Patch "rxrpc: Fix notification vs call-release vs recvmsg" has been added to the 5.10-stable tree
gregkh at linuxfoundation.org
gregkh at linuxfoundation.org
Thu Aug 20 06:36:27 PDT 2026
This is a note to let you know that I've just added the patch titled
rxrpc: Fix notification vs call-release vs recvmsg
to the 5.10-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
rxrpc-fix-notification-vs-call-release-vs-recvmsg.patch
and it can be found in the queue-5.10 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable at vger.kernel.org> know about it.
>From stable+bounces-288098-greg=kroah.com at vger.kernel.org Thu Jul 23 01:27:17 2026
From: Sasha Levin <sashal at kernel.org>
Date: Wed, 22 Jul 2026 19:21:32 -0400
Subject: rxrpc: Fix notification vs call-release vs recvmsg
To: stable at vger.kernel.org
Cc: David Howells <dhowells at redhat.com>, Jeffrey Altman <jaltman at auristor.com>, Marc Dionne <marc.dionne at auristor.com>, "Junvyyang, Tencent Zhuque Lab" <zhuque at tencent.com>, LePremierHomme <kwqcheii at proton.me>, Simon Horman <horms at kernel.org>, linux-afs at lists.infradead.org, Jakub Kicinski <kuba at kernel.org>, Sasha Levin <sashal at kernel.org>
Message-ID: <20260722232133.2553162-2-sashal at kernel.org>
From: David Howells <dhowells at redhat.com>
[ Upstream commit 2fd895842d49c23137ae48252dd211e5d6d8a3ed ]
When a call is released, rxrpc takes the spinlock and removes it from
->recvmsg_q in an effort to prevent racing recvmsg() invocations from
seeing the same call. Now, rxrpc_recvmsg() only takes the spinlock when
actually removing a call from the queue; it doesn't, however, take it in
the lead up to that when it checks to see if the queue is empty. It *does*
hold the socket lock, which prevents a recvmsg/recvmsg race - but this
doesn't prevent sendmsg from ending the call because sendmsg() drops the
socket lock and relies on the call->user_mutex.
Fix this by firstly removing the bit in rxrpc_release_call() that dequeues
the released call and, instead, rely on recvmsg() to simply discard
released calls (done in a preceding fix).
Secondly, rxrpc_notify_socket() is abandoned if the call is already marked
as released rather than trying to be clever by setting both pointers in
call->recvmsg_link to NULL to trick list_empty(). This isn't perfect and
can still race, resulting in a released call on the queue, but recvmsg()
will now clean that up.
Fixes: 17926a79320a ("[AF_RXRPC]: Provide secure RxRPC sockets for use by userspace and kernel both")
Signed-off-by: David Howells <dhowells at redhat.com>
Reviewed-by: Jeffrey Altman <jaltman at auristor.com>
cc: Marc Dionne <marc.dionne at auristor.com>
cc: Junvyyang, Tencent Zhuque Lab <zhuque at tencent.com>
cc: LePremierHomme <kwqcheii at proton.me>
cc: Simon Horman <horms at kernel.org>
cc: linux-afs at lists.infradead.org
Link: https://patch.msgid.link/20250717074350.3767366-4-dhowells@redhat.com
Signed-off-by: Jakub Kicinski <kuba at kernel.org>
Stable-dep-of: e66f8f32f501 ("rxrpc: Fix socket notification race")
Signed-off-by: Sasha Levin <sashal at kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
---
net/rxrpc/call_object.c | 27 +++++++++++----------------
net/rxrpc/recvmsg.c | 4 ++++
2 files changed, 15 insertions(+), 16 deletions(-)
--- a/net/rxrpc/call_object.c
+++ b/net/rxrpc/call_object.c
@@ -529,7 +529,6 @@ void rxrpc_release_call(struct rxrpc_soc
{
const void *here = __builtin_return_address(0);
struct rxrpc_connection *conn = call->conn;
- bool put = false;
_enter("{%d,%d}", call->debug_id, refcount_read(&call->ref));
@@ -547,23 +546,13 @@ void rxrpc_release_call(struct rxrpc_soc
rxrpc_put_call_slot(call);
rxrpc_delete_call_timer(call);
- /* Make sure we don't get any more notifications */
+ /* Note that at this point, the call may still be on or may have been
+ * added back on to the socket receive queue. recvmsg() must discard
+ * released calls. The CALL_RELEASED flag should prevent further
+ * notifications.
