 14:36:54 +0100 Message-ID: <20260923133706.1496540-8-dhowells@redhat.com> In-Reply-To: <20260923133706.1496540-1-dhowells@redhat.com> References: <20260923133706.1496540-1-dhowells@redhat.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.0 on 10.30.177.17 Content-Type: text/plain; charset="utf-8" rxrpc_send_data() is given two data lengths (len and msg->msg_iter.count) and is inconsistent about how it uses them. Fix this by using len in preference to msg->msg_iter.count. Also limit the amount copied to either len or msg->msg_iter.count, whichever is smaller. Note that, currently, all the callers have len and msg->msg_iter.count the same and so the problem won't occur. This is a prerequisite for another patch that fixes the handling of encryption errors. Fixes: 382d7974de31 ("RxRPC: Use iov_iter_count() in rxrpc_send_data() inst= ead of the len argument") Signed-off-by: David Howells cc: Marc Dionne cc: Jeffrey Altman cc: Eric Dumazet cc: "David S. Miller" cc: Jakub Kicinski cc: Paolo Abeni cc: Simon Horman cc: linux-afs@lists.infradead.org --- net/rxrpc/sendmsg.c | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-) diff --git a/net/rxrpc/sendmsg.c b/net/rxrpc/sendmsg.c index 393a2dcfda07..312be27ca75b 100644 --- a/net/rxrpc/sendmsg.c +++ b/net/rxrpc/sendmsg.c @@ -374,9 +374,9 @@ static int rxrpc_send_data(struct rxrpc_sock *rx, =20 ret =3D -EMSGSIZE; if (call->tx_total_len !=3D -1) { - if (len - copied > call->tx_total_len) + if (len > call->tx_total_len) goto maybe_error; - if (!more && len - copied !=3D call->tx_total_len) + if (!more && len !=3D call->tx_total_len) goto maybe_error; } =20 @@ -402,7 +402,7 @@ static int rxrpc_send_data(struct rxrpc_sock *rx, * the security header is going to be in the padded * region (enc blocksize), but the trailer is not. */ - remain =3D more ? INT_MAX : msg_data_left(msg); + remain =3D more ? INT_MAX : len; txb =3D call->conn->security->alloc_txbuf(call, remain, sk->sk_allocati= on); if (!txb) { ret =3D -ENOMEM; @@ -416,8 +416,8 @@ static int rxrpc_send_data(struct rxrpc_sock *rx, _debug("append"); =20 /* append next segment of data to the current buffer */ - if (msg_data_left(msg) > 0) { - size_t copy =3D umin(txb->space, msg_data_left(msg)); + if (len > 0) { + size_t copy =3D min3(txb->space, len, msg_data_left(msg)); =20 _debug("add %zu", copy); if (!copy_from_iter_full(txb->data + txb->offset, @@ -428,6 +428,7 @@ static int rxrpc_send_data(struct rxrpc_sock *rx, txb->len +=3D copy; txb->offset +=3D copy; copied +=3D copy; + len -=3D copy; if (call->tx_total_len !=3D -1) call->tx_total_len -=3D copy; } @@ -439,8 +440,8 @@ static int rxrpc_send_data(struct rxrpc_sock *rx, =20 /* add the packet to the send queue if it's now full */ if (!txb->space || - (msg_data_left(msg) =3D=3D 0 && !more)) { - if (msg_data_left(msg) =3D=3D 0 && !more) + (len =3D=3D 0 && !more)) { + if (len =3D=3D 0 && !more) txb->flags |=3D RXRPC_LAST_PACKET; =20 ret =3D call->security->secure_packet(call, txb); @@ -449,7 +450,7 @@ static int rxrpc_send_data(struct rxrpc_sock *rx, rxrpc_queue_packet(rx, call, txb, notify_end_tx); call->tx_pending =3D NULL; } - } while (msg_data_left(msg) > 0); + } while (len > 0 && msg_data_left(msg) > 0); =20 success: ret =3D copied; From nobody Thu Sep 24 12:50:58 2026 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 89BBD5326C6 for ; Wed, 23 Sep 2026 13:38:05 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.133.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790170687; cv=none; b=DOdS626o8P5Q8lFiPBXOQo3/GKIe6khm+CvhrWAcZVYhOKOIzL2rkM5C41peRJ9jMkOfpN4lYJu6R4syEOiBEG1pYgSp0tmB5SDWf/BWpcOsGm9M27q9NrTFCvw5GX+XD6wnsgYd0TtQYQUlKQyv7BBhTUpWhOwHj/Xsyp0VA90= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790170687; c=relaxed/simple; bh=4vh8v8aKpOcLX8nHKdWwTVN9Zlgb6js+pBcueFGnnjE=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=mtFPCihEK79cUewBjBnMU4qhxhqcOnCPRUt/wY5Y1TScDkCr6BaN1FwvCG1r7FK5TrFqUzVfFjbePqc0Pjv30Ru38OgvFHdP2MKeth7xUoW75me2Fh+hHgGrhLcszGj+WvCiMDcq+x6ce0QeGA9dIC//75qqUGp/1e0N8IGTUrc= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=QFc2qKyX; arc=none smtp.client-ip=170.10.133.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="QFc2qKyX" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1790170684; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=AQyQZHEzqKL3gR4bqmpMdwtxd6mLpJ+ODofdMwin1jc=; b=QFc2qKyXQ2KSgZTFpNbG/ZK8ozBADnCltDh4DeaShjrQCli/BAu69/ZkEAEYRXt0soNfsM e7Ynqm2gOQbgqUov6rrEUIQu3pmOQS6lOuZqqe0QMZKPRavEh9EG13YSoKi0GEyzUotLmC xZQr1wGpn2QsmvKhtj7CL3E5DeVxUSU= Received: from mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-616-eeh9a8ixP8aQ6qossAtkmg-1; Wed, 23 Sep 2026 09:38:01 -0400 X-MC-Unique: eeh9a8ixP8aQ6qossAtkmg-1 X-Mimecast-MFC-AGG-ID: eeh9a8ixP8aQ6qossAtkmg_1790170679 Received: from mx-prod-int-06.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-06.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.93]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id D56EC180267A; Wed, 23 Sep 2026 13:37:58 +0000 (UTC) Received: from warthog.com (unknown [10.44.32.54]) by mx-prod-int-06.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 7F063180057E; Wed, 23 Sep 2026 13:37:55 +0000 (UTC) From: David Howells To: netdev@vger.kernel.org Cc: David Howells , Marc Dionne , Jakub Kicinski , "David S. Miller" , Eric Dumazet , Paolo Abeni , Simon Horman , linux-afs@lists.infradead.org, linux-kernel@vger.kernel.org, Jeffrey Altman , stable@vger.kernel.org Subject: [PATCH net v11 08/17] rxrpc: Fix error handling in rxrpc_send_data() Date: Wed, 23 Sep 2026 14:36:55 +0100 Message-ID: <20260923133706.1496540-9-dhowells@redhat.com> In-Reply-To: <20260923133706.1496540-1-dhowells@redhat.com> References: <20260923133706.1496540-1-dhowells@redhat.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.93 Content-Type: text/plain; charset="utf-8" Fix the error handling in rxrpc_send_data() so that it doesn't return an error if it has successfully queued the last packet of a call, but the call has seen to have completed after it did that. Rather, leave it to recvmsg() to report the completion (which it will do anyway). The problem with trying to report the error twice is that the caller may try to clean up the dead call twice. Further, if we haven't queued the final packet yet, return -ESHUTDOWN if the call is now marked complete (e.g. it got aborted by the peer) as there's no point sendmsg() continuing to try to add data to a call if it is defunct. The application should abort the call and then call recvmsg() to pick up the reason. Fixes: 4ba68c519255 ("rxrpc: Return an error to sendmsg if call failed") Signed-off-by: David Howells cc: Marc Dionne cc: Jeffrey Altman cc: Eric Dumazet cc: "David S. Miller" cc: Jakub Kicinski cc: Paolo Abeni cc: Simon Horman cc: linux-afs@lists.infradead.org cc: stable@vger.kernel.org --- fs/afs/rxrpc.c | 11 +++-- net/rxrpc/rxperf.c | 29 +++++++---- net/rxrpc/sendmsg.c | 114 ++++++++++++++++++++++++++++++-------------- 3 files changed, 103 insertions(+), 51 deletions(-) diff --git a/fs/afs/rxrpc.c b/fs/afs/rxrpc.c index c38458157ecc..0b9027549580 100644 --- a/fs/afs/rxrpc.c +++ b/fs/afs/rxrpc.c @@ -448,13 +448,14 @@ void afs_make_call(struct afs_call *call, gfp_t gfp) return; } =20 - if (ret =3D=3D -ECONNABORTED) { + if (ret =3D=3D -ESHUTDOWN) { len =3D 0; iov_iter_kvec(&msg.msg_iter, ITER_DEST, NULL, 0, 0); - rxrpc_kernel_recv_data(call->net->socket, rxcall, - &msg.msg_iter, &len, false, - &call->abort_code, &call->service_id); - call->responded =3D true; + ret =3D rxrpc_kernel_recv_data(call->net->socket, rxcall, + &msg.msg_iter, &len, false, + &call->abort_code, &call->service_id); + if (ret =3D=3D -ECONNABORTED) + call->responded =3D true; } call->error =3D ret; trace_afs_call_done(call); diff --git a/net/rxrpc/rxperf.c b/net/rxrpc/rxperf.c index 823eedc5d16f..5042e8bfca55 100644 --- a/net/rxrpc/rxperf.c +++ b/net/rxrpc/rxperf.c @@ -74,7 +74,7 @@ static struct workqueue_struct *rxperf_workqueue; static void rxperf_deliver_to_call(struct work_struct *work); static int rxperf_deliver_param_block(struct rxperf_call *call); static int rxperf_deliver_request(struct rxperf_call *call); -static int rxperf_process_call(struct rxperf_call *call); +static void rxperf_process_call(struct rxperf_call *call); static void rxperf_charge_preallocation(struct work_struct *work); =20 static DECLARE_WORK(rxperf_charge_preallocation_work, @@ -293,18 +293,28 @@ static void rxperf_deliver_to_call(struct work_struct= *work) state =3D=3D RXPERF_CALL_SV_AWAIT_ACK ) { if (state =3D=3D RXPERF_CALL_SV_AWAIT_ACK) { - if (!rxrpc_kernel_check_life(rxperf_socket, call->rxcall)) + size_t len =3D 0; + iov_iter_kvec(&call->iter, ITER_DEST, NULL, 0, 0); + ret =3D rxrpc_kernel_recv_data(rxperf_socket, + call->rxcall, &call->iter, + &len, false, &remote_abort, + &call->service_id); + + if (ret =3D=3D -EINPROGRESS || ret =3D=3D -EAGAIN) + return; + if (ret < 0 || ret =3D=3D 1) { + if (ret =3D=3D 1) + ret =3D 0; goto call_complete; + } return; } =20 ret =3D call->deliver(call); - if (ret =3D=3D 