Patch "rxrpc: serialize kernel accept preallocation with socket teardown" has been added to the 6.1-stable tree
gregkh at linuxfoundation.org
gregkh at linuxfoundation.org
Thu Aug 20 06:10:14 PDT 2026
This is a note to let you know that I've just added the patch titled
rxrpc: serialize kernel accept preallocation with socket teardown
to the 6.1-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
rxrpc-serialize-kernel-accept-preallocation-with-socket-teardown.patch
and it can be found in the queue-6.1 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable at vger.kernel.org> know about it.
>From stable+bounces-287928-greg=kroah.com at vger.kernel.org Wed Jul 22 18:29:16 2026
From: Sasha Levin <sashal at kernel.org>
Date: Wed, 22 Jul 2026 12:07:48 -0400
Subject: rxrpc: serialize kernel accept preallocation with socket teardown
To: stable at vger.kernel.org
Cc: Li Daming <d4n.for.sec at gmail.com>, Yuan Tan <yuantan098 at gmail.com>, Yifan Wu <yifanwucs at gmail.com>, Juefei Pu <tomapufckgml at gmail.com>, Xin Liu <bird at lzu.edu.cn>, Ren Wei <n05ec at lzu.edu.cn>, David Howells <dhowells at redhat.com>, Marc Dionne <marc.dionne at auristor.com>, Jeffrey Altman <jaltman at auristor.com>, Simon Horman <horms at kernel.org>, linux-afs at lists.infradead.org, stable at kernel.org, Jakub Kicinski <kuba at kernel.org>, Sasha Levin <sashal at kernel.org>
Message-ID: <20260722160748.1740112-1-sashal at kernel.org>
From: Li Daming <d4n.for.sec at gmail.com>
[ Upstream commit dc175389b18c29a5303ee83169ec653adfae3e17 ]
rxrpc_kernel_charge_accept() reads rx->backlog without any
socket/backlog synchronization and passes that raw pointer into
rxrpc_service_prealloc_one(). A concurrent rxrpc_discard_prealloc()
sets rx->backlog = NULL and frees the backlog rings, so a kernel
preallocation worker can keep using a freed struct rxrpc_backlog
while updating *_backlog_head/tail and array slots.
Serialize the state check and backlog lookup with the socket lock,
and reject kernel preallocation once teardown has disabled
listening or discarded the service backlog.
Fixes: 00e907127e6f ("rxrpc: Preallocate peers, conns and calls for incoming service requests")
Reported-by: Yuan Tan <yuantan098 at gmail.com>
Reported-by: Yifan Wu <yifanwucs at gmail.com>
Reported-by: Juefei Pu <tomapufckgml at gmail.com>
Reported-by: Xin Liu <bird at lzu.edu.cn>
Signed-off-by: Li Daming <d4n.for.sec at gmail.com>
Signed-off-by: Ren Wei <n05ec at lzu.edu.cn>
Signed-off-by: David Howells <dhowells at redhat.com>
cc: Marc Dionne <marc.dionne at auristor.com>
cc: Jeffrey Altman <jaltman at auristor.com>
cc: Simon Horman <horms at kernel.org>
cc: linux-afs at lists.infradead.org
cc: stable at kernel.org
Link: https://patch.msgid.link/20260609140911.838677-6-dhowells@redhat.com
Signed-off-by: Jakub Kicinski <kuba at kernel.org>
[ kept 6.1's extra user_attach_call argument in the rxrpc_service_prealloc_one() call ]
Signed-off-by: Sasha Levin <sashal at kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
---
net/rxrpc/call_accept.c | 27 ++++++++++++++++++++-------
1 file changed, 20 insertions(+), 7 deletions(-)
--- a/net/rxrpc/call_accept.c
+++ b/net/rxrpc/call_accept.c
@@ -481,14 +481,27 @@ int rxrpc_kernel_charge_accept(struct so
