Patch "afs: Fix uncancelled rxrpc OOB message handler" has been added to the 6.18-stable tree

[gregkh at linuxfoundation.org]

This is a note to let you know that I've just added the patch titled

    afs: Fix uncancelled rxrpc OOB message handler

to the 6.18-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     afs-fix-uncancelled-rxrpc-oob-message-handler.patch
and it can be found in the queue-6.18 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable at vger.kernel.org> know about it.


>From a4057e58b07005d0fe0491bdbf1868c1491909ee Mon Sep 17 00:00:00 2001
From: David Howells <dhowells at redhat.com>
Date: Wed, 24 Jun 2026 17:38:12 +0100
Subject: afs: Fix uncancelled rxrpc OOB message handler

From: David Howells <dhowells at redhat.com>

commit a4057e58b07005d0fe0491bdbf1868c1491909ee upstream.

Fix AFS to cancel its OOB message processing (typically to respond to
security challenges).  Also move OOB message processing to afs_wq so that
it's also waited for and make the OOB handler just return if the net
namespace is no longer live.

Fixes: 5800b1cf3fd8 ("rxrpc: Allow CHALLENGEs to the passed to the app for a RESPONSE")
Link: https://sashiko.dev/#/patchset/20260609140911.838677-1-dhowells%40redhat.com
Signed-off-by: David Howells <dhowells at redhat.com>
cc: Li Daming <d4n.for.sec at gmail.com>
cc: Ren Wei <n05ec at lzu.edu.cn>
cc: Marc Dionne <marc.dionne at auristor.com>
cc: Jeffrey Altman <jaltman at auristor.com>
cc: Simon Horman <horms at kernel.org>
cc: linux-afs at lists.infradead.org
cc: stable at kernel.org
Link: https://patch.msgid.link/20260624163819.3017002-6-dhowells@redhat.com
Signed-off-by: Jakub Kicinski <kuba at kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
---
 fs/afs/cm_security.c |    3 ++-
 fs/afs/rxrpc.c       |    5 ++++-
 2 files changed, 6 insertions(+), 2 deletions(-)

--- a/fs/afs/cm_security.c
+++ b/fs/afs/cm_security.c
@@ -101,7 +101,8 @@ void afs_process_oob_queue(struct work_s
 	struct sk_buff *oob;
 	enum rxrpc_oob_type type;
 
-	while ((oob = rxrpc_kernel_dequeue_oob(net->socket, &type))) {
+	while (READ_ONCE(net->live) &&
+	       (oob = rxrpc_kernel_dequeue_oob(net->socket, &type))) {
 		switch (type) {
 		case RXRPC_OOB_CHALLENGE:
 			afs_respond_to_challenge(oob);
--- a/fs/afs/rxrpc.c
+++ b/fs/afs/rxrpc.c
@@ -128,6 +128,7 @@ void afs_close_socket(struct afs_net *ne
 	_enter("");
 
 	cancel_work_sync(&net->charge_preallocation_work);
+	cancel_work_sync(&net->rx_oob_work);
 	/* Future work items should now see ->live is false. */
 
 	kernel_listen(net->socket, 0);
@@ -148,6 +149,7 @@ void afs_close_socket(struct afs_net *ne
 
 	kernel_sock_shutdown(net->socket, SHUT_RDWR);
 	flush_workqueue(afs_async_calls);
+	cancel_work_sync(&net->rx_oob_work);
 	net->socket->sk->sk_user_data = NULL;
 	sock_release(net->socket);
 	key_put(net->fs_cm_token_key);
@@ -989,5 +991,6 @@ static void afs_rx_notify_oob(struct soc
 {
 	struct afs_net *net = sk->sk_user_data;
 
-	schedule_work(&net->rx_oob_work);
+	if (READ_ONCE(net->live))
+		queue_work(afs_wq, &net->rx_oob_work);
 }


Patches currently in stable-queue which might be from dhowells at redhat.com are

queue-6.18/rxrpc-don-t-move-a-peeked-oob-message-onto-the-pending-queue.patch
queue-6.18/rxrpc-fix-potential-infinite-loop-in-rxrpc_recvmsg.patch
queue-6.18/rxrpc-rxrpc_verify_data-ensure-rx_dec_buffer-alloc.patch
queue-6.18/afs-fix-further-netns-teardown-to-cancel-the-preallocation-charger.patch
queue-6.18/afs-fix-netns-teardown-to-cancel-the-preallocation-charger.patch
queue-6.18/rxrpc-fix-ackall-packet-handling.patch
queue-6.18/rxrpc-fix-leak-of-connection-from-oob-challenge.patch
queue-6.18/rxrpc-fix-oob-challenge-leak-in-cleanup-after-notification-failure.patch
queue-6.18/afs-handle-cb.initcallbackstate3-requests-without-a-server-record.patch
queue-6.18/rxrpc-fix-socket-notification-race.patch
queue-6.18/rxrpc-fix-rxrpc_rotate_tx_rotate-to-check-there-s-something-to-rotate.patch
queue-6.18/rxrpc-fix-leak-of-released-call-in-recvmsg-msg_peek.patch
queue-6.18/rxrpc-serialize-kernel-accept-preallocation-with-socket-teardown.patch
queue-6.18/afs-fix-null-pointer-dereference-in-afs_get_tree.patch
queue-6.18/rxrpc-fix-the-reception-of-a-reply-packet-before-data-transmission.patch
queue-6.18/rxrpc-fix-double-unlock-in-rxrpc_recvmsg.patch
queue-6.18/afs-fix-uncancelled-rxrpc-oob-message-handler.patch
queue-6.18/rxrpc-fix-uaf-in-rxgk_issue_challenge.patch