0) - ret =3D rxperf_process_call(call); - switch (ret) { case 0: - continue; + rxperf_process_call(call); + return; case -EINPROGRESS: case -EAGAIN: return; @@ -496,7 +506,7 @@ static int rxperf_deliver_request(struct rxperf_call *c= all) /* * Process a call for which we've received the request. */ -static int rxperf_process_call(struct rxperf_call *call) +static void rxperf_process_call(struct rxperf_call *call) { struct msghdr msg =3D {}; struct bio_vec bv; @@ -527,11 +537,11 @@ static int rxperf_process_call(struct rxperf_call *ca= ll) ret =3D rxrpc_kernel_send_data(rxperf_socket, call->rxcall, &msg, rxperf_notify_end_reply_tx); if (ret =3D=3D 0) - return 0; + return; + send_error: rxrpc_kernel_abort_call(rxperf_socket, call->rxcall, RXGEN_SS_MARSHAL, ret, rxperf_abort_send_error); - return ret; } =20 /* @@ -684,4 +694,3 @@ static void __exit rxperf_exit(void) rcu_barrier(); } module_exit(rxperf_exit); - diff --git a/net/rxrpc/sendmsg.c b/net/rxrpc/sendmsg.c index 312be27ca75b..80c6afc64787 100644 --- a/net/rxrpc/sendmsg.c +++ b/net/rxrpc/sendmsg.c @@ -324,19 +324,10 @@ static int rxrpc_send_data(struct rxrpc_sock *rx, __releases(&call->user_mutex) { struct sock *sk =3D &rx->sk; - enum rxrpc_call_state state; long timeo; bool more =3D msg->msg_flags & MSG_MORE; int ret, copied =3D 0; =20 - if (test_bit(RXRPC_CALL_TX_NO_MORE, &call->flags)) { - trace_rxrpc_abort(call->debug_id, rxrpc_sendmsg_late_send, - call->cid, call->call_id, call->rx_consumed, - 0, -EPROTO); - ret =3D -EPROTO; - goto out_unlock; - } - timeo =3D sock_sndtimeo(sk, msg->msg_flags & MSG_DONTWAIT); =20 ret =3D rxrpc_wait_to_be_connected(call, &timeo); @@ -355,21 +346,31 @@ static int rxrpc_send_data(struct rxrpc_sock *rx, reload: ret =3D -EPIPE; if (sk->sk_shutdown & SEND_SHUTDOWN) - goto maybe_error; - state =3D rxrpc_call_state(call); - ret =3D -ESHUTDOWN; - if (state >=3D RXRPC_CALL_COMPLETE) - goto maybe_error; - ret =3D -EPROTO; - if (state !=3D RXRPC_CALL_CLIENT_PRE_SEND && - state !=3D RXRPC_CALL_CLIENT_SEND_REQUEST && - state !=3D RXRPC_CALL_SERVER_ACK_REQUEST && - state !=3D RXRPC_CALL_SERVER_SEND_REPLY) { - /* Request phase complete for this client call */ + goto out_unlock; + + switch (rxrpc_call_state(call)) { + case RXRPC_CALL_CLIENT_PRE_SEND: + case RXRPC_CALL_CLIENT_SEND_REQUEST: + case RXRPC_CALL_SERVER_ACK_REQUEST: + case RXRPC_CALL_SERVER_SEND_REPLY: + break; + case RXRPC_CALL_COMPLETE: + ret =3D -ESHUTDOWN; + goto out_unlock; + default: + ret =3D -EPROTO; trace_rxrpc_abort(call->debug_id, rxrpc_sendmsg_late_send, call->cid, call->call_id, call->rx_consumed, 0, -EPROTO); - goto maybe_error; + goto out_unlock; + } + + if (unlikely(test_bit(RXRPC_CALL_TX_NO_MORE, &call->flags))) { + trace_rxrpc_abort(call->debug_id, rxrpc_sendmsg_late_send, + call->cid, call->call_id, call->rx_consumed, + 0, -EPROTO); + ret =3D -EPROTO; + goto out_unlock; } =20 ret =3D -EMSGSIZE; @@ -435,8 +436,9 @@ static int rxrpc_send_data(struct rxrpc_sock *rx, =20 /* check for the far side aborting the call or a network error * occurring */ + ret =3D -ESHUTDOWN; if (rxrpc_call_is_complete(call)) - goto call_terminated; + goto out_unlock; =20 /* add the packet to the send queue if it's now full */ if (!txb->space || @@ -449,31 +451,71 @@ static int rxrpc_send_data(struct rxrpc_sock *rx, goto out_unlock; rxrpc_queue_packet(rx, call, txb, notify_end_tx); call->tx_pending =3D NULL; + + /* At this point, if that was the last packet, it may + * have been transmitted and the reply (client call) or + * final ACK (service call) may have been received, + * completing the call. + */ } } while (len > 0 && msg_data_left(msg) > 0); =20 -success: + /* Don't check for call completeness here, but leave that to recvmsg or + * a further call to sendmsg(). + */ ret =3D copied; - if (rxrpc_call_is_complete(call) && - call->error < 0) - ret =3D call->error; out_unlock: mutex_unlock(&call->user_mutex); +out: + + /* The return value is a bit complicated as we want to avoid returning + * an error if we have queued the final packet. In descending order of + * preference: + * + * (1) If the send side of the socket is shut down, -EPIPE. + * + * (2) If the call has terminated early, likely due to an external + * event such as being remotely aborted: -ESHUTDOWN. + * + * (3) If the call is in the wrong state to transmit: -EPROTO. + * + * (4) If another sendmsg() has already queued the last packet: -EPROTO. + * + * (5) If we queue the last packet: the amount copied (which may be + * zero). recvmsg() should be used to collect the result. + * + * (6) If some data has been copied by this call: the amount copied + * (which will be greater than zero). + * + * (7) Any other error. + * + * For (1)-(4), there's no point in continuing with the sendmsg(). The + * app should abort the call (just in case the error came from + * somewhere else) and then use recvmsg() to collect the final result + * of the call. + */ _leave(" =3D %d", ret); return ret; =20 -call_terminated: - ret =3D call->error; - goto out_unlock; - maybe_error: - if (copied) - goto success; + if (copied) { + if (test_bit(RXRPC_CALL_TX_NO_MORE, &call->flags)) { + /* If we've get here, we must have slept waiting for space and . + */ + ret =3D copied; + goto out_unlock; + } + if (rxrpc_call_is_complete(call)) { + ret =3D -ESHUTDOWN; + goto out_unlock; + } + ret =3D copied; + } goto out_unlock; =20 efault: ret =3D -EFAULT; - goto out_unlock; + goto maybe_error; =20 wait_for_space: ret =3D -EAGAIN; @@ -496,7 +538,9 @@ static int rxrpc_send_data(struct rxrpc_sock *rx, goto reload; out_nolock: _leave(" =3D %d [intr]", ret); - return copied ?: ret; + if (copied) + ret =3D copied; + goto out; } =20 /* @@ -818,8 +862,6 @@ int rxrpc_kernel_send_data(struct socket *sock, struct = rxrpc_call *call, =20 ret =3D rxrpc_send_data(rxrpc_sk(sock->sk), call, msg, msg_data_left(msg), notify_end_tx); - if (ret =3D=3D -ESHUTDOWN) - ret =3D call->error; if (ret < 0) break; if (msg_data_left(msg) =3D=3D 0) { From nobody Thu Sep 24 12:50:58 2026 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 788C5533590 for ; Wed, 23 Sep 2026 13:38:09 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.129.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790170691; cv=none; b=EA1MN72C+/KErw5riMCIm3ceEOIuWTCbDZ+MYgWl81QjEPQn8CzMZuVCRRiK0O0WP+UNAoT/AP4wKHpd13+eIZZVHgx5xssxJL+wicZxaMmBmgARqOeqiShMbV9sP1W3W2F3JasPpHSi1SJFF64Z0yCNkqYg1OVlNA4OacL/EzY= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790170691; c=relaxed/simple; bh=AgQkNK9DZVe4D2Wdj7XGYwOLrTkZNGJ59AtVCb/jgYA=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=F4kBtfVTVk8kSqE1m+CHuZhHfXy2p38v0sDot9lLuasO2zdUdDrFS8+tViEONh/6Qb4qb65XlSmZWhIYfgLZKF6uB5LJY0R5CIWP+pREWfEvaMPtuR1y3UM7zBZb0X+c7hPgazeLkilAZ8nqxqJQATjQ/iouOYoUH+B7vHDLseM= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=NW//hBlx; arc=none smtp.client-ip=170.10.129.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="NW//hBlx" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1790170688; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=uzCMAv3yRDg2M+JwGL3OWL9L58RzLWg2LBCgM9DMQCA=; b=NW//hBlxEFKMDj2ocPKjDfLFKdRJKCBX7qwwE+eqaS11jl74c+OtBpKeDLYtTlJRbObv76 3fQnNs0QmJGPmJz/9ev/STNQLrA0HaVZsjIVhEjdGSohxVeZX3d3U3zBN6jZ+VbMY+t117 2/teNi9XfQaRxsRHD0cSni36aBjTcXk= Received: from mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-661-lC4_OpOwNVu4YORBb0Qu8g-1; Wed, 23 Sep 2026 09:38:05 -0400 X-MC-Unique: lC4_OpOwNVu4YORBb0Qu8g-1 X-Mimecast-MFC-AGG-ID: lC4_OpOwNVu4YORBb0Qu8g_1790170683 Received: from mx-prod-int-08.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-08.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.111]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id AB29D182A114; Wed, 23 Sep 2026 13:38:03 +0000 (UTC) Received: from warthog.com (unknown [10.44.32.54]) by mx-prod-int-08.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 70626180025F; Wed, 23 Sep 2026 13:38:00 +0000 (UTC) From: David Howells To: netdev@vger.kernel.org Cc: David Howells , Marc Dionne , Jakub Kicinski , "David S. Miller" , Eric Dumazet , Paolo Abeni , Simon Horman , linux-afs@lists.infradead.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org Subject: [PATCH net v11 09/17] rxrpc: Fix packet encryption error handling Date: Wed, 23 Sep 2026 14:36:56 +0100 Message-ID: <20260923133706.1496540-10-dhowells@redhat.com> In-Reply-To: <20260923133706.1496540-1-dhowells@redhat.com> References: <20260923133706.1496540-1-dhowells@redhat.