[PATCH] rxrpc: Serialize client connection IDR updates

[Andrew Lunn]

On Thu, Oct 29, 2026 at 09:21:29PM -0700, Kyle Zeng wrote:
> The common connection destructor calls rxrpc_kill_client_conn() for
> service connections as well as client connections.  A service connection
> gets its CID from the peer and never owns an entry in local->conn_ids.
> Its destruction can therefore remove an unrelated client connection.
> 
> The final reference can be dropped by the service reaper or a call
> destruction worker, outside the owning local endpoint's I/O thread.
> Client connection destruction can also run off-thread, and can remove an
> ID already released by rxrpc_unbundle_conn().  These writers can race
> idr_alloc_cyclic(), corrupting the radix tree and its RCU callbacks.  A
> second removal can also delete a new owner after an ID has been reused.
> 
> Only run client cleanup for client connections.  Restore a per-local IDR
> writer lock and the client-ID ownership flag, clearing the flag under the
> lock when releasing the ID.  Serialize IDR destruction with the same
> lock.  This covers deferred final puts without changing connection
> expiry or the RCU lookup path.
> 
> Fixes: 9d35d880e0e4 ("rxrpc: Move client call connection to the I/O thread")
> Signed-off-by: Kyle Zeng <kylebot at openai.com>
> ---
> I have a reproducer for this issue and can share via DM

Please take a read of

https://www.kernel.org/doc/html/latest/process/maintainer-netdev.html

You need to set the subject line correctly to indicate the three they
are applied to.

All the patches you have posted are very likely to be sent to
/dev/null because of this. It is a good idea to start slow, only one
patch at a time, and figure out the processes.

      Andrew