unsigned long user_call_ID, gfp_t gfp,
unsigned int debug_id)
{
- struct rxrpc_sock *rx = rxrpc_sk(sock->sk);
- struct rxrpc_backlog *b = rx->backlog;
+ struct rxrpc_backlog *b;
+ struct rxrpc_sock *rx;
+ struct sock *sk;
+ int ret;
- if (sock->sk->sk_state == RXRPC_CLOSE)
- return -ESHUTDOWN;
+ sk = sock->sk;
+ rx = rxrpc_sk(sk);
- return rxrpc_service_prealloc_one(rx, b, notify_rx,
- user_attach_call, user_call_ID,
- gfp, debug_id);
+ lock_sock(sk);
+ if (sk->sk_state != RXRPC_SERVER_LISTENING || !rx->backlog) {
+ ret = -ESHUTDOWN;
+ goto out;
+ }
+
+ b = rx->backlog;
+ ret = rxrpc_service_prealloc_one(rx, b, notify_rx,
+ user_attach_call, user_call_ID,
+ gfp, debug_id);
+
+out:
+ release_sock(sk);
+ return ret;
}
EXPORT_SYMBOL(rxrpc_kernel_charge_accept);
Patches currently in stable-queue which might be from sashal at kernel.org are
queue-6.1/udmabuf-do-not-create-malformed-scatterlists.patch
queue-6.1/treewide-rename-pinctrl_gpio_direction_input_new.patch
queue-6.1/dma-buf-udmabuf-skip-redundant-cpu-sync-to-fix-cacheline-eexist-warning.patch
queue-6.1/wifi-brcmfmac-set-f2-blocksize-to-256-for-bcm43752.patch
queue-6.1/usb-gadget-f_tcm-synchronize-delayed-set_alt-with-teardown.patch
queue-6.1/input-mms114-reject-an-oversized-device-packet-size.patch
queue-6.1/iommu-amd-don-t-split-flush-for-amd_iommu_domain_flush_all.patch
queue-6.1/dm-fix-trailing-statements.patch
queue-6.1/fbcon-rename-struct-fbcon_ops-to-struct-fbcon_par.patch
queue-6.1/usb-typec-ucsi-fix-race-condition-and-ordering-in-port-unregistration.patch
queue-6.1/fpga-dfl-afu-validate-dma-mapping-length-in-afu_dma_map_region.patch
queue-6.1/mm-mm_init-fix-uninitialized-struct-pages-for-zone_device.patch
queue-6.1/netfilter-nft_set_pipapo-move-cloning-of-match-info-to-insert-removal-path.patch
queue-6.1/vduse-remove-unused-vaddr-parameter-of-vduse_domain_free_coherent.patch
queue-6.1/netfilter-nf_tables-remove-unused-nft_reduce_is_readonly.patch
queue-6.1/bootconfig-fix-null-pointer-arithmetic-in-xbc_snprint_cmdline.patch
queue-6.1/alsa-hda-codecs-hdmi-disable-keep-alive-before-audio-format-change.patch
queue-6.1/octeontx2-annotate-mmio-regions-as-__iomem.patch
queue-6.1/siw-inline-do_tcp_sendpages.patch
queue-6.1/kvm-s390-pci-fix-resource-leak-on-irq-registration-f.patch
queue-6.1/net-mana-validate-the-packet-length-reported-by-the-nic.patch
queue-6.1/netfilter-nft_set_pipapo-move-prove_locking-helper-around.patch
queue-6.1/mlxsw-fix-refcount-leak-in-mlxsw_sp_port_lag_join.patch
queue-6.1/mptcp-pm-avoid-code-duplication-to-lookup-endp.patch
queue-6.1/s390-cpum_cf-merge-source-files-for-cpu-measurement-counter-facility.patch
queue-6.1/octeontx2-af-cn10k-restrict-vf-lmtline-sharing-to-its-own-pf.patch
queue-6.1/mm-move-most-of-core-mm-initialization-to-mm-mm_init.c.patch
queue-6.1/mptcp-pm-use-addr-entry-for-get_local_id.patch
queue-6.1/mmc-vub300-fix-use-after-free-on-probe-failure.patch
queue-6.1/ipvs-separate-destination-availability-state.patch
queue-6.1/libceph-add-doutc-and-_client-debug-macros-support.patch
queue-6.1/ata-libata-core-reject-an-invalid-concurrent-positioning-ranges-count.patch
queue-6.1/bootconfig-move-xbc_snprint_cmdline-to-lib-bootconfig.c.patch
queue-6.1/taskstats-retain-dead-thread-stats-in-tgid-queries.patch