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.111 Content-Type: text/plain; charset="utf-8" In rxrpc_send_data(), if ->secure_packet() returns an error, the code currently just jumps to out: and returns the error to the app on the assumption that any error returned by this is automatically fatal for the call, and may even have corrupted the transmission queue - but leaving it to userspace to deal with. Nothing stops the application from retrying the sendmsg(), which will try to encrypt the buffer again, and might succeed with a corrupt buffer. Fix rxrpc_send_data() in the following ways: (1) If -ENOMEM is returned, assume we never got as far as the encryption and that the operation is retryable. In which case, jump to maybe_error_rewind and, if we've copied all remaining data into the last packet, remove some of the bytes from it that we just added so that we don't tell the caller that we've completed the transmission phase. The iterator is also correspondingly rewound. (2) If any other error occurs, set the TX_ERROR flag on the call and return that error directly; on all subsequent attempts to add data to the call, return -EIO. The app must then abort the call to get rid of it (this allows the app to choose the abort code to use). Fixes: 17926a79320a ("[AF_RXRPC]: Provide secure RxRPC sockets for use by u= serspace and kernel both") Closes: https://sashiko.dev/#/patchset/20260702144919.172295-1-dhowells%40r= edhat.com Signed-off-by: David Howells cc: Marc Dionne cc: Eric Dumazet cc: "David S. Miller" cc: Jakub Kicinski cc: Paolo Abeni cc: Simon Horman cc: linux-afs@lists.infradead.org cc: stable@vger.kernel.org --- Documentation/networking/rxrpc.rst | 6 ++- include/trace/events/rxrpc.h | 1 + net/rxrpc/ar-internal.h | 1 + net/rxrpc/sendmsg.c | 68 +++++++++++++++++++++++++----- 4 files changed, 63 insertions(+), 13 deletions(-) diff --git a/Documentation/networking/rxrpc.rst b/Documentation/networking/= rxrpc.rst index 01ad12fdf305..9b7eeae84148 100644 --- a/Documentation/networking/rxrpc.rst +++ b/Documentation/networking/rxrpc.rst @@ -878,8 +878,10 @@ The kernel interface functions are as follows: exclusively to in-kernel virtual addresses. msg.msg_flags may be giv= en MSG_MORE if there will be subsequent data sends for this call. =20 - The msg must not specify a destination address, control data or any f= lags - other than MSG_MORE. + msg must not specify a destination address, control data or any flags + other than MSG_MORE. The last-packet flag will only be set on the + outgoing packet if MSG_MORE is not set and all the data in the iterat= or is + buffered. =20 notify_end_rx can be NULL or it can be used to specify a function to = be called when the call changes state to end the Tx phase. This functio= n is diff --git a/include/trace/events/rxrpc.h b/include/trace/events/rxrpc.h index 56dc9b614071..a5c92592d8f9 100644 --- a/include/trace/events/rxrpc.h +++ b/include/trace/events/rxrpc.h @@ -148,6 +148,7 @@ EM(rxrpc_eproto_wrong_security, "wrong-sec") \ EM(rxrpc_recvmsg_excess_data, "recvmsg-excess") \ EM(rxrpc_recvmsg_short_data, "recvmsg-short") \ + EM(rxrpc_sendmsg_tx_error, "tx-error") \ E_(rxrpc_sendmsg_late_send, "sendmsg-late") =20 #define rxrpc_call_poke_traces \ diff --git a/net/rxrpc/ar-internal.h b/net/rxrpc/ar-internal.h index 865f05fe37ab..a6f830c1621f 100644 --- a/net/rxrpc/ar-internal.h +++ b/net/rxrpc/ar-internal.h @@ -642,6 +642,7 @@ enum rxrpc_call_flag { RXRPC_CALL_TX_LAST, /* Last packet in Tx buffer (at rxtx_top) */ RXRPC_CALL_TX_ALL_ACKED, /* Last packet has been hard-acked */ RXRPC_CALL_TX_NO_MORE, /* No more data to transmit (MSG_MORE deasserted)= */ + RXRPC_CALL_TX_ERROR, /* Terminal error; call needs abort */ RXRPC_CALL_SEND_PING, /* A ping will need to be sent */ RXRPC_CALL_RETRANS_TIMEOUT, /* Retransmission due to timeout occurred */ RXRPC_CALL_BEGAN_RX_TIMER, /* We began the expect_rx_by timer */ diff --git a/net/rxrpc/sendmsg.c b/net/rxrpc/sendmsg.c index 80c6afc64787..e3b6347888bf 100644 --- a/net/rxrpc/sendmsg.c +++ b/net/rxrpc/sendmsg.c @@ -324,6 +324,7 @@ static int rxrpc_send_data(struct rxrpc_sock *rx, __releases(&call->user_mutex) { struct sock *sk =3D &rx->sk; + unsigned int rewind_by =3D 0; long timeo; bool more =3D msg->msg_flags & MSG_MORE; int ret, copied =3D 0; @@ -372,6 +373,13 @@ static int rxrpc_send_data(struct rxrpc_sock *rx, ret =3D -EPROTO; goto out_unlock; } + if (unlikely(test_bit(RXRPC_CALL_TX_ERROR, &call->flags))) { + trace_rxrpc_abort(call->debug_id, rxrpc_sendmsg_tx_error, + call->cid, call->call_id, call->rx_consumed, + 0, -EIO); + ret =3D -EIO; + goto out_unlock; + } =20 ret =3D -EMSGSIZE; if (call->tx_total_len !=3D -1) { @@ -425,6 +433,7 @@ static int rxrpc_send_data(struct rxrpc_sock *rx, copy, &msg->msg_iter)) goto efault; _debug("added"); + rewind_by =3D copy; txb->space -=3D copy; txb->len +=3D copy; txb->offset +=3D copy; @@ -443,14 +452,29 @@ static int rxrpc_send_data(struct rxrpc_sock *rx, /* add the packet to the send queue if it's now full */ if (!txb->space || (len =3D=3D 0 && !more)) { - if (len =3D=3D 0 && !more) - txb->flags |=3D RXRPC_LAST_PACKET; - + /* Do any required crypto. If this fails, it could + * have corrupted the txbuf content with a partial + * encrypt. Assume that ENOMEM is retryable, but + * everything else is terminal. + */ ret =3D call->security->secure_packet(call, txb); - if (ret < 0) + if (ret < 0) { + /* Assume that ENOMEM here means that the + * encryption hasn't happened yet. The data is + * aligned to avoid the need for slow buffering + * in the crypto walk. + */ + if (ret =3D=3D -ENOMEM) + goto maybe_error_rewind; + set_bit(RXRPC_CALL_TX_ERROR, &call->flags); goto out_unlock; + } + + if (len =3D=3D 0 && !more) + txb->flags |=3D RXRPC_LAST_PACKET; rxrpc_queue_packet(rx, call, txb, notify_end_tx); call->tx_pending =3D NULL; + rewind_by =3D 0; =20 /* At this point, if that was the last packet, it may * have been transmitted and the reply (client call) or @@ -481,22 +505,44 @@ static int rxrpc_send_data(struct rxrpc_sock *rx, * * (4) If another sendmsg() has already queued the last packet: -EPROTO. * - * (5) If we queue the last packet: the amount copied (which may be + * (5) If an error occurs that may have corrupted the transmission + * buffer (e.g. crypto failure) or unusable crypto was encountered: + * the error given (and RXRPC_CALL_TX_ERROR is set to cause -EIO to + * be returned from further calls). + * + * (6) If we queue the last packet: the amount copied (which may be * zero). recvmsg() should be used to collect the result. * - * (6) If some data has been copied by this call: the amount copied + * (7) If some data has been copied by this call: the amount copied * (which will be greater than zero). * - * (7) Any other error. + * (8) Any other error. * - * For (1)-(4), there's no point in continuing with the sendmsg(). The - * app should abort the call (just in case the error came from - * somewhere else) and then use recvmsg() to collect the final result - * of the call. + * For (1)-(6), there's no point in continuing with the sendmsg() and + * we no longer care how much has been queued as the call is no longer + * viable. The app should abort the call (just in case the error came + * from somewhere else) and then use recvmsg() to collect the final + * result of the call. */ _leave(" =3D %d", ret); return ret; =20 +maybe_error_rewind: + /* If we got a retryable error after copying all the supplied data into + * the last packet, we need to rewind as much as we can so the caller + * knows they need to retry the sendmsg. + */ + if (rewind_by && !more && !len) { + struct rxrpc_txbuf *txb =3D call->tx_pending; + + txb->space +=3D rewind_by; + txb->len -=3D rewind_by; + txb->offset -=3D rewind_by; + copied -=3D rewind_by; + if (call->tx_total_len !=3D -1) + call->tx_total_len +=3D rewind_by; + iov_iter_revert(&msg->msg_iter, rewind_by); + } maybe_error: if (copied) { if (test_bit(RXRPC_CALL_TX_NO_MORE, &call->flags)) { From nobody Thu Sep 24 12:50:58 2026 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 363CF52F299 for ; Wed, 23 Sep 2026 13:38:15 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.133.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790170696; cv=none; b=jdqT2NOoB/LA6VRvCA8ptG5EWabGHK+d6tZoBMnI5lmVj7Om4VKX247Ay/ekDNVu9cHCtNQQ71K4yBqYo4i7sRJRoke7GQz1gtshOmTcTjdhwnrQ+GUikptAr8B2jllOsjwf6IuRHZ/VKHYQFwGe6/e5QUf4CtA7US4f8ydrPBM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790170696; c=relaxed/simple; bh=qz07hn8lQ4THyuIIoFyqLIU4DrrAhB80BdiWn82oR14=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=TJJaNJZo2CgSzaTKmLWkt2jOcha6wIbSXcnWzH01SBZdtxtgXW3LFRKNmlpSpAH6lwfAcReP3byVigWku6B9YxiMBFLiVduO+VSp2aCeLJY32xNRU0CQv4FwS4lqVCsqs10UDxnfYEIAxhYxyS2h2o6KjNanl2IjjSyuujJU15g= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=Hkzwaxg+; arc=none smtp.client-ip=170.10.133.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="Hkzwaxg+" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1790170694; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=X/q/mU7BulScXkOh99fPoWpNQXaPupXrst3HyJERiYw=; b=Hkzwaxg+Zjf2ZTtc7dNaS8dYEJHxZLKeGgmTlmrjftt80FPpW5cdhUksWWNN0GwJs1wXfS K/nFb8d53dWnshM9ZoUs7Yac+zEZnkkBkUKTSdjereF9QoduNxTkI8FJxJnAnDzz3gLluA EA5jKSqwzOlh3E8ZKWLYpjUJ1Yl1Sjw= Received: from mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-166-koHRPuZSNOCilL-ykx51jQ-1; Wed, 23 Sep 2026 09:38:10 -0400 X-MC-Unique: koHRPuZSNOCilL-ykx51jQ-1 X-Mimecast-MFC-AGG-ID: koHRPuZSNOCilL-ykx51jQ_1790170688 Received: from mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.12]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 935E41800679; Wed, 23 Sep 2026 13:38:08 +0000 (UTC) Received: from warthog.com (unknown [10.44.32.54]) by mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 452A41956042; Wed, 23 Sep 2026 13:38:05 +0000 (UTC) From: David Howells To: netdev@vger.kernel.org Cc: David Howells , Marc Dionne , Jakub Kicinski , "David S. Miller" , Eric Dumazet , Paolo Abeni , Simon Horman , linux-afs@lists.infradead.org, linux-kernel@vger.kernel.org, Jeffrey Altman , stable@vger.kernel.org Subject: [PATCH net v11 10/17] rxrpc: Fix return in rxrpc_recvmsg_data() for service calls Date: Wed, 23 Sep 2026 14:36:57 +0100 Message-ID: <20260923133706.1496540-11-dhowells@redhat.com> In-Reply-To: <20260923133706.1496540-1-dhowells@redhat.com> References: <20260923133706.1496540-1-dhowells@redhat.