+ */
write_lock_bh(&rx->recvmsg_lock);
-
- if (!list_empty(&call->recvmsg_link)) {
- _debug("unlinking once-pending call %p { e=%lx f=%lx }",
- call, call->events, call->flags);
- list_del(&call->recvmsg_link);
- put = true;
- }
-
- /* list_empty() must return false in rxrpc_notify_socket() */
- call->recvmsg_link.next = NULL;
- call->recvmsg_link.prev = NULL;
-
write_unlock_bh(&rx->recvmsg_lock);
- if (put)
- rxrpc_put_call(call, rxrpc_call_put);
write_lock(&rx->call_lock);
@@ -612,6 +601,12 @@ void rxrpc_release_calls_on_socket(struc
rxrpc_put_call(call, rxrpc_call_put);
}
+ while ((call = list_first_entry_or_null(&rx->recvmsg_q,
+ struct rxrpc_call, recvmsg_link))) {
+ list_del_init(&call->recvmsg_link);
+ rxrpc_put_call(call, rxrpc_call_put);
+ }
+
_leave("");
}
--- a/net/rxrpc/recvmsg.c
+++ b/net/rxrpc/recvmsg.c
@@ -29,6 +29,10 @@ void rxrpc_notify_socket(struct rxrpc_ca
if (!list_empty(&call->recvmsg_link))
return;
+ if (test_bit(RXRPC_CALL_RELEASED, &call->flags)) {
+ rxrpc_see_call(call);
+ return;
+ }
rcu_read_lock();
Patches currently in stable-queue which might be from sashal at kernel.org are
queue-5.10/udmabuf-do-not-create-malformed-scatterlists.patch
queue-5.10/rxrpc-fix-notification-vs-call-release-vs-recvmsg.patch
queue-5.10/dma-buf-udmabuf-skip-redundant-cpu-sync-to-fix-cacheline-eexist-warning.patch
queue-5.10/input-mms114-reject-an-oversized-device-packet-size.patch
queue-5.10/scsi-target-bound-pr-out-transportid-parsing-to-the-received-buffer.patch
queue-5.10/media-mediatek-vcodec-fix-a-resource-leak-related-to.patch
queue-5.10/fpga-dfl-afu-validate-dma-mapping-length-in-afu_dma_map_region.patch
queue-5.10/netfilter-nft_set_pipapo-move-cloning-of-match-info-to-insert-removal-path.patch
queue-5.10/jbd2-fix-integer-underflow-in-jbd2_journal_initialize_fast_commit.patch
queue-5.10/scsi-target-core-generate-correct-identifiers-for-pr-out-transport-ids.patch
queue-5.10/octeontx2-annotate-mmio-regions-as-__iomem.patch
queue-5.10/mlxsw-fix-refcount-leak-in-mlxsw_sp_port_lag_join.patch
queue-5.10/net-9p-fix-infinite-loop-in-p9_client_rpc-on-fatal-signal.patch
queue-5.10/ipvs-separate-destination-availability-state.patch
queue-5.10/taskstats-retain-dead-thread-stats-in-tgid-queries.patch
queue-5.10/octeontx2-pf-clear-stale-mailbox-irq-state-before-request_irq.patch
queue-5.10/scsi-target-core-pr-initialize-arrays-at-declaration-time.patch
queue-5.10/netfilter-nf_conntrack_sip-remove-net-variable-shadowing.patch
queue-5.10/smb-client-use-kvzalloc-for-megabyte-buffer-in-simple-fallocate.patch
queue-5.10/mtd-spi-nor-intel-remove-global-protection-flag.patch
queue-5.10/tipc-restrict-socket-queue-dumps-in-enqueue-tracepoints.patch
queue-5.10/rxrpc-fix-recv-recv-race-of-completed-call.patch
queue-5.10/mtd-maps-vmu-flash-fix-fault-in-unaligned-fixup.patch
queue-5.10/mtd-spi-nor-swp-improve-locking-user-experience.patch
queue-5.10/selinux-avoid-sk_socket-dereference-in-selinux_sctp_bind_connect.patch
queue-5.10/lsm-infrastructure-management-of-the-sock-security.patch
queue-5.10/audit-use-unsigned-int-instead-of-unsigned.patch
queue-5.10/media-mtk-vcodec-potential-null-pointer-deference-in.patch
queue-5.10/i2c-davinci-unregister-cpufreq-notifier-on-probe-failure.patch
queue-5.10/rxrpc-fix-socket-notification-race.patch
queue-5.10/i2c-imx-separate-atomic-dma-and-non-dma-use-case.patch