queue-6.1/fs-ntfs3-undo-critial-modificatins-to-keep-directory-consistency.patch
queue-6.1/mm-vmemmap-devdax-fix-kernel-crash-when-probing-devdax-devices.patch
queue-6.1/usb-musb-omap2430-clean-up-probe-error-handling.patch
queue-6.1/dm-add-missing-empty-lines.patch
queue-6.1/net-ipa-fix-smem-state-handle-leaks-in-smp2p-init.patch
queue-6.1/vfio-pci-fix-racy-bitfields-and-tighten-struct-layout.patch
queue-6.1/octeontx2-pf-clear-stale-mailbox-irq-state-before-request_irq.patch
queue-6.1/ceph-pass-the-mdsc-to-several-helpers.patch
queue-6.1/fbcon-use-correct-type-for-vc_resize-return-value.patch
queue-6.1/netfilter-nf_conntrack_sip-remove-net-variable-shadowing.patch
queue-6.1/netfilter-nf_tables-pass-context-structure-to-nft_parse_register_load.patch
queue-6.1/remoteproc-qcom-pas-adjust-the-phys-addr-wrt-the-mem-region.patch
queue-6.1/wifi-ath6kl-fix-use-after-free-in-aggr_reset_state.patch
queue-6.1/asoc-mediatek-use-common-mtk_afe_pcm_platform-with-common-probe-cb.patch
queue-6.1/wifi-brcmfmac-fix-43752-sdio-fwvid-incorrectly-labelled-as-cypress-cyw.patch
queue-6.1/vduse-avoid-leaking-information-to-userspace.patch
queue-6.1/asoc-mediatek-mt8192-check-runtime-resume-during-probe.patch
queue-6.1/tipc-restrict-socket-queue-dumps-in-enqueue-tracepoints.patch
queue-6.1/ceph-avoid-fs-reclaim-while-using-current-journal_info.patch
queue-6.1/drm-i915-hdcp-move-to-using-intel_display-in-intel_hdcp.patch
queue-6.1/usb-typec-ucsi-split-connector-lock-classes.patch
queue-6.1/f2fs-fix-uaf-issue-in-f2fs_merge_page_bio.patch
queue-6.1/drm-i915-hdcp-require-monotonically-increasing-seq_num_v.patch
queue-6.1/pmdomain-imx-fix-i.mx8mp-power-notifier.patch
queue-6.1/mmc-vub300-fix-use-after-free-on-disconnect.patch
queue-6.1/mtd-maps-vmu-flash-fix-fault-in-unaligned-fixup.patch
queue-6.1/ceph-fix-hanging-__ceph_get_caps-with-stale-mds_wanted.patch
queue-6.1/remoteproc-qcom-fix-leak-when-custom-dump_segments-addition-fails.patch
queue-6.1/libceph-amend-checking-to-fix-make-w-1-build-breakage.patch
queue-6.1/dm-crypt-correct-foo-to-foo.patch
queue-6.1/libceph-bound-pg_-temp-upmap-upmap_items-length-to-ceph_pg_max_size.patch
queue-6.1/selinux-avoid-sk_socket-dereference-in-selinux_sctp_bind_connect.patch
queue-6.1/mptcp-pm-userspace-fix-use-after-free-in-get_local_id.patch
queue-6.1/drm-bridge-cdns-dsi-replace-deprecated-universal_dev_pm_ops.patch
queue-6.1/kvm-introduce-vcpu-wants_to_run.patch
queue-6.1/drm-i915-hdcp-check-streams-bounds-before-overflow.patch
queue-6.1/dm-remove-unnecessary-braces-from-single-statement-blocks.patch
queue-6.1/tcp_bpf-inline-do_tcp_sendpages-as-it-s-now-a-wrapper-around-tcp_sendmsg.patch
queue-6.1/bluetooth-remove-usage-of-the-deprecated-ida_simple_xx-api.patch
queue-6.1/vduse-take-out-allocations-from-vduse_dev_alloc_coherent.patch
queue-6.1/lsm-infrastructure-management-of-the-sock-security.patch
queue-6.1/remoteproc-qcom-replace-kstrdup-with-kstrndup.patch
queue-6.1/audit-use-unsigned-int-instead-of-unsigned.patch
queue-6.1/wifi-brcmfmac-drain-bus_reset-work-on-device-removal.patch
queue-6.1/i2c-davinci-unregister-cpufreq-notifier-on-probe-failure.patch
queue-6.1/bootconfig-do-not-put-quotes-on-cmdline-items-unless-necessary.patch