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.0 on 10.30.177.12 Content-Type: text/plain; charset="utf-8" When rxrpc_recvmsg_data() gets called on a service call that has received all of the request, RXRPC_CALL_RECVMSG_READ_ALL has been set, and this causes rxrpc_recvmsg_data() to jump straight out, indicating the end of the call (ie. rxrpc_kernel_recv_data() returns 1) without waiting for the call to be processed or the reply to be transmitted. Link: https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260914151340.32= 27501-1-dhowells%40redhat.com Signed-off-by: David Howells cc: Marc Dionne cc: Jeffrey Altman cc: Eric Dumazet cc: "David S. Miller" cc: Jakub Kicinski cc: Paolo Abeni cc: Simon Horman cc: linux-afs@lists.infradead.org cc: stable@vger.kernel.org --- fs/afs/rxrpc.c | 4 ++-- net/rxrpc/recvmsg.c | 13 ++++++++++--- net/rxrpc/rxperf.c | 4 ++-- 3 files changed, 14 insertions(+), 7 deletions(-) diff --git a/fs/afs/rxrpc.c b/fs/afs/rxrpc.c index 0b9027549580..8e7a83a95ac9 100644 --- a/fs/afs/rxrpc.c +++ b/fs/afs/rxrpc.c @@ -542,7 +542,7 @@ void afs_deliver_to_call(struct afs_call *call) &call->service_id); trace_afs_receive_data(call, &call->def_iter, false, ret); =20 - if (ret =3D=3D -EINPROGRESS || ret =3D=3D -EAGAIN) + if (ret =3D=3D -EAGAIN || ret =3D=3D 2) return; if (ret < 0 || ret =3D=3D 1) { if (ret =3D=3D 1) @@ -932,7 +932,7 @@ int afs_extract_data(struct afs_call *call, bool want_m= ore) return ret; =20 state =3D READ_ONCE(call->state); - if (ret =3D=3D 1) { + if (ret =3D=3D 1 || ret =3D=3D 2) { switch (state) { case AFS_CALL_CL_AWAIT_REPLY: afs_set_call_state(call, state, AFS_CALL_CL_PROC_REPLY); diff --git a/net/rxrpc/recvmsg.c b/net/rxrpc/recvmsg.c index efcba4b2e74f..716f7f47d7e4 100644 --- a/net/rxrpc/recvmsg.c +++ b/net/rxrpc/recvmsg.c @@ -637,9 +637,11 @@ int rxrpc_recvmsg(struct socket *sock, struct msghdr *= msg, size_t len, * Note that we may return %-EAGAIN to drain empty packets at the end * of the data, even if we've already copied over the requested data. * - * Return: %0 if got what was asked for and there's more available, %1 - * if we got what was asked for and we're at the end of the data and - * %-EAGAIN if we need more data. + * Return: %0 if got what was asked for and there's more available, %1 if = we + * got what was asked for and we're at the end of the call, %2 if a service + * call received all of the request but is still in progress and %-EAGAIN = if we + * need more data. A variety of other errors can be returned if the call + * completed with failure. */ int rxrpc_kernel_recv_data(struct socket *sock, struct rxrpc_call *call, struct iov_iter *iter, size_t *_len, @@ -678,6 +680,11 @@ int rxrpc_kernel_recv_data(struct socket *sock, struct= rxrpc_call *call, =20 read_phase_complete: ret =3D 1; + if (rxrpc_is_service_call(call)) { + if (rxrpc_call_is_complete(call)) + goto call_failed; + ret =3D 2; + } out: if (_service) *_service =3D call->dest_srx.srx_service; diff --git a/net/rxrpc/rxperf.c b/net/rxrpc/rxperf.c index 5042e8bfca55..6ccfd40b5388 100644 --- a/net/rxrpc/rxperf.c +++ b/net/rxrpc/rxperf.c @@ -300,7 +300,7 @@ static void rxperf_deliver_to_call(struct work_struct *= work) &len, false, &remote_abort, &call->service_id); =20 - if (ret =3D=3D -EINPROGRESS || ret =3D=3D -EAGAIN) + if (ret =3D=3D -EAGAIN || ret =3D=3D 2) return; if (ret < 0 || ret =3D=3D 1) { if (ret =3D=3D 1) @@ -379,7 +379,7 @@ static int rxperf_extract_data(struct rxperf_call *call= , bool want_more) if (ret =3D=3D 0 || ret =3D=3D -EAGAIN) return ret; =20 - if (ret =3D=3D 1) { + if (ret =3D=3D 1 || ret =3D=3D 2) { switch (call->state) { case RXPERF_CALL_SV_AWAIT_REQUEST: rxperf_set_call_state(call, RXPERF_CALL_SV_REPLYING); From nobody Thu Sep 24 12:50:58 2026 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4AF645349A9 for ; Wed, 23 Sep 2026 13:38:19 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.133.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790170700; cv=none; b=dc9mIuAJiJiA7+wSR9m38CtKpKdU2vAxVnAw0DYNQ3wnGGRWK3RiZAP4i2t2FUmabMntnq01uiFnlB9PXZxWUtO7f3qEEktrvcigySM5Savcz6ckVeJ5Sb94txnEFuzzqNJhYQvPYE+11FK9sGdjLremdlgsNsBxPIij++nqmBk= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790170700; c=relaxed/simple; bh=YVG2GdfZ/DU+R1hpjVUnwj/1UuU7gqIwRqvk6yX2xuA=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=p13fHARBuo9FOG65eGFsqdromJ10GOyrX+zSwDNQ1FQgdvsmhZkt+1Bce6K/4cLtr7RXf5XvNVok021D8UeUQDCnfFZkBRevmURzlkV1PoEi4ZrftCuOW2VgzhksX4k2js9DN/Bam7diLITv4EMYYeD+loqBb9maMgOcPLNypxM= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=EZsA9B7b; arc=none smtp.client-ip=170.10.133.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="EZsA9B7b" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1790170698; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=z8cEewKUOsN85qX65B7mWIZXL/Xgq09KjiIiPoqM12k=; b=EZsA9B7bzkQlWb6K7kASga35nqO0jhUjkdcpj9XpCF7bK6xOOmJZuAyIUauBr5EGUn5sTn NEz7eDUCMjJWDvl9G3Ur3y7vhpTzNO0+7IxOlLBSQs0GVQswVbZAyCqiRKRZCl7tkMdB/4 EkZjExZdpUu1Zi6vl1UzhM3XQkjNcaM= Received: from mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-252-cBpLWN4dNFigqFKlw6Q32Q-1; Wed, 23 Sep 2026 09:38:15 -0400 X-MC-Unique: cBpLWN4dNFigqFKlw6Q32Q-1 X-Mimecast-MFC-AGG-ID: cBpLWN4dNFigqFKlw6Q32Q_1790170693 Received: from mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.17]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 58B3919775FB; Wed, 23 Sep 2026 13:38:13 +0000 (UTC) Received: from warthog.com (unknown [10.44.32.54]) by mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 42DC319539A7; Wed, 23 Sep 2026 13:38:10 +0000 (UTC) From: David Howells To: netdev@vger.kernel.org Cc: David Howells , Marc Dionne , Jakub Kicinski , "David S. Miller" , Eric Dumazet , Paolo Abeni , Simon Horman , linux-afs@lists.infradead.org, linux-kernel@vger.kernel.org, stable@kernel.org Subject: [PATCH net v11 11/17] rxrpc: Fix double IRQ enablement Date: Wed, 23 Sep 2026 14:36:58 +0100 Message-ID: <20260923133706.1496540-12-dhowells@redhat.com> In-Reply-To: <20260923133706.1496540-1-dhowells@redhat.com> References: <20260923133706.1496540-1-dhowells@redhat.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.0 on 10.30.177.17 Content-Type: text/plain; charset="utf-8" rxrpc_notify_socket() explicitly disables and then re-enables IRQs, but one of its call chains (rxrpc_input_queue_data() -> rxrpc_end_rx_phase() -> rxrpc_call_completed() -> rxrpc_set_call_completion()) has IRQs disabled around it. Fix this by making rxrpc_notify_socket() use irqsave spinlocks. Fixes: a2ea9a907260 ("rxrpc: Use irq-disabling spinlocks between app and I/= O thread") Link: https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260812110129.97= 9970-6-dhowells@redhat.com Signed-off-by: David Howells cc: Marc Dionne cc: Eric Dumazet cc: "David S. Miller" cc: Jakub Kicinski cc: Paolo Abeni cc: Simon Horman cc: linux-afs@lists.infradead.org cc: stable@kernel.org --- net/rxrpc/recvmsg.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/net/rxrpc/recvmsg.c b/net/rxrpc/recvmsg.c index 716f7f47d7e4..0c960f13b5fc 100644 --- a/net/rxrpc/recvmsg.c +++ b/net/rxrpc/recvmsg.c @@ -24,6 +24,7 @@ void rxrpc_notify_socket(struct rxrpc_call *call) { struct rxrpc_sock *rx; struct sock *sk; + unsigned long flags; =20 _enter("%d", call->debug_id); =20 @@ -38,16 +39,16 @@ void rxrpc_notify_socket(struct rxrpc_call *call) sk =3D &rx->sk; if (rx && sk->sk_state < RXRPC_CLOSE) { if (call->notify_rx) { - spin_lock_irq(&call->notify_lock); + spin_lock_irqsave(&call->notify_lock, flags); call->notify_rx(sk, call, call->user_call_ID); - spin_unlock_irq(&call->notify_lock); + spin_unlock_irqrestore(&call->notify_lock, flags); } else { - spin_lock_irq(&rx->recvmsg_lock); + spin_lock_irqsave(&rx->recvmsg_lock, flags); if (list_empty(&call->recvmsg_link)) { rxrpc_get_call(call, rxrpc_call_get_notify_socket); list_add_tail(&call->recvmsg_link, &rx->recvmsg_q); } - spin_unlock_irq(&rx->recvmsg_lock); + spin_unlock_irqrestore(&rx->recvmsg_lock, flags); =20 if (!sock_flag(sk, SOCK_DEAD)) { _debug("call %ps", sk->sk_data_ready); From nobody Thu Sep 24 12:50:58 2026 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 09521528421 for ; Wed, 23 Sep 2026 13:38:25 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.129.