queue-5.10/netfilter-nft_set_pipapo-merge-deactivate-helper-into-caller.patch
queue-5.10/dm-integrity-don-t-increment-hash_offset-twice.patch
queue-5.10/vfs-audit-introduce-kern_path_parent-for-audit.patch
queue-5.10/audit-fix-recursive-locking-deadlock-in-audit_dupe_exe.patch
queue-5.10/thunderbolt-remove-xdomain-from-the-bus-without-holding-tb-lock.patch
queue-5.10/rxrpc-serialize-kernel-accept-preallocation-with-socket-teardown.patch
queue-5.10/rdma-rtrs-srv-bound-rdma-write-length-to-chunk-size-in-rdma_write_sg.patch
queue-5.10/9p-skip-nlink-update-in-cacheless-mode-to-fix-warn_on.patch
queue-5.10/dmaengine-dw-edma-add-spinlock-to-protect-done_int_mask-and-abort_int_mask.patch
queue-5.10/netfilter-nft_set_pipapo-use-gfp_kernel-for-insertions.patch
queue-5.10/mtd-spi-nor-fix-spi_nor_try_unlock_all.patch
queue-5.10/alsa-hda-fix-cached-processing-coefficient-verbs.patch
queue-5.10/dm-verity-make-error-counter-atomic.patch
queue-5.10/device-property-add-fwnode_irq_get_byname.patch
queue-5.10/jbd2-add-a-helper-to-find-out-number-of-fast-commit-blocks.patch
queue-5.10/i2c-imx-fix-locked-bus-on-smbus-block-read-of-0-atomic.patch
queue-5.10/wifi-libertas_tf-fix-use-after-free-in-lbtf_free_adapter.patch
queue-5.10/mlxsw-spectrum-apply-rif-configuration-when-joining-a-lag.patch
queue-5.10/netfilter-nft_set_pipapo-don-t-leak-bad-clone-into-future-transaction.patch
queue-5.10/mlxsw-spectrum-on-port-enslavement-to-a-lag-join-upper-s-bridges.patch
queue-5.10/scsi-lpfc-fix-memory-leak-in-lpfc_sli4_driver_resource_setup.patch
queue-5.10/netfilter-nf_conntrack_sip-validate-skb_dst-before-accessing-it.patch
queue-5.10/thunderbolt-keep-xdomain-reference-during-the-lifetime-of-a-service.patch
queue-5.10/asoc-mediatek-mt8183-check-runtime-resume-during-probe.patch
queue-5.10/octeontx2-vf-clear-stale-mailbox-irq-state-before-request_irq.patch
queue-5.10/input-ims-pcu-fix-race-condition-in-reset_device-sysfs-callback.patch
queue-5.10/net-thunderbolt-fix-frags-overflow-by-bounding-frame_count.patch
queue-5.10/netfilter-nft_set_pipapo-make-pipapo_clone-helper-return-null.patch
queue-5.10/mtd-spi-nor-sst-remove-global-protection-flag.patch
queue-5.10/tpm-tpm_tis_spi-use-wait_woken-in-wait_for_tmp_stat.patch
queue-5.10/pci-add-pci_find_vsec_capability-to-find-a-specific-vsec.patch
queue-5.10/serial-max310x-replace-bare-use-of-unsigned-with-unsigned-int-checkpatch.patch
queue-5.10/audit-widen-ino-fields-to-u64.patch
queue-5.10/lsm-use-default-hook-return-value-in-call_int_hook.patch
queue-5.10/bpf-reject-bpf_map_type_inode_storage-creation-if-bpf-lsm-is-uninitialized.patch
queue-5.10/ovl-use-linked-upper-dentry-in-copy-up-tmpfile.patch
queue-5.10/netfilter-nft_set_pipapo-prepare-pipapo_get-helper-for-on-demand-clone.patch
queue-5.10/netfilter-nft_set_pipapo-prepare-walk-function-for-on-demand-clone.patch
queue-5.10/taskstats-fill_stats_for_tgid-use-for_each_thread.patch
queue-5.10/thunderbolt-prevent-xdomain-delayed-work-use-after-free-on-disconnect.patch
queue-5.10/dmaengine-dw-edma-improve-the-linked-list-and-data-blocks-definition.patch
queue-5.10/dmaengine-dw-edma-remove-unused-irq-field-in-struct-dw_edma_chip.patch
queue-5.10/mtd-spi-nor-move-software-write-protection-logic-out-of-the-core.patch
queue-5.10/serial-max310x-implement-gpio_chip-get_direction.patch
queue-5.10/i2c-smbus-use-device_-functions-instead-of-of_.patch
More information about the linux-afs
mailing list