queue-6.1/mptcp-add-mptcp_userspace_pm_lookup_addr-helper.patch
queue-6.1/i2c-imx-separate-atomic-dma-and-non-dma-use-case.patch
queue-6.1/locking-rt-fix-the-incorrect-rcu-protection-in-rt_spin_unlock.patch
queue-6.1/drm-displayid-fix-tiled-display-topology-id-size.patch
queue-6.1/netfilter-nft_set_pipapo-merge-deactivate-helper-into-caller.patch
queue-6.1/dm-integrity-don-t-increment-hash_offset-twice.patch
queue-6.1/vfs-audit-introduce-kern_path_parent-for-audit.patch
queue-6.1/bpf-fork-wipe-bpf_storage-before-bailouts-that-access-it.patch
queue-6.1/audit-fix-recursive-locking-deadlock-in-audit_dupe_exe.patch
queue-6.1/asoc-fsl_sai-fix-spurious-bclk-on-resume-by-clearing-byp.patch
queue-6.1/drm-tegra-fbdev-remove-offset-into-framebuffer-memory.patch
queue-6.1/rxrpc-serialize-kernel-accept-preallocation-with-socket-teardown.patch
queue-6.1/mei-bus-access-mei_device-under-device_lock-on-cleanup.patch
queue-6.1/usb-musb-omap2430-do-not-put-borrowed-of_node-in-probe.patch
queue-6.1/block-stop-the-timeout-timer-when-releasing-a-never-.patch
queue-6.1/s390-cpum_cf-move-stccm_avail.patch
queue-6.1/9p-skip-nlink-update-in-cacheless-mode-to-fix-warn_on.patch
queue-6.1/netfilter-nf_tables-drop-unused-3rd-argument-from-validate-callback-ops.patch
queue-6.1/mmc-vub300-rename-probe-error-labels.patch
queue-6.1/kvm-x86-only-reset-tsc-deadline-timer-in-apic_timer_expired-on-kvm_run.patch
queue-6.1/usb-typec-ucsi-only-enable-supported-notifications.patch
queue-6.1/netfilter-nft_set_pipapo-use-gfp_kernel-for-insertions.patch
queue-6.1/tracing-rename-kvfree_rcu-to-kvfree_rcu_mightsleep.patch
queue-6.1/drm-i915-vrr-check-has_vrr-first-in-intel_vrr_is_capable.patch
queue-6.1/mm-do-file-ownership-checks-with-the-proper-mount-idmap.patch
queue-6.1/vduse-use-fixed-4kb-bounce-pages-for-non-4kb-page-size.patch
queue-6.1/alsa-hda-fix-cached-processing-coefficient-verbs.patch
queue-6.1/net-ip6_tunnel-require-cap_net_admin-in-the-device-netns-for-changelink.patch
queue-6.1/dm-verity-make-error-counter-atomic.patch
queue-6.1/alsa-hda-conexant-remove-mic-bias-threshold-override.patch
queue-6.1/media-i2c-imx219-correct-the-minimum-vblanking-value.patch
queue-6.1/kvm-s390-pci-fix-memory-accounting-for-pinned-unpinn.patch
queue-6.1/net-sched-sch_taprio-replace-direct-dequeue-call-with-peek-and-qdisc_dequeue_peeked.patch
queue-6.1/i2c-imx-fix-locked-bus-on-smbus-block-read-of-0-atomic.patch
queue-6.1/wifi-libertas_tf-fix-use-after-free-in-lbtf_free_adapter.patch
queue-6.1/netfilter-nft_set_pipapo-don-t-leak-bad-clone-into-future-transaction.patch
queue-6.1/input-mms114-fix-touch-indexing-for-mms134s-and-mms136.patch
queue-6.1/mlxsw-spectrum-on-port-enslavement-to-a-lag-join-upper-s-bridges.patch
queue-6.1/firmware_loader-introduce-__free-cleanup-hanler.patch
queue-6.1/netfilter-nf_conntrack_sip-validate-skb_dst-before-accessing-it.patch
queue-6.1/espintcp-inline-do_tcp_sendpages.patch
queue-6.1/s390-perf_cpum_cf-add-missing-array_index_nospec-to-__hw_perf_event_init.patch
queue-6.1/asoc-mediatek-mt8183-check-runtime-resume-during-probe.patch
queue-6.1/dm-verity-avoid-double-increment-of-use_bh_wq_enabled.patch
queue-6.1/ceph-rename-_to_client-to-_to_fs_client.patch
queue-6.1/octeontx2-vf-clear-stale-mailbox-irq-state-before-request_irq.patch