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790170707; cv=none; b=gJ6NcuPqMLgWPOakSh+RIZlfm67V06zKXCM2UlHC4w1RupWZiM8uDoAAMcJucsiE1YMYfIQJbYPa36S1ZCK0LtqBOpWOgl0IJE6jtDqWOcKJXJKEq2UXSM8Vhx+QMacu5+m5Vr2ZKZfnP+3S/y12F30MaRAtgiYpov6iuLSRXQY= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790170707; c=relaxed/simple; bh=B91d7cpO45/3biR+vbDcO9NDMEwft4Qa+BZbb33eUQA=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=GXCAuj/AjGW6vYoBVltHcMho+0YbolgR79XoWCwpOEs1jj4SfD35pQH4wmnkVi4LMijBcXHuw7TbfGTBANd9vlIXIAEW5Z835H7nkWaguKex+GGZ8T9f5akIFY2UgG6lhxnef/wqKgFFPJ9Dh3soMtHCWcd3EeYMmuJEFDBWqIE= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=fW8PyX8N; arc=none smtp.client-ip=170.10.129.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="fW8PyX8N" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1790170705; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=VCs/LO6BiAJX2RDaKskTXyXfHoBUExtpi6AMZbPC2ec=; b=fW8PyX8NAmYn7ymXrdQ0nmiEwQFLZmJ4smB++hOC8d5vhc2u41xQQxHy0HARykO0LGuhTd fz4uvX1xxnNJlWSwXjSidbXwcY2nMdY2l1uFCyvEXw/7aYIErFRjxcVSJCo2Q9WHo5Xatg Ym+huQVbmwbguEiVX3gK1gfJ3zn2Lgc= Received: from mx-prod-mc-05.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-329-qcB9IW_xNCKN0WoRkTCLUA-1; Wed, 23 Sep 2026 09:38:19 -0400 X-MC-Unique: qcB9IW_xNCKN0WoRkTCLUA-1 X-Mimecast-MFC-AGG-ID: qcB9IW_xNCKN0WoRkTCLUA_1790170698 Received: from mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.12]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-05.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 2CA4C1977517; Wed, 23 Sep 2026 13:38:18 +0000 (UTC) Received: from warthog.com (unknown [10.44.32.54]) by mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 017FF1956042; Wed, 23 Sep 2026 13:38:14 +0000 (UTC) From: David Howells To: netdev@vger.kernel.org Cc: David Howells , Marc Dionne , Jakub Kicinski , "David S. Miller" , Eric Dumazet , Paolo Abeni , Simon Horman , linux-afs@lists.infradead.org, linux-kernel@vger.kernel.org, stable@kernel.org Subject: [PATCH net v11 12/17] rxrpc: Fix generation of notifications after call completion Date: Wed, 23 Sep 2026 14:36:59 +0100 Message-ID: <20260923133706.1496540-13-dhowells@redhat.com> In-Reply-To: <20260923133706.1496540-1-dhowells@redhat.com> References: <20260923133706.1496540-1-dhowells@redhat.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.0 on 10.30.177.12 Content-Type: text/plain; charset="utf-8" AF_RXRPC may generate a notification to the application after a call has completed because it generates one notification when rxrpc_input_split_jumbo() queues the final packet and completes the call and then generates another when rxrpc_input_split_jumbo() does the aggregated data receive notification at the end of the function. This might cause the AFS filesystem to malfunction because it tries to queue the afs_call for processing an extra time. Most of the time this happens quickly enough that the second queue_work skips, but sometimes this means that the call work may happen a second time with implications for afs_call lifetime management. Fix this by: (1) Create a lighter version of rxrpc_notify_socket() that's just used to requeue a call for rxrpc_recvmsg() without needing to consider kernel apps. This also ignores shutdown(), allowing recvmsg() to continue collecting from already queued calls. (2) Move rxrpc_notify_socket() to call_state.c and rename it to __rxrpc_notify_socket(). (3) Create a wrapper called rxrpc_notify_socket() that skips the notification if a call is completed. (4) Make rxrpc_set_call_completion() call __rxrpc_notify_socket() to avoid the skip-if-completed check. Also remove the comment on rxrpc_notify_socket() that said it added the call to a dummy queue to prevent further notification. Fixes: 2d1faf7a0ca3 ("rxrpc: Simplify skbuff accounting in receive path") Signed-off-by: David Howells cc: Marc Dionne cc: Eric Dumazet cc: "David S. Miller" cc: Jakub Kicinski cc: Paolo Abeni cc: Simon Horman cc: linux-afs@lists.infradead.org cc: stable@kernel.org --- include/trace/events/rxrpc.h | 1 + net/rxrpc/ar-internal.h | 2 +- net/rxrpc/call_state.c | 57 +++++++++++++++++++++++++++++++++++- net/rxrpc/recvmsg.c | 45 ++++++++++------------------ 4 files changed, 74 insertions(+), 31 deletions(-) diff --git a/include/trace/events/rxrpc.h b/include/trace/events/rxrpc.h index a5c92592d8f9..52f8718cf725 100644 --- a/include/trace/events/rxrpc.h +++ b/include/trace/events/rxrpc.h @@ -343,6 +343,7 @@ EM(rxrpc_call_see_distribute_error, "SEE dist-err") \ EM(rxrpc_call_see_input, "SEE input ") \ EM(rxrpc_call_see_notify_released, "SEE nfy-rlsd") \ + EM(rxrpc_call_see_notify_skipped, "SEE nfy-skip") \ EM(rxrpc_call_see_recvmsg, "SEE recvmsg ") \ EM(rxrpc_call_see_recvmsg_requeue, "SEE recv-rqu") \ EM(rxrpc_call_see_recvmsg_requeue_first, "SEE recv-rqF") \ diff --git a/net/rxrpc/ar-internal.h b/net/rxrpc/ar-internal.h index a6f830c1621f..cb36a709f540 100644 --- a/net/rxrpc/ar-internal.h +++ b/net/rxrpc/ar-internal.h @@ -1110,6 +1110,7 @@ static inline bool rxrpc_is_client_call(const struct = rxrpc_call *call) /* * call_state.c */ +void rxrpc_notify_socket(struct rxrpc_call *call); bool rxrpc_set_call_completion(struct rxrpc_call *call, enum rxrpc_call_completion compl, u32 abort_code, @@ -1442,7 +1443,6 @@ extern const struct seq_operations rxrpc_local_seq_op= s; /* * recvmsg.c */ -void rxrpc_notify_socket(struct rxrpc_call *); int rxrpc_recvmsg(struct socket *, struct msghdr *, size_t, int); =20 /* diff --git a/net/rxrpc/call_state.c b/net/rxrpc/call_state.c index 6afb54373ebb..52465e88a044 100644 --- a/net/rxrpc/call_state.c +++ b/net/rxrpc/call_state.c @@ -7,6 +7,61 @@ =20 #include "ar-internal.h" =20 +/* + * Post a call for attention by the socket or kernel service. + */ +static void __rxrpc_notify_socket(struct rxrpc_call *call) +{ + struct rxrpc_sock *rx; + struct sock *sk; + unsigned long flags; + + if (test_bit(RXRPC_CALL_RELEASED, &call->flags)) { + rxrpc_see_call(call, rxrpc_call_see_notify_released); + return; + } + + rcu_read_lock(); + + rx =3D rcu_dereference(call->socket); + sk =3D &rx->sk; + if (rx && sk->sk_state < RXRPC_CLOSE) { + if (call->notify_rx) { + spin_lock_irqsave(&call->notify_lock, flags); + call->notify_rx(sk, call, call->user_call_ID); + spin_unlock_irqrestore(&call->notify_lock, flags); + } else { + spin_lock_irqsave(&rx->recvmsg_lock, flags); + if (list_empty(&call->recvmsg_link)) { + rxrpc_get_call(call, rxrpc_call_get_notify_socket); + list_add_tail(&call->recvmsg_link, &rx->recvmsg_q); + } + spin_unlock_irqrestore(&rx->recvmsg_lock, flags); + + if (!sock_flag(sk, SOCK_DEAD)) { + _debug("call %ps", sk->sk_data_ready); + sk->sk_data_ready(sk); + } + } + } + + rcu_read_unlock(); +} + +/* + * Post a call for attention by the socket or kernel service if the call i= sn't + * already complete. + */ +void rxrpc_notify_socket(struct rxrpc_call *call) +{ + if (rxrpc_call_is_complete(call)) { + rxrpc_see_call(call, rxrpc_call_see_notify_skipped); + return; + } + + __rxrpc_notify_socket(call); +} + /* * Transition a call to the complete state. */ @@ -25,7 +80,7 @@ bool rxrpc_set_call_completion(struct rxrpc_call *call, rxrpc_set_call_state(call, RXRPC_CALL_COMPLETE); trace_rxrpc_call_complete(call); wake_up(&call->waitq); - rxrpc_notify_socket(call); + __rxrpc_notify_socket(call); return true; } =20 diff --git a/net/rxrpc/recvmsg.c b/net/rxrpc/recvmsg.c index 0c960f13b5fc..8b07c31dfd2e 100644 --- a/net/rxrpc/recvmsg.c +++ b/net/rxrpc/recvmsg.c @@ -17,14 +17,14 @@ #include "ar-internal.h" =20 /* - * Post a call for attention by the socket or kernel service. Further - * notifications are suppressed by putting recvmsg_link on a dummy queue. + * Requeue a call for recvmsg() to pick up. We ignore RXRPC_CLOSE, allowi= ng + * recvmsg() to continue picking up calls that are already on the queue if= it + * wants to, but no new calls will get added. */ -void rxrpc_notify_socket(struct rxrpc_call *call) +static void rxrpc_requeue_call(struct socket *sock, struct rxrpc_call *cal= l) { - struct rxrpc_sock *rx; - struct sock *sk; - unsigned long flags; + struct rxrpc_sock *rx =3D rxrpc_sk(sock->sk); + struct sock *sk =3D &rx->sk; =20 _enter("%d", call->debug_id); =20 @@ -33,31 +33,18 @@ void rxrpc_notify_socket(struct rxrpc_call *call) return; } =20 - rcu_read_lock(); - - rx =3D rcu_dereference(call->socket); - sk =3D &rx->sk; - if (rx && sk->sk_state < RXRPC_CLOSE) { - if (call->notify_rx) { - spin_lock_irqsave(&call->notify_lock, flags); - call->notify_rx(sk, call, call->user_call_ID); - spin_unlock_irqrestore(&call->notify_lock, flags); - } else { - spin_lock_irqsave(&rx->recvmsg_lock, flags); - if (list_empty(&call->recvmsg_link)) { - rxrpc_get_call(call, rxrpc_call_get_notify_socket); - list_add_tail(&call->recvmsg_link, &rx->recvmsg_q); - } - spin_unlock_irqrestore(&rx->recvmsg_lock, flags); + spin_lock_irq(&rx->recvmsg_lock); + if (list_empty(&call->recvmsg_link)) { + rxrpc_get_call(call, rxrpc_call_get_notify_socket); + list_add_tail(&call->recvmsg_link, &rx->recvmsg_q); + } + spin_unlock_irq(&rx->recvmsg_lock); =20 - if (!sock_flag(sk, SOCK_DEAD)) { - _debug("call %ps", sk->sk_data_ready); - sk->sk_data_ready(sk); - } - } + if (!sock_flag(sk, SOCK_DEAD)) { + _debug("call %ps", sk->sk_data_ready); + sk->sk_data_ready(sk); } =20 - rcu_read_unlock(); _leave(""); } =20 @@ -562,7 +549,7 @@ int rxrpc_recvmsg(struct socket *sock, struct msghdr *m= sg, size_t len, =20 if (!