Patch "rxrpc: serialize kernel accept preallocation with socket teardown" has been added to the 5.15-stable tree

[gregkh at linuxfoundation.org]

This is a note to let you know that I've just added the patch titled

    rxrpc: serialize kernel accept preallocation with socket teardown

to the 5.15-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     rxrpc-serialize-kernel-accept-preallocation-with-socket-teardown.patch
and it can be found in the queue-5.15 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable at vger.kernel.org> know about it.


>From stable+bounces-287975-greg=kroah.com at vger.kernel.org Wed Jul 22 19:04:39 2026
From: Sasha Levin <sashal at kernel.org>
Date: Wed, 22 Jul 2026 12:54:35 -0400
Subject: rxrpc: serialize kernel accept preallocation with socket teardown
To: stable at vger.kernel.org
Cc: Li Daming <d4n.for.sec at gmail.com>, Yuan Tan <yuantan098 at gmail.com>, Yifan Wu <yifanwucs at gmail.com>, Juefei Pu <tomapufckgml at gmail.com>, Xin Liu <bird at lzu.edu.cn>, Ren Wei <n05ec at lzu.edu.cn>, David Howells <dhowells at redhat.com>, Marc Dionne <marc.dionne at auristor.com>, Jeffrey Altman <jaltman at auristor.com>, Simon Horman <horms at kernel.org>, linux-afs at lists.infradead.org, stable at kernel.org, Jakub Kicinski <kuba at kernel.org>, Sasha Levin <sashal at kernel.org>
Message-ID: <20260722165435.1853631-1-sashal at kernel.org>

From: Li Daming <d4n.for.sec at gmail.com>

[ Upstream commit dc175389b18c29a5303ee83169ec653adfae3e17 ]

rxrpc_kernel_charge_accept() reads rx->backlog without any
socket/backlog synchronization and passes that raw pointer into
rxrpc_service_prealloc_one(). A concurrent rxrpc_discard_prealloc()
sets rx->backlog = NULL and frees the backlog rings, so a kernel
preallocation worker can keep using a freed struct rxrpc_backlog
while updating *_backlog_head/tail and array slots.

Serialize the state check and backlog lookup with the socket lock,
and reject kernel preallocation once teardown has disabled
listening or discarded the service backlog.

Fixes: 00e907127e6f ("rxrpc: Preallocate peers, conns and calls for incoming service requests")
Reported-by: Yuan Tan <yuantan098 at gmail.com>
Reported-by: Yifan Wu <yifanwucs at gmail.com>
Reported-by: Juefei Pu <tomapufckgml at gmail.com>
Reported-by: Xin Liu <bird at lzu.edu.cn>
Signed-off-by: Li Daming <d4n.for.sec at gmail.com>
Signed-off-by: Ren Wei <n05ec at lzu.edu.cn>
Signed-off-by: David Howells <dhowells at redhat.com>
cc: Marc Dionne <marc.dionne at auristor.com>
cc: Jeffrey Altman <jaltman at auristor.com>
cc: Simon Horman <horms at kernel.org>
cc: linux-afs at lists.infradead.org
cc: stable at kernel.org
Link: https://patch.msgid.link/20260609140911.838677-6-dhowells@redhat.com
Signed-off-by: Jakub Kicinski <kuba at kernel.org>
[ kept 6.1's extra user_attach_call argument in the rxrpc_service_prealloc_one() call ]
Signed-off-by: Sasha Levin <sashal at kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
---
 net/rxrpc/call_accept.c |   27 ++++++++++++++++++++-------
 1 file changed, 20 insertions(+), 7 deletions(-)

--- a/net/rxrpc/call_accept.c
+++ b/net/rxrpc/call_accept.c
@@ -481,14 +481,27 @@ int rxrpc_kernel_charge_accept(struct so
 			       unsigned long user_call_ID, gfp_t gfp,
 			       unsigned int debug_id)
 {
-	struct rxrpc_sock *rx = rxrpc_sk(sock->sk);
-	struct rxrpc_backlog *b = rx->backlog;
+	struct rxrpc_backlog *b;
+	struct rxrpc_sock *rx;
+	struct sock *sk;
+	int ret;
 
-	if (sock->sk->sk_state == RXRPC_CLOSE)
-		return -ESHUTDOWN;
+	sk = sock->sk;
+	rx = rxrpc_sk(sk);
 
-	return rxrpc_service_prealloc_one(rx, b, notify_rx,
-					  user_attach_call, user_call_ID,
-					  gfp, debug_id);
+	lock_sock(sk);
+	if (sk->sk_state != RXRPC_SERVER_LISTENING || !rx->backlog) {
+		ret = -ESHUTDOWN;
+		goto out;
+	}
+
+	b = rx->backlog;
+	ret = rxrpc_service_prealloc_one(rx, b, notify_rx,
+					 user_attach_call, user_call_ID,
+					 gfp, debug_id);
+
+out:
+	release_sock(sk);
+	return ret;
 }
 EXPORT_SYMBOL(rxrpc_kernel_charge_accept);


