Patch "rxrpc: Fix return in rxrpc_recvmsg_data() for service calls" has been added to the 7.3-stable tree
gregkh at linuxfoundation.org
gregkh at linuxfoundation.org
Wed Nov 4 11:16:07 PST 2026
This is a note to let you know that I've just added the patch titled
rxrpc: Fix return in rxrpc_recvmsg_data() for service calls
to the 7.3-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
rxrpc-fix-return-in-rxrpc_recvmsg_data-for-service-calls.patch
and it can be found in the queue-7.3 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable at vger.kernel.org> know about it.
>From 18a71e111c7505e16c2de91480561fc491f41341 Mon Sep 17 00:00:00 2001
From: David Howells <dhowells at redhat.com>
Date: Tue, 6 Oct 2026 14:30:01 +0100
Subject: rxrpc: Fix return in rxrpc_recvmsg_data() for service calls
From: David Howells <dhowells at redhat.com>
commit 18a71e111c7505e16c2de91480561fc491f41341 upstream.
When rxrpc_recvmsg_data() gets called on a service call that has received
all of the request, RXRPC_CALL_RECVMSG_READ_ALL has been set, and this
causes rxrpc_recvmsg_data() to jump straight out, indicating the end of the
call (ie. rxrpc_kernel_recv_data() returns 1) without waiting for the call
to be processed or the reply to be transmitted.
rxperf_deliver_to_call() also has to be altered to call
rxrpc_kernel_recv_data() to collect the final ACK on a service call as does
afs_deliver_to_call().
Fixes: d001648ec7cf ("rxrpc: Don't expose skbs to in-kernel users [ver #2]")
Link: https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260914151340.3227501-1-dhowells%40redhat.com
Signed-off-by: David Howells <dhowells at redhat.com>
cc: Marc Dionne <marc.dionne at auristor.com>
cc: Jeffrey Altman <jaltman at auristor.com>
cc: Eric Dumazet <edumazet at google.com>
cc: "David S. Miller" <davem at davemloft.net>
cc: Jakub Kicinski <kuba at kernel.org>
cc: Paolo Abeni <pabeni at redhat.com>
cc: Simon Horman <horms at kernel.org>
cc: linux-afs at lists.infradead.org
cc: stable at vger.kernel.org
Link: https://patch.msgid.link/20261006133011.531806-10-dhowells@redhat.com
Signed-off-by: Paolo Abeni <pabeni at redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
---
Documentation/networking/rxrpc.rst | 13 +++++++++----
fs/afs/rxrpc.c | 4 ++--
net/rxrpc/recvmsg.c | 13 ++++++++++---
net/rxrpc/rxperf.c | 16 ++++++++++++++--
4 files changed, 35 insertions(+), 11 deletions(-)
--- a/Documentation/networking/rxrpc.rst
+++ b/Documentation/networking/rxrpc.rst
@@ -909,10 +909,15 @@ The kernel interface functions are as fo
want_more should be true if further data will be required after this is
satisfied and false if this is the last item of the receive phase.
- There are three normal returns: 0 if the buffer was filled and want_more
- was true; 1 if the buffer was filled, the last DATA packet has been
- emptied and want_more was false; and -EAGAIN if the function needs to be
- called again.
+ For client calls, there are three normal returns: 0 if the buffer was
+ filled and want_more was true; 1 if the buffer was filled, the last DATA
+ packet has been emptied and want_more was false; and -EAGAIN if the
+ function needs to be called again.
+
+ For service calls, there are four normal returns: 0 and -EAGAIN are the
+ same as for client calls; 2 indicates that the last DATA packet of the
+ request has been received, want_more was false and the call is still in
+ progress; and 1 indicates that the call is now successfully complete.
If the last DATA packet is processed but the buffer contains less than
the amount requested, EBADMSG is returned. If want_more wasn't set, but
--- a/fs/afs/rxrpc.c
+++ b/fs/afs/rxrpc.c
@@ -541,7 +541,7 @@ void afs_deliver_to_call(struct afs_call
&call->service_id);
trace_afs_receive_data(call, &call->def_iter, false, ret);
- if (ret == -EINPROGRESS || ret == -EAGAIN)
+ if (ret == -EAGAIN || ret == 2)
return;
if (ret < 0 || ret == 1) {
if (ret == 1)
@@ -934,7 +934,7 @@ int afs_extract_data(struct afs_call *ca
return ret;
state = READ_ONCE(call->state);
- if (ret == 1) {
+ if (ret == 1 || ret == 2) {
switch (state) {
case AFS_CALL_CL_AWAIT_REPLY:
afs_set_call_state(call, state, AFS_CALL_CL_PROC_REPLY);
--- a/net/rxrpc/recvmsg.c
+++ b/net/rxrpc/recvmsg.c
@@ -638,9 +638,11 @@ wait_error:
* Note that we may return %-EAGAIN to drain empty packets at the end
* of the data, even if we've already copied over the requested data.