(flags & MSG_PEEK) && !skb_queue_empty(&call->recvmsg_queue)) - rxrpc_notify_socket(call); + rxrpc_requeue_call(sock, call); goto not_yet_complete; =20 call_failed: From nobody Thu Sep 24 12:50:58 2026 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 819D45304CE for ; Wed, 23 Sep 2026 13:38:29 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.129.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790170711; cv=none; b=OZqCogFhQ7ys0jBXU+4S9JJv38oLP+l7wqlMS50OynXNAMMuaH453M6lHV+E+v5NURTAYSgVr31alzpMMZrQQoKXc+eQchuKCnd5GafjmM3fIM6mrp3i6zKY9Ib/ZICI5Wyhvdo5IU5TwSoxtAipt2UsBT842MHuIc4y6Il3MW4= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790170711; c=relaxed/simple; bh=qaXzYrNiiWjeqfWelf3EWiGvOJxOMon5SO68ipwd1Fc=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=q2u4tIb6JQUDwwemITTT9uaoIYEWirSkKWWBXcTp2JUZHlJHnG22HWR/WnifeqFn93cBERtD78RcdPS/73fgkYG+KIUmC0URT2sE1gilu2wA8YNMnD0RODoLIB2uuXbsxn9RA0SvqvNVLzN2vh2Tj/G3P1Vi8/J/wOIVxJ7QB+U= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=cKUENYh8; arc=none smtp.client-ip=170.10.129.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="cKUENYh8" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1790170708; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=jGs0yeHtAEv/IqKQ632s8QFE8oaBGxldKeQIsDwv57c=; b=cKUENYh80e1DShlcZ5/w42e6NHhTHF+5zU0+00/ZfFaPJRMwiz12XkdP6j3J8eqMc7Z/uG LIkfVZhJSBBLJwE+ITOn3wTPtD55hOfjpbtaH6k2ExxhGOtgLELOR14aFKn2pBVI1aenr0 JwnmbfAgEu++n7cioeFw0Z4o7qKhjeI= Received: from mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-637-RSZROErGMlG2L-gMamK5GA-1; Wed, 23 Sep 2026 09:38:25 -0400 X-MC-Unique: RSZROErGMlG2L-gMamK5GA-1 X-Mimecast-MFC-AGG-ID: RSZROErGMlG2L-gMamK5GA_1790170703 Received: from mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.12]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id ADA511800668; Wed, 23 Sep 2026 13:38:23 +0000 (UTC) Received: from warthog.com (unknown [10.44.32.54]) by mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id D062A1956042; Wed, 23 Sep 2026 13:38:19 +0000 (UTC) From: David Howells To: netdev@vger.kernel.org Cc: David Howells , Marc Dionne , Jakub Kicinski , "David S. Miller" , Eric Dumazet , Paolo Abeni , Simon Horman , linux-afs@lists.infradead.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org Subject: [PATCH net v11 13/17] rxrpc: Fix RxGK key parser to check enctype is supported Date: Wed, 23 Sep 2026 14:37:00 +0100 Message-ID: <20260923133706.1496540-14-dhowells@redhat.com> In-Reply-To: <20260923133706.1496540-1-dhowells@redhat.com> References: <20260923133706.1496540-1-dhowells@redhat.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.0 on 10.30.177.12 Content-Type: text/plain; charset="utf-8" Fix the parser of RxGK keys supplied by userspace to check that the specified encryption type is supported and check the key length. Further, since the checking function isn't necessarily available in CONFIG_RXGK=3Dn, make the RxGK key wrangling bits conditional. Also only account the a token to the key's quota if that token is used. Fixes: 0ca100ff4df6 ("rxrpc: Add YFS RxGK (GSSAPI) security class") Link: https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260824091645.41= 5423-1-dhowells%40redhat.com Signed-off-by: David Howells cc: Marc Dionne cc: Eric Dumazet cc: "David S. Miller" cc: Jakub Kicinski cc: Paolo Abeni cc: Simon Horman cc: linux-afs@lists.infradead.org cc: stable@vger.kernel.org --- net/rxrpc/key.c | 41 +++++++++++++++++++++++++++++++---------- 1 file changed, 31 insertions(+), 10 deletions(-) diff --git a/net/rxrpc/key.c b/net/rxrpc/key.c index cbd26da44951..904da3fe7e47 100644 --- a/net/rxrpc/key.c +++ b/net/rxrpc/key.c @@ -71,14 +71,11 @@ static int rxrpc_preparse_xdr_rxkad(struct key_preparse= d_payload *prep, if (toklen < 8 * 4 + tktlen) return -EKEYREJECTED; =20 - plen =3D sizeof(*token) + sizeof(*token->kad) + tktlen; - prep->quotalen +=3D datalen + plen; - - plen -=3D sizeof(*token); token =3D kzalloc_obj(*token); if (!token) return -ENOMEM; =20 + plen =3D sizeof(*token->kad) + tktlen; token->kad =3D kzalloc(plen, GFP_KERNEL); if (!token->kad) { kfree(token); @@ -112,6 +109,8 @@ static int rxrpc_preparse_xdr_rxkad(struct key_preparse= d_payload *prep, token->kad->ticket[4], token->kad->ticket[5], token->kad->ticket[6], token->kad->ticket[7]); =20 + prep->quotalen +=3D sizeof(*token) + datalen + plen; + /* count the number of tokens attached */ prep->payload.data[1] =3D (void *)((unsigned long)prep->payload.data[1] += 1); =20 @@ -129,6 +128,7 @@ static int rxrpc_preparse_xdr_rxkad(struct key_preparse= d_payload *prep, return 0; } =20 +#ifdef CONFIG_RXGK static u64 xdr_dec64(const __be32 *xdr) { return (u64)ntohl(xdr[0]) << 32 | (u64)ntohl(xdr[1]); @@ -166,12 +166,13 @@ static int rxrpc_preparse_xdr_yfs_rxgk(struct key_pre= parsed_payload *prep, size_t datalen, const __be32 *xdr, unsigned int toklen) { + const struct krb5_enctype *enc; struct rxrpc_key_token *token, **pptoken; time64_t expiry; - size_t plen; const __be32 *ticket, *key; s64 tmp; size_t raw_keylen, raw_tktlen, keylen, tktlen; + int ret =3D -EKEYREJECTED; =20 _enter(",{%x,%x,%x,%x},%x", ntohl(xdr[0]), ntohl(xdr[1]), ntohl(xdr[2]), ntohl(xdr[3]), @@ -202,10 +203,6 @@ static int rxrpc_preparse_xdr_yfs_rxgk(struct key_prep= arsed_payload *prep, goto reject; } =20 - plen =3D sizeof(*token) + sizeof(*token->rxgk) + tktlen + keylen; - prep->quotalen +=3D datalen + plen; - - plen -=3D sizeof(*token); token =3D kzalloc_obj(*token); if (!token) goto nomem; @@ -229,6 +226,17 @@ static int rxrpc_preparse_xdr_yfs_rxgk(struct key_prep= arsed_payload *prep, token->rxgk->key.data =3D token->rxgk->_key; token->rxgk->ticket.len =3D raw_tktlen; =20 + /* Check the enctype is supported. */ + enc =3D crypto_krb5_find_enctype(token->rxgk->enctype); + if (!enc) { + ret =3D -ENOPKG; + goto reject_token; + } + if (raw_keylen !=3D enc->key_len) { + ret =3D -EKEYREJECTED; + goto reject_token; + } + if (token->rxgk->endtime !=3D 0) { expiry =3D rxrpc_s64_to_time64(token->rxgk->endtime); if (expiry < 0) @@ -257,6 +265,8 @@ static int rxrpc_preparse_xdr_yfs_rxgk(struct key_prepa= rsed_payload *prep, _debug("TICK: %*phN", min_t(u32, token->rxgk->ticket.len, 32), token->rxgk->ticket.data); =20 + prep->quotalen +=3D sizeof(*token) + datalen + tktlen + keylen; + /* count the number of tokens attached */ prep->payload.data[1] =3D (void *)((unsigned long)prep->payload.data[1] += 1); =20 @@ -280,12 +290,13 @@ static int rxrpc_preparse_xdr_yfs_rxgk(struct key_pre= parsed_payload *prep, kfree(token->rxgk); kfree(token); reject: - return -EKEYREJECTED; + return ret; expired: kfree(token->rxgk); kfree(token); return -EKEYEXPIRED; } +#endif /* CONFIG_RXGK */ =20 /* * attempt to parse the data as the XDR format @@ -386,9 +397,11 @@ static int rxrpc_preparse_xdr(struct key_preparsed_pay= load *prep) case RXRPC_SECURITY_RXKAD: ret2 =3D rxrpc_preparse_xdr_rxkad(prep, datalen, token, toklen); break; +#ifdef CONFIG_RXGK case RXRPC_SECURITY_YFS_RXGK: ret2 =3D rxrpc_preparse_xdr_yfs_rxgk(prep, datalen, token, toklen); break; +#endif default: ret2 =3D -EPROTONOSUPPORT; break; @@ -556,10 +569,12 @@ static void rxrpc_free_token_list(struct rxrpc_key_to= ken *token) case RXRPC_SECURITY_RXKAD: kfree(token->kad); break; +#ifdef CONFIG_RXGK case RXRPC_SECURITY_YFS_RXGK: kfree(token->rxgk->ticket.data); kfree(token->rxgk); break; +#endif default: pr_err("Unknown token type %x on rxrpc key\n", token->security_index); @@ -603,9 +618,11 @@ static void rxrpc_describe(const struct key *key, stru= ct seq_file *m) case RXRPC_SECURITY_RXKAD: seq_puts(m, "ka"); break; +#ifdef CONFIG_RXGK case RXRPC_SECURITY_YFS_RXGK: seq_puts(m, "ygk"); break; +#endif default: /* we have a ticket we can't encode */ seq_printf(m, "%u", token->security_index); break; @@ -770,12 +787,14 @@ static long rxrpc_read(const struct key *key, toksize +=3D RND(token->kad->ticket_len); break; =20 +#ifdef CONFIG_RXGK case RXRPC_SECURITY_YFS_RXGK: toksize +=3D 6 * 8 + 2 * 4; if (!token->no_leak_key) toksize +=3D RND(token->rxgk->key.len); toksize +=3D RND(token->rxgk->ticket.len); break; +#endif =20 default: /* we have a ticket we can't encode */ pr_err("Unsupported key token type (%u)\n", @@ -856,6 +875,7 @@ static long rxrpc_read(const struct key *key, ENCODE_DATA(token->kad->ticket_len, token->kad->ticket); break; =20 +#ifdef CONFIG_RXGK case RXRPC_SECURITY_YFS_RXGK: ENCODE64(token->rxgk->begintime); ENCODE64(token->rxgk->endtime); @@ -869,6 +889,7 @@ static long rxrpc_read(const struct key *key, ENCODE_DATA(token->rxgk->key.len, token->rxgk->key.data); ENCODE_DATA(token->rxgk->ticket.len, token->rxgk->ticket.data); break; +#endif =20 default: pr_err("Unsupported key token type (%u)\n", From nobody Thu Sep 24 12:50:58 2026 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6B76A5372F8 for ; Wed, 23 Sep 2026 13:38:35 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.133.