queue-6.1/net-thunderbolt-fix-frags-overflow-by-bounding-frame_count.patch
queue-6.1/netfilter-nft_set_pipapo-make-pipapo_clone-helper-return-null.patch
queue-6.1/ntfs3-validate-split-point-offset-in-indx_insert_into_buffer.patch
queue-6.1/espintcp-use-sk_msg_free_partial-to-fix-partial-send.patch
queue-6.1/netfilter-bitwise-rename-some-boolean-operation-functions.patch
queue-6.1/fscrypt-use-the-mount-idmap-for-the-owner-check-in-f.patch
queue-6.1/input-ims-pcu-fix-firmware-leak-in-async-update.patch
queue-6.1/kernel-user-allow-user_struct-locked_vm-to-be-usable.patch
queue-6.1/media-i2c-imx219-drop-imx219_vts_-macros.patch
queue-6.1/s390-cpum_cf-move-cpum_cf_ctrset_size.patch
queue-6.1/net-sched-taprio-avoid-calling-child-ops-dequeue-child-twice.patch
queue-6.1/octeontx2-pf-fix-sqb-pointer-leak-on-init-failure.patch
queue-6.1/ipmi-fix-refcount-leak-in-i_ipmi_request.patch
queue-6.1/kvm-s390-pci-fix-missing-error-codes-and-memory-unac.patch
queue-6.1/tracing-osnoise-call-synchronize_rcu-when-unregistering.patch
queue-6.1/media-i2c-imx219-rename-vts-to-frm_length.patch
queue-6.1/remoteproc-qcom-fix-sparse-warnings.patch
queue-6.1/gpio-tegra-do-not-call-pinctrl-for-gpio-direction.patch
queue-6.1/libceph-fix-two-unsafe-bare-decodes-in-decode_lockers.patch
queue-6.1/netfilter-nft_objref-validate-objref-and-objrefmap-expressions.patch
queue-6.1/net-sched-act_ct-preserve-tc_skb_cb-across-defragmentation.patch
queue-6.1/media-imx219-fix-maximum-frame-length-in-lines.patch
queue-6.1/serial-max310x-replace-bare-use-of-unsigned-with-unsigned-int-checkpatch.patch
queue-6.1/drm-i915-vrr-require-valid-min-max-vfreq-for-vrr.patch
queue-6.1/audit-widen-ino-fields-to-u64.patch
queue-6.1/net-macb-drop-in-flight-tx-skbs-on-close.patch
queue-6.1/drm-amdgpu-respect-placement-requirements-in-amdgpu_gtt_mgr-functions.patch
queue-6.1/asoc-mediatek-mt8192-afe-pcm-simplify-probe-with-local-dev-variable.patch
queue-6.1/bpf-reject-bpf_map_type_inode_storage-creation-if-bpf-lsm-is-uninitialized.patch
queue-6.1/ovl-use-linked-upper-dentry-in-copy-up-tmpfile.patch
queue-6.1/bluetooth-hci-remove-hci_amp-support.patch
queue-6.1/netfilter-nft_set_pipapo-prepare-pipapo_get-helper-for-on-demand-clone.patch
queue-6.1/tcp_bpf-smc-tls-espintcp-siw-reduce-msg_sendpage_notlast-usage.patch
queue-6.1/netfilter-nft_set_pipapo-prepare-walk-function-for-on-demand-clone.patch
queue-6.1/taskstats-fill_stats_for_tgid-use-for_each_thread.patch
queue-6.1/thunderbolt-prevent-xdomain-delayed-work-use-after-free-on-disconnect.patch
queue-6.1/asoc-mediatek-mt8192-afe-pcm-simplify-with-dev_err_probe.patch
queue-6.1/asoc-mediatek-mt8192-afe-pcm-convert-to-devm_pm_runtime_enable.patch
queue-6.1/fs-resctrl-fix-double-add-of-pseudo-locked-region-s-rmid-to-free-list.patch
queue-6.1/s390-cpum_cf-remove-in-kernel-counting-facility-interface.patch
queue-6.1/asoc-sof-ipc3-control-fix-heap-overflow-in-bytes_ext-put-get.patch
queue-6.1/kvm-s390-pci-fix-aisb-calculation.patch
queue-6.1/serial-max310x-implement-gpio_chip-get_direction.patch
queue-6.1/sctp-avoid-auth_enable-sysctl-uaf-during-netns-teardown.patch
queue-6.1/gpio-mt7621-avoid-corruption-of-shared-interrupt-trigger-state.patch
More information about the linux-afs
mailing list