[PATCH net] rxrpc: fix use-after-free in rxrpc_poke_conn()

[Simon Horman]

On Tue, Sep 01, 2026 at 02:10:45PM +0900, Seungwon Bae wrote:
> rxrpc_poke_conn() takes a reference on the connection with no liveness
> check, unlike its sibling rxrpc_queue_conn() which gates on
> atomic_read(&conn->active) >= 0.  The per-connection timer is armed with
> no reference held for it, and rxrpc_put_connection() cancels it with a
> non-synchronous timer_delete() only after the refcount reaches 0.
> refcount_t saturates rather than resurrecting, so the connection can be
> kfree()d while still linked in local->conn_attend_q (nothing in teardown
> unlinks attend_link).  The rxrpc I/O thread then performs a UAF write
> (list_del_init) plus UAF reads and indirect calls through conn->security.
> 
> Reproduced on a KASAN + PREEMPT kernel: 56 "refcount_t: addition on 0"
> saturations at load, escalating to
> 
>   BUG: KASAN: slab-use-after-free in rxrpc_io_thread   Write of size 8
> 
> AF_RXRPC socket creation (rxrpc_create) has no capability check, so this
> is reachable by an unprivileged user.
> 
> Guard rxrpc_poke_conn() with the same liveness/refcount check the sibling
> rxrpc_queue_conn() uses before taking the poke reference, so a connection
> past its last-active point is not poked/requeued after teardown began.
> 
> Verified before/after on KASAN+PREEMPT at equal timer volume: 56
> saturations + 15 KASAN reports unpatched vs 0 and 0 patched.
> 

I think a Fixes tag is needed here, citing the patch where
this problem first manifested.

Perhaps this one?

Fixes: f2cce89a074e ("rxrpc: Implement a mechanism to send an event notification to a connection")

If so, there shouldn't be any further action required to that end.
But if you do re-post for some other reason note that
there should not be a blank line between the Fixes and
Signed-off-by tags (or between any other tags).

> Signed-off-by: Seungwon Bae <qotmddnjs at ajou.ac.kr>

...