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790170717; cv=none; b=bK8+d6qnb1jnXc8KAdWgaM0FkJEEghnU/M78+KYWXZ4UVZW6monaA7KSSYHOV2N0TooYtq0JN3on9HltQIOhUHJwzRPeJYtvDp0uB+RhRgKwASyATSrvtuqDCEVL++qcPS9Zq9JvnXsokiLbb2dBtIBECnqYsiBpMNl89ICzo7A= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790170717; c=relaxed/simple; bh=4rulRz/ACvzdMV65PymqWxPemkbqAcLLi8c99C7xCYs=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=X4QfCw1ow8Mo2m58vyphd/6y/WqO40vwVYqG/AOkyhcQ0dTgTjERoIQzTlcIBQhNBobKApLkPlsCH1ELqCRNke/kc5VKjJJVgofeixoJtjPM7/q2ySmVMceFtHPB+qA1v1JeTczGMkAr1ibZiVGJZNxYBE+gC6Fn8kfjPfoTuN8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=BKxdA5f1; arc=none smtp.client-ip=170.10.133.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="BKxdA5f1" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1790170714; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=fPG3JCWqVjH93XC+uYutRtQ5wp+gmwXzPifpp4N5UQY=; b=BKxdA5f1vCLLi8gYiDXi4UeuzLVDHFJKhfi+8iMP4E3zx9XNav39EHm+tWQBKSVkLXwy6x 3aOQZt85904Tt3frf9obWeaEQ99ZfBkqg7tCIwMQykFM05dF0iAfgov6woDYTZrFPAlmS7 31Y90aEL99joM40Fn5y5cvPXlmQFWOg= Received: from mx-prod-mc-01.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-606-RunEewxrMmy8GXkfaE6xOQ-1; Wed, 23 Sep 2026 09:38:31 -0400 X-MC-Unique: RunEewxrMmy8GXkfaE6xOQ-1 X-Mimecast-MFC-AGG-ID: RunEewxrMmy8GXkfaE6xOQ_1790170708 Received: from mx-prod-int-06.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-06.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.93]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-01.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 700551955EAB; Wed, 23 Sep 2026 13:38:28 +0000 (UTC) Received: from warthog.com (unknown [10.44.32.54]) by mx-prod-int-06.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 48CC51800473; Wed, 23 Sep 2026 13:38:25 +0000 (UTC) From: David Howells To: netdev@vger.kernel.org Cc: David Howells , Marc Dionne , Jakub Kicinski , "David S. Miller" , Eric Dumazet , Paolo Abeni , Simon Horman , linux-afs@lists.infradead.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org Subject: [PATCH net v11 14/17] afs: Fix creation of RxGK CM channel token to have right size Date: Wed, 23 Sep 2026 14:37:01 +0100 Message-ID: <20260923133706.1496540-15-dhowells@redhat.com> In-Reply-To: <20260923133706.1496540-1-dhowells@redhat.com> References: <20260923133706.1496540-1-dhowells@redhat.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.93 Content-Type: text/plain; charset="utf-8" Fix afs_create_yfs_cm_token() so that it calculates the token size correctly, remembering to add in the 4 bytes of the level. Fixes: d98c317fd9aa ("afs: Use rxgk RESPONSE to pass token for callback cha= nnel") Link: https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260824091645.41= 5423-1-dhowells%40redhat.com Signed-off-by: David Howells cc: Marc Dionne cc: Eric Dumazet cc: "David S. Miller" cc: Jakub Kicinski cc: Paolo Abeni cc: Simon Horman cc: linux-afs@lists.infradead.org cc: stable@vger.kernel.org --- fs/afs/cm_security.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/afs/cm_security.c b/fs/afs/cm_security.c index 103168c70dd4..5eeeef761cf3 100644 --- a/fs/afs/cm_security.c +++ b/fs/afs/cm_security.c @@ -235,7 +235,7 @@ static int afs_create_yfs_cm_token(struct sk_buff *chal= lenge, * struct RXGK_AuthName identities<>; * }; */ - toksize =3D keysize + 8 + 4 + 4 + 8 + xdr_len_object(authsize); + toksize =3D keysize + 4 + 8 + 4 + 4 + 8 + xdr_len_object(authsize); =20 offset =3D 0; encsize =3D crypto_krb5_how_much_buffer(token_krb5, KRB5_ENCRYPT_MODE, to= ksize, &offset); From nobody Thu Sep 24 12:50:58 2026 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 380555383E5 for ; Wed, 23 Sep 2026 13:38:40 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.129.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790170721; cv=none; b=XhtDDmSDHlJ0mIWlG/ObKg2C9/i2bSQbiQ/EGc2cxLQQDoPxg6jf/j1ae5DSZ47Dm8obTzhpfdHidGERy9K1XqvLlSC3BRb4apO7g9WbdgGbXkuL9jmQztgF8bhyUfMj3qASz2j03hv2FWL0zCpzd1Z1+lcWITwq0JzYoUoHay8= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790170721; c=relaxed/simple; bh=oARkvHRv8u06iVI97tQ0CNF8wMYPDcFPNd+6s7DXcpk=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=f/qCRrBcScjjCLmseOIn+JzUZENcaU7TmuOwHl/Zhh1i1PmtGNjv/WhsYgs9NHCZi9XdHjcqup23eD3JNHR6mD9454TQOw3uChSBoQIGh1ep0ssXrKwaK+b10V03wD1qLRuzMV8w/5t4ZfdbUq/XwX7cxZTMuc4HFgdx0ha3cZw= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=M0yXsV+8; arc=none smtp.client-ip=170.10.129.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="M0yXsV+8" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1790170719; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=WbMzyVBVe/sIloy3f7aJTGgiLhXy0Ia1vtlgRrzL8zs=; b=M0yXsV+8cCFf23w/vvcSfscM5nnFBdZ76EJzKl1txmbuHgDiFUfymuPasmg9oD3r/dnnIr pqOWkdl1tsT1ekA6221RL3lJwqVNhIYje5aBG6Joasw+rXxyQHahwiFDl0HRTXjuCuDNVf hiuhaqUOCLcE5L3FSRvfsKtTWUSP5xg= Received: from mx-prod-mc-01.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-669-_os72mXuM3qGPT9T6JvuUQ-1; Wed, 23 Sep 2026 09:38:35 -0400 X-MC-Unique: _os72mXuM3qGPT9T6JvuUQ-1 X-Mimecast-MFC-AGG-ID: _os72mXuM3qGPT9T6JvuUQ_1790170714 Received: from mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.12]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-01.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id DF9EA1954B1D; Wed, 23 Sep 2026 13:38:33 +0000 (UTC) Received: from warthog.com (unknown [10.44.32.54]) by mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 096931956042; Wed, 23 Sep 2026 13:38:29 +0000 (UTC) From: David Howells To: netdev@vger.kernel.org Cc: David Howells , Marc Dionne , Jakub Kicinski , "David S. Miller" , Eric Dumazet , Paolo Abeni , Simon Horman , linux-afs@lists.infradead.org, linux-kernel@vger.kernel.org, Jeffrey Altman , Jarkko Sakkinen , keyrings@vger.kernel.org, stable@kernel.org Subject: [PATCH net v11 15/17] afs: Fix lack of setting call->server when doing FS.InlineBulkStatus Date: Wed, 23 Sep 2026 14:37:02 +0100 Message-ID: <20260923133706.1496540-16-dhowells@redhat.com> In-Reply-To: <20260923133706.1496540-1-dhowells@redhat.com> References: <20260923133706.1496540-1-dhowells@redhat.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.0 on 10.30.177.12 Content-Type: text/plain; charset="utf-8" Fix afs_make_op_call to set call->server. This will prevent afs_done_fs_inline_bulk_status() from oopsing if the server does not support the FS.InlineBulkStatus RPC due to call->server not being set. Note that this requires afs_make_op_call() to be moved so that it can use afs_use_server(); the server is un-used by afs_free_call(). Fixes: e49c7b2f6de7 ("afs: Build an abstraction around an "operation" conce= pt") Link: https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260824091645.41= 5423-1-dhowells%40redhat.com Signed-off-by: David Howells cc: Marc Dionne cc: Jeffrey Altman cc: Eric Dumazet cc: "David S. Miller" cc: Jakub Kicinski cc: Paolo Abeni cc: Simon Horman cc: Jarkko Sakkinen cc: linux-afs@lists.infradead.org cc: keyrings@vger.kernel.org cc: stable@kernel.org --- fs/afs/internal.h | 33 +++++++++++++++++---------------- include/trace/events/afs.h | 1 + 2 files changed, 18 insertions(+), 16 deletions(-) diff --git a/fs/afs/internal.h b/fs/afs/internal.h index 330654ed16ec..40dc85d9a5c9 100644 --- a/fs/afs/internal.h +++ b/fs/afs/internal.h @@ -1424,22 +1424,6 @@ static inline void afs_see_call(struct afs_call *cal= l, enum afs_call_trace why) __builtin_return_address(0)); } =20 -static inline void afs_make_op_call(struct afs_operation *op, struct afs_c= all *call, - gfp_t gfp) -{ - struct afs_addr_list *alist =3D op->estate->addresses; - - op->call =3D afs_get_call(call, afs_call_trace_get); - op->type =3D call->type; - call->op =3D op; - call->key =3D op->key; - call->intr =3D !(op->flags & AFS_OPERATION_UNINTR); - call->peer =3D rxrpc_kernel_get_peer(alist->addrs[op->addr_index].peer); - call->service_id =3D op->server->service_id; - afs_make_call(call, gfp); - afs_put_call(call); -} - static inline void afs_extract_begin(struct afs_call *call, void *buf, siz= e_t size) { call->iov_len =3D size; @@ -1771,6 +1755,23 @@ static inline struct inode *AFS_VNODE_TO_I(struct af= s_vnode *vnode) return &vnode->netfs.inode; } =20 +static inline void afs_make_op_call(struct afs_operation *op, struct afs_c= all *call, + gfp_t gfp) +{ + struct afs_addr_list *alist =3D op->estate->addresses; + + op->call =3D afs_get_call(call, afs_call_trace_get); + op->type =3D call->type; + call->op =3D op; + call->server =3D afs_use_server(op->server, false, afs_server_trace_use_c= all); + call->key =3D op->key; + call->intr =3D !