Patches currently in stable-queue which might be from sashal at kernel.org are

queue-5.15/udmabuf-do-not-create-malformed-scatterlists.patch
queue-5.15/dma-buf-udmabuf-skip-redundant-cpu-sync-to-fix-cacheline-eexist-warning.patch
queue-5.15/input-mms114-reject-an-oversized-device-packet-size.patch
queue-5.15/iommu-amd-don-t-split-flush-for-amd_iommu_domain_flush_all.patch
queue-5.15/media-mediatek-vcodec-fix-a-resource-leak-related-to.patch
queue-5.15/fbcon-rename-struct-fbcon_ops-to-struct-fbcon_par.patch
queue-5.15/fpga-dfl-afu-validate-dma-mapping-length-in-afu_dma_map_region.patch
queue-5.15/netfilter-nft_set_pipapo-move-cloning-of-match-info-to-insert-removal-path.patch
queue-5.15/vduse-remove-unused-vaddr-parameter-of-vduse_domain_free_coherent.patch
queue-5.15/octeontx2-annotate-mmio-regions-as-__iomem.patch
queue-5.15/netfilter-nft_set_pipapo-move-prove_locking-helper-around.patch
queue-5.15/mlxsw-fix-refcount-leak-in-mlxsw_sp_port_lag_join.patch
queue-5.15/ipvs-separate-destination-availability-state.patch
queue-5.15/octeontx2-pf-clear-stale-mailbox-irq-state-before-request_irq.patch
queue-5.15/fbcon-use-correct-type-for-vc_resize-return-value.patch
queue-5.15/ipv4-adopt-dst_dev-skb_dst_dev-and-skb_dst_dev_net.patch
queue-5.15/netfilter-nf_conntrack_sip-remove-net-variable-shadowing.patch
queue-5.15/remoteproc-qcom-pas-adjust-the-phys-addr-wrt-the-mem-region.patch
queue-5.15/asoc-mediatek-use-common-mtk_afe_pcm_platform-with-common-probe-cb.patch
queue-5.15/vduse-avoid-leaking-information-to-userspace.patch
queue-5.15/asoc-mediatek-mt8192-check-runtime-resume-during-probe.patch
queue-5.15/tipc-restrict-socket-queue-dumps-in-enqueue-tracepoints.patch
queue-5.15/f2fs-fix-uaf-issue-in-f2fs_merge_page_bio.patch
queue-5.15/octeontx2-af-fix-apr-entry-mapping-based-on-apr_lmt_cfg.patch
queue-5.15/remoteproc-qcom-fix-leak-when-custom-dump_segments-addition-fails.patch
queue-5.15/net-dst-annotate-data-races-around-dst-output.patch
queue-5.15/vduse-take-out-allocations-from-vduse_dev_alloc_coherent.patch
queue-5.15/remoteproc-qcom-replace-kstrdup-with-kstrndup.patch
queue-5.15/audit-use-unsigned-int-instead-of-unsigned.patch
queue-5.15/media-mtk-vcodec-potential-null-pointer-deference-in.patch
queue-5.15/i2c-davinci-unregister-cpufreq-notifier-on-probe-failure.patch
queue-5.15/netfilter-nft_set_pipapo-merge-deactivate-helper-into-caller.patch
queue-5.15/vfs-audit-introduce-kern_path_parent-for-audit.patch
queue-5.15/audit-fix-recursive-locking-deadlock-in-audit_dupe_exe.patch
queue-5.15/net-dst-add-four-helpers-to-annotate-data-races-around-dst-dev.patch
queue-5.15/rxrpc-serialize-kernel-accept-preallocation-with-socket-teardown.patch
queue-5.15/netfilter-nft_set_pipapo-use-gfp_kernel-for-insertions.patch
queue-5.15/mm-do-file-ownership-checks-with-the-proper-mount-idmap.patch
queue-5.15/vduse-use-fixed-4kb-bounce-pages-for-non-4kb-page-size.patch
queue-5.15/alsa-hda-fix-cached-processing-coefficient-verbs.patch
queue-5.15/alsa-hda-conexant-remove-mic-bias-threshold-override.patch
queue-5.15/netfilter-nft_set_pipapo-don-t-leak-bad-clone-into-future-transaction.patch
queue-5.15/input-mms114-fix-touch-indexing-for-mms134s-and-mms136.patch
queue-5.15/mlxsw-spectrum-on-port-enslavement-to-a-lag-join-upper-s-bridges.patch
queue-5.15/netfilter-nf_conntrack_sip-validate-skb_dst-before-accessing-it.patch
queue-5.15/asoc-mediatek-mt8183-check-runtime-resume-during-probe.patch
queue-5.15/tcp-convert-to-dev_net_rcu.patch
queue-5.15/octeontx2-vf-clear-stale-mailbox-irq-state-before-request_irq.patch
queue-5.15/netfilter-nft_set_pipapo-make-pipapo_clone-helper-return-null.patch
queue-5.15/fscrypt-use-the-mount-idmap-for-the-owner-check-in-f.patch
queue-5.15/netfilter-nf_queue-pin-bridge-device-while-nfqueue-holds-fake-dst.patch
queue-5.15/remoteproc-qcom-fix-sparse-warnings.patch
queue-5.15/serial-max310x-replace-bare-use-of-unsigned-with-unsigned-int-checkpatch.patch
queue-5.15/audit-widen-ino-fields-to-u64.patch
queue-5.15/lsm-use-default-hook-return-value-in-call_int_hook.patch
queue-5.15/asoc-mediatek-mt8192-afe-pcm-simplify-probe-with-local-dev-variable.patch
queue-5.15/bpf-reject-bpf_map_type_inode_storage-creation-if-bpf-lsm-is-uninitialized.patch
queue-5.15/netfilter-nft_set_pipapo-prepare-pipapo_get-helper-for-on-demand-clone.patch
queue-5.15/netfilter-nft_set_pipapo-prepare-walk-function-for-on-demand-clone.patch
queue-5.15/asoc-mediatek-mt8192-afe-pcm-simplify-with-dev_err_probe.patch
queue-5.15/asoc-mediatek-mt8192-afe-pcm-convert-to-devm_pm_runtime_enable.patch
queue-5.15/net-dst-annotate-data-races-around-dst-input.patch
queue-5.15/serial-max310x-implement-gpio_chip-get_direction.patch