*
- * Return: %0 if got what was asked for and there's more available, %1
- * if we got what was asked for and we're at the end of the data and
- * %-EAGAIN if we need more data.
+ * Return: %0 if got what was asked for and there's more available, %1 if we
+ * got what was asked for and we're at the end of the call, %2 if a service
+ * call received all of the request but is still in progress and %-EAGAIN if we
+ * need more data. A variety of other errors can be returned if the call
+ * completed with failure.
*/
int rxrpc_kernel_recv_data(struct socket *sock, struct rxrpc_call *call,
struct iov_iter *iter, size_t *_len,
@@ -679,6 +681,11 @@ int rxrpc_kernel_recv_data(struct socket
read_phase_complete:
ret = 1;
+ if (rxrpc_is_service_call(call)) {
+ if (rxrpc_call_is_complete(call))
+ goto call_failed;
+ ret = 2;
+ }
out:
if (_service)
*_service = call->dest_srx.srx_service;
--- a/net/rxrpc/rxperf.c
+++ b/net/rxrpc/rxperf.c
@@ -293,8 +293,20 @@ static void rxperf_deliver_to_call(struc
state == RXPERF_CALL_SV_AWAIT_ACK
) {
if (state == RXPERF_CALL_SV_AWAIT_ACK) {
- if (!rxrpc_kernel_check_life(rxperf_socket, call->rxcall))
+ size_t len = 0;
+ iov_iter_kvec(&call->iter, ITER_DEST, NULL, 0, 0);
+ ret = rxrpc_kernel_recv_data(rxperf_socket,
+ call->rxcall, &call->iter,
+ &len, false, &remote_abort,
+ &call->service_id);
+
+ if (ret == -EAGAIN || ret == 2)
+ return;
+ if (ret < 0 || ret == 1) {
+ if (ret == 1)
+ ret = 0;
goto call_complete;
+ }
return;
}
@@ -369,7 +381,7 @@ static int rxperf_extract_data(struct rx
if (ret == 0 || ret == -EAGAIN)
return ret;
- if (ret == 1) {
+ if (ret == 1 || ret == 2) {
switch (call->state) {
case RXPERF_CALL_SV_AWAIT_REQUEST:
rxperf_set_call_state(call, RXPERF_CALL_SV_REPLYING);
Patches currently in stable-queue which might be from dhowells at redhat.com are
queue-7.3/smb-client-reject-short-or-out-of-range-find-response-parameters.patch
queue-7.3/smb-client-require-stable-pages-for-smb-compression.patch
queue-7.3/rxrpc-fix-double-irq-enablement.patch
queue-7.3/rxrpc-fix-return-in-rxrpc_recvmsg_data-for-service-calls.patch
queue-7.3/smb-client-fix-use-after-free-infoleak-via-the-readdir-resume-name.patch
queue-7.3/smb-client-reclaim-credits-for-decrypted-reads-with-no-matching-mid.patch
queue-7.3/smb-client-reject-find-data-areas-that-run-past-the-received-response.patch
queue-7.3/smb-client-fix-oob-last_entry-pointer-from-unbounded-lastnameoffset.patch
queue-7.3/smb-client-do-not-pass-a-null-buf-to-is_oplock_break.patch
queue-7.3/smb-client-don-t-resurrect-an-exiting-tcon-from-cached-dir-workers.patch
queue-7.3/afs-fix-afs-to-abort-the-rxrpc-call-on-send-error.patch
queue-7.3/smb-client-fix-oob-read-in-the-smb_find_file_unix-name-scan.patch
queue-7.3/rxrpc-fix-update-of-call-tx_pending-without-holding-lock.patch
queue-7.3/rxrpc-fix-lack-of-short-send-handling-in-rxrpc_kernel_send_data.patch
queue-7.3/smb-client-fix-use-after-free-in-cifs_ses_add_channel.patch
queue-7.3/smb-client-fix-oob-read-of-the-resume-name-sent-in-trans2_find_next2.patch
More information about the linux-afs
mailing list