(op->flags & AFS_OPERATION_UNINTR); + call->peer =3D rxrpc_kernel_get_peer(alist->addrs[op->addr_index].peer); + call->service_id =3D op->server->service_id; + afs_make_call(call, gfp); + afs_put_call(call); +} + /* * Note that a dentry got changed. We need to set d_fsdata to the data ve= rsion * number derived from the result of the operation. It doesn't matter if diff --git a/include/trace/events/afs.h b/include/trace/events/afs.h index 1b3c48b5591d..04b0bb682b81 100644 --- a/include/trace/events/afs.h +++ b/include/trace/events/afs.h @@ -148,6 +148,7 @@ enum yfs_cm_operation { EM(afs_server_trace_unuse_slist_isort, "UNU isort") \ EM(afs_server_trace_update, "UPDATE ") \ EM(afs_server_trace_use_by_uuid, "USE uuid ") \ + EM(afs_server_trace_use_call, "USE call ") \ EM(afs_server_trace_use_cm_call, "USE cm-cl") \ EM(afs_server_trace_use_get_caps, "USE gcaps") \ EM(afs_server_trace_use_give_up_cb, "USE gvupc") \ From nobody Thu Sep 24 12:50:58 2026 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 61E1B538D92 for ; Wed, 23 Sep 2026 13:38:44 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.133.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790170725; cv=none; b=ki+E+6EMfqzbWmmiC4q7p5ML+xBPNOP4qsFiEtBFuN7C3CriBiUMtLLVJEPEFMmOXx9i396DKCtZREJrzIAZtId0PnLnwuoHPV466nipi4sroF92s4A/4FGIhzHZpjM8lqNOgvKajFCF+6mywgEeUG6LbKKy9IKZRy4ArWwcZQU= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790170725; c=relaxed/simple; bh=C5Z33UK1q9A2DIreWQwpPUin3DP+A9ytD5ps3dEuVDE=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=RiZ/uL/Q7e7Saj3bIdTLWSJezZwGYGOXxpqLvUatE5j5J5Ud06dxrcDx3OByOtq7+7auT/Y3B7bHz+HaGXHCmNZfIGPzfmVTiO6Xb0WhgH9SdoFzDxoyNPd9meS2tP+Hiyq0oE/SJQmnzdYLWU74rds7EtBdDIdjaXd6E1TBzCY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=CfU19HvH; arc=none smtp.client-ip=170.10.133.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="CfU19HvH" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1790170723; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=9h5xcT8+EYkwS6UIVrfYDzPRvAU8rPGMSJ7y80eXqKQ=; b=CfU19HvHRpJRTiDyokqLsBc1OuRiTkLsPJ4caH3mTCRoqWj3jy56/pSQS+W6tQ+vlQ/UaC 1ursMNJHp02ztdszzz5sJ4DAJdsVoSEjW8kqeyPBc5Apwy8oR/HHmPF6yg6v681J2JWcn9 kUT5pK4hbDRpuKfRB2CiW+wUv4eluF0= Received: from mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-346-X0GjhdGRMlCSoIo7vPp8GA-1; Wed, 23 Sep 2026 09:38:40 -0400 X-MC-Unique: X0GjhdGRMlCSoIo7vPp8GA-1 X-Mimecast-MFC-AGG-ID: X0GjhdGRMlCSoIo7vPp8GA_1790170718 Received: from mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.12]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 7CB451955DCE; Wed, 23 Sep 2026 13:38:38 +0000 (UTC) Received: from warthog.com (unknown [10.44.32.54]) by mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 92DF01956042; Wed, 23 Sep 2026 13:38:35 +0000 (UTC) From: David Howells To: netdev@vger.kernel.org Cc: David Howells , Marc Dionne , Jakub Kicinski , "David S. Miller" , Eric Dumazet , Paolo Abeni , Simon Horman , linux-afs@lists.infradead.org, linux-kernel@vger.kernel.org Subject: [PATCH net v11 16/17] afs: Fix uncleared op->call pointer Date: Wed, 23 Sep 2026 14:37:03 +0100 Message-ID: <20260923133706.1496540-17-dhowells@redhat.com> In-Reply-To: <20260923133706.1496540-1-dhowells@redhat.com> References: <20260923133706.1496540-1-dhowells@redhat.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.0 on 10.30.177.12 Content-Type: text/plain; charset="utf-8" Fix uncleared op->call pointer in afs_wait_for_operation() to make sure that it isn't seen set if server rotation occurs. Note that afs_read_receive() already does this. Note also that this was spotted by AI code inspection rather than by hitting an issue. Fixes: e49c7b2f6de7 ("afs: Build an abstraction around an "operation" conce= pt") Link: https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260907113743.14= 53210-1-dhowells%40redhat.com Signed-off-by: David Howells cc: Marc Dionne cc: Eric Dumazet cc: "David S. Miller" cc: Jakub Kicinski cc: Paolo Abeni cc: Simon Horman cc: linux-afs@lists.infradead.org --- fs/afs/fs_operation.c | 1 + 1 file changed, 1 insertion(+) diff --git a/fs/afs/fs_operation.c b/fs/afs/fs_operation.c index 20801b29521d..94fa65548d71 100644 --- a/fs/afs/fs_operation.c +++ b/fs/afs/fs_operation.c @@ -297,6 +297,7 @@ void afs_wait_for_operation(struct afs_operation *op) op->call_error =3D op->call->error; op->call_responded =3D op->call->responded; afs_put_call(op->call); + op->call =3D NULL; } } From nobody Thu Sep 24 12:50:58 2026 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9DBD1533586 for ; Wed, 23 Sep 2026 13:38:51 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.133.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790170733; cv=none; b=J+XzgyNMJBov+ZWLeQp1psKlVJyeqZbfBWLc+3H/3sMrx9iSBnkedH0mNB0OHFqd2IM9gNJFZCBY4bfd7X3ATbFJLKhE69p7FS5OGQMgh2ApV1s0KT7Zzjm7w0X79wpRKKt5/CnRJsoXQ4DWHSezJLhAWl5PULznXtcPst6V4Dc= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790170733; c=relaxed/simple; bh=hNd6bIyFAvlFxc6hjuFcDqVwVqg86Zvx1YHzqvt4tLo=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=TBgNsZa9uowIqqjSHz03TM0CUp62GkzpdVI+i4VkycMPSkEVVR3V4Gdaq7ZiWDrpLSbzdZ+kexJ9yCoXUxLrUsUzp4aPbReTYFgpyAnTxLy5GMp/5O+oJODZ9cZyn3nzLgS7NDtFE5udvIXRzG0QvuZoEdMITXp2l5JO0jOl990= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=MMLMPSFo; arc=none smtp.client-ip=170.10.133.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="MMLMPSFo" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1790170730; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=HHCKmh+GTex17viqHU7+p3b1kZPrhM46bDIsKbGkEho=; b=MMLMPSFoA0Gjbi50X2fQbBfKd7mykbws+fFkn/kA8nL4rWszeri/KmYUtVcajHxZDnmesT 3FPMwJ0oqd55n8FwZ7JVevjUCagIAKoBKU67eSrgNQ0XX3YfphymKzJR7mES3QTyBNr6pf 2LNLAPdW5NQXd3PyKtYnfNRtZMlJp/Y= Received: from mx-prod-mc-01.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-342-JkCCGU2pMfud3ac-UALFuQ-1; Wed, 23 Sep 2026 09:38:46 -0400 X-MC-Unique: JkCCGU2pMfud3ac-UALFuQ-1 X-Mimecast-MFC-AGG-ID: JkCCGU2pMfud3ac-UALFuQ_1790170724 Received: from mx-prod-int-10.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-10.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.95]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-01.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 28299195FD12; Wed, 23 Sep 2026 13:38:44 +0000 (UTC) Received: from warthog.com (unknown [10.44.32.54]) by mx-prod-int-10.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 28704427; Wed, 23 Sep 2026 13:38:39 +0000 (UTC) From: David Howells To: netdev@vger.kernel.org Cc: David Howells , Marc Dionne , Jakub Kicinski , "David S. Miller" , Eric Dumazet , Paolo Abeni , Simon Horman , linux-afs@lists.infradead.org, linux-kernel@vger.kernel.org, Seungwon Bae , stable@vger.kernel.org Subject: [PATCH net v11 17/17] rxrpc: fix use-after-free in rxrpc_poke_conn() Date: Wed, 23 Sep 2026 14:37:04 +0100 Message-ID: <20260923133706.1496540-18-dhowells@redhat.com> In-Reply-To: <20260923133706.1496540-1-dhowells@redhat.com> References: <20260923133706.1496540-1-dhowells@redhat.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.6 on 10.30.177.95 Content-Type: text/plain; charset="utf-8" From: Seungwon Bae rxrpc_poke_conn() takes a reference on the connection with no liveness check, unlike its sibling rxrpc_queue_conn() which gates on atomic_read(&conn->active) >=3D 0. The per-connection timer is armed with no reference held for it, and rxrpc_put_connection() cancels it with a non-synchronous timer_delete() only after the refcount reaches 0. refcount_t saturates rather than resurrecting, so the connection can be kfree()d while still linked in local->conn_attend_q (nothing in teardown unlinks attend_link). The rxrpc I/O thread then performs a UAF write (list_del_init) plus UAF reads and indirect calls through conn->security. Reproduced on a KASAN + PREEMPT kernel: 56 "refcount_t: addition on 0" saturations at load, escalating to BUG: KASAN: slab-use-after-free in rxrpc_io_thread Write of size 8 AF_RXRPC socket creation (rxrpc_create) has no capability check, so this is reachable by an unprivileged user. Guard rxrpc_poke_conn() with the same liveness/refcount check the sibling rxrpc_queue_conn() uses before taking the poke reference, so a connection past its last-active point is not poked/requeued after teardown began. Verified before/after on KASAN+PREEMPT at equal timer volume: 56 saturations + 15 KASAN reports unpatched vs 0 and 0 patched. Fixes: f2cce89a074e ("rxrpc: Implement a mechanism to send an event notific= ation to a connection") Signed-off-by: Seungwon Bae Signed-off-by: David Howells cc: Marc Dionne cc: Eric Dumazet cc: "David S. Miller" cc: Jakub Kicinski cc: Paolo Abeni cc: Simon Horman cc: linux-afs@lists.infradead.org cc: stable@vger.kernel.org --- net/rxrpc/conn_object.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/net/rxrpc/conn_object.c b/net/rxrpc/conn_object.c index 0ece717db0f8..1be50e0c9cee 100644 --- a/net/rxrpc/conn_object.c +++ b/net/rxrpc/conn_object.c @@ -34,7 +34,10 @@ void rxrpc_poke_conn(struct rxrpc_connection *conn, enum= rxrpc_conn_trace why) spin_lock_irq(&local->lock); busy =3D !list_empty(&conn->attend_link); if (!busy) { - rxrpc_get_connection(conn, why); + if (!rxrpc_get_connection_maybe(conn, why)) { + spin_unlock_irq(&local->lock); + return; + } list_add_tail(&conn->attend_link, &local->conn_attend_q); } spin_unlock_irq(&local->lock);