[PATCH v3] rxrpc: Fix use-after-free in rxrpc_destroy_all_peers()

[Marco Elver]

During network namespace teardown, rxrpc_destroy_all_peers() iterates over
the rxnet->peer_hash table to print leaked peers without holding
rxnet->peer_hash_lock. If concurrent activity drops the last reference to
a peer, __rxrpc_put_peer() unlinks the peer from rxnet->peer_hash under
rxnet->peer_hash_lock and frees it via kfree_rcu(). Without locking,
traversal can race with hash unlinking and RCU reclamation, triggering a
KASAN slab-use-after-free.

BUG: KASAN: slab-use-after-free in rxrpc_destroy_all_peers+0xcc/0x150
net/rxrpc/peer_object.c:461
Read of size 8 at addr ffff88811089e420 by task kworker/u8:1/13
Call Trace:
 <TASK>
 rxrpc_destroy_all_peers+0xcc/0x150 net/rxrpc/peer_object.c:461
 rxrpc_exit_net+0x7f/0xc0 net/rxrpc/net_ns.c:114
 ops_exit_list net/core/net_namespace.c:199 [inline]
 ops_undo_list+0x43d/0x8d0 net/core/net_namespace.c:252
 cleanup_net+0x572/0x810 net/core/net_namespace.c:702
 process_one_work kernel/workqueue.c:3322 [inline]
 process_scheduled_works+0xa8e/0x14e0 kernel/workqueue.c:3405
 worker_thread+0x92d/0xe10 kernel/workqueue.c:3486
 kthread+0x388/0x470 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>

Fix the slab-use-after-free by acquiring rxnet->peer_hash_lock with
spin_lock_bh() while iterating over rxnet->peer_hash in
rxrpc_destroy_all_peers().

Fixes: 17226f124038 ("rxrpc: Fix leak of rxrpc_peer objects")
Reported-by: syzbot+c876adfab6362679008c at syzkaller.appspotmail.com
Assisted-by: Gemini:gemini-3.6-flash Gemini:gemini-3.1-pro-preview syzbot
Closes: https://syzkaller.appspot.com/bug?extid=c876adfab6362679008c
Link: https://syzkaller.appspot.com/ai_job?id=7fecbeb2-cd9b-4ca2-8149-48663e20b153
Signed-off-by: Marco Elver <elver at google.com>
---
v3:
* syzbot reported "INFO: task hung in rxrpc_destroy_all_calls" on v2:
  Drop .pre_exit split.  rxrpc_destroy_all_calls() blocks in
  wait_var_event() on RCU call freeing; executing this in .pre_exit
  under pernet_ops_rwsem deadlocks netns cleanup before
  synchronize_rcu() and device teardown can run.

v2:
* Split teardown and use .pre_exit instead of rcu_barrier() (Eric).
---
 net/rxrpc/peer_object.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/net/rxrpc/peer_object.c b/net/rxrpc/peer_object.c
index fa9a406e1168..faa2983638b2 100644
--- a/net/rxrpc/peer_object.c
+++ b/net/rxrpc/peer_object.c
@@ -454,6 +454,12 @@ void rxrpc_destroy_all_peers(struct rxrpc_net *rxnet)
 	struct rxrpc_peer *peer;
 	int i;
 
+	/*
+	 * Prevent use-after-free if a peer is concurrently unlinked from the
+	 * hash table and freed via RCU during iteration.
+	 */
+	spin_lock_bh(&rxnet->peer_hash_lock);
+
 	for (i = 0; i < HASH_SIZE(rxnet->peer_hash); i++) {
 		if (hlist_empty(&rxnet->peer_hash[i]))
 			continue;
@@ -465,6 +471,8 @@ void rxrpc_destroy_all_peers(struct rxrpc_net *rxnet)
 			       &peer->srx.transport);
 		}
 	}
+
+	spin_unlock_bh(&rxnet->peer_hash_lock);
 }
 
 /**
-- 
2.55.0.1003.g10538fe699-goog