From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E2E823A5E78 for ; Mon, 13 Jul 2026 08:11:01 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.133.124 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783930263; cv=none; b=Gv0jTdT7gTkRHsxCFmJXr/doR7Ng83RyfBX0NsV750Ejs1fIlAFdIYELJzl5ujCTRvK2zOBrmxWTneaVDtykRwGXabivyJdoglSR1hbXXDwscE/rBf3lran9ZfQfdm95nKRX+RqZRgiikAGsnI5mH1wwP1igyoG4vlzLOKxWvhU= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783930263; c=relaxed/simple; bh=RqEZ8V3VTBLUYMWessvmE35+orqVW6T6gXuF1INaQHs=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=nV35ojogoDo4V5/d/4mvJzowWZGxeOIRISGUj4mjVRbxcm3iGkbP/lyCalskfUKnSdURgAv1IeTk2CTFJKPKb7/pIbD+sItnkrt5T1x1oYjRvHBBCBcCb2gpsFbtJfpfDq1J0yxGCcmDISC/33b/iEg429kP1YkuRqMlchCFdE8= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=gQtcIdCI; arc=none smtp.client-ip=170.10.133.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="gQtcIdCI" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1783930260; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=5tnXvZhH3Uv8RMIWKCx6J8r5QB8JHDWA9/+oQzZb+wc=; b=gQtcIdCItNur2BabSkokYMhhp94oAcQa6P1x49xD2/pq7N3MAxS1XbokQSrzFjFsNa7fJv ETV615l+y/JeFb4NM/bksnKpbhb7BH6AqEgN1hRrwFWgTR0lxeJoURJqK8VN54hkYPkBF3 6CYbr8J2S8GOviOnJoYpHWuLh1iIq8g= Received: from mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-664-a0llZpPCNQmF2I-erdN-sg-1; Mon, 13 Jul 2026 04:10:56 -0400 X-MC-Unique: a0llZpPCNQmF2I-erdN-sg-1 X-Mimecast-MFC-AGG-ID: a0llZpPCNQmF2I-erdN-sg_1783930255 Received: from mx-prod-int-10.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-10.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.95]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id DEA4C1956066; Mon, 13 Jul 2026 08:10:54 +0000 (UTC) Received: from warthog.procyon.org.com (unknown [10.44.33.159]) by mx-prod-int-10.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 6FF9D36919; Mon, 13 Jul 2026 08:10:51 +0000 (UTC) From: David Howells To: netdev@vger.kernel.org Cc: David Howells , Marc Dionne , Jakub Kicinski , "David S. Miller" , Eric Dumazet , Paolo Abeni , Simon Horman , linux-afs@lists.infradead.org, linux-kernel@vger.kernel.org, stable@kernel.org Subject: [PATCH net v3 05/14] rxrpc: Fix update of call->tx_pending without holding lock Date: Mon, 13 Jul 2026 09:10:11 +0100 Message-ID: <20260713081022.2186481-6-dhowells@redhat.com> In-Reply-To: <20260713081022.2186481-1-dhowells@redhat.com> References: <20260713081022.2186481-1-dhowells@redhat.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Scanned-By: MIMEDefang 3.6 on 10.30.177.95 Currently, rxrpc_send_data() updates call->tx_pending just before it returns - but it won't be holding the call->lock when it does this if a wait was interrupted by a signal. This would allow a parallel sendmsg() to race. Further, both the callers of rxrpc_send_data() call it with the lock held, and then it returns an indication through the parameter list to say whether it has dropped the lock or not - after which the callers both just drop the lock if it's still held. Fix this by: (1) Moving the release of call->lock down into rxrpc_send_data() and get rid of the indicator parameter. This makes it easier to see where the lock is held. (2) Make the wait_for_space path move the value in txb back into call->tx_pending before dropping the lock prior to the wait. (3) After waiting, if the attempt to reacquire the mutex is interrupted, just return directly there rather than going to out_unlock Fixes: b0f571ecd794 ("rxrpc: Fix locking in rxrpc's sendmsg") Closes: https://sashiko.dev/#/patchset/20260702144919.172295-1-dhowells%40redhat.com Signed-off-by: David Howells cc: Marc Dionne cc: Eric Dumazet cc: "David S. Miller" cc: Jakub Kicinski cc: Paolo Abeni cc: Simon Horman cc: linux-afs@lists.infradead.org cc: stable@kernel.org --- net/rxrpc/sendmsg.c | 52 +++++++++++++++++++++++++-------------------- 1 file changed, 29 insertions(+), 23 deletions(-) diff --git a/net/rxrpc/sendmsg.c b/net/rxrpc/sendmsg.c index d5060fd9631a..71343998b87d 100644 --- a/net/rxrpc/sendmsg.c +++ b/net/rxrpc/sendmsg.c @@ -320,8 +320,8 @@ static int rxrpc_alloc_txqueue(struct sock *sk, struct rxrpc_call *call) static int rxrpc_send_data(struct rxrpc_sock *rx, struct rxrpc_call *call, struct msghdr *msg, size_t len, - rxrpc_notify_end_tx_t notify_end_tx, - bool *_dropped_lock) + rxrpc_notify_end_tx_t notify_end_tx) + __releases(&call->user_mutex) { struct rxrpc_txbuf *txb; struct sock *sk = &rx->sk; @@ -334,25 +334,27 @@ static int rxrpc_send_data(struct rxrpc_sock *rx, trace_rxrpc_abort(call->debug_id, rxrpc_sendmsg_late_send, call->cid, call->call_id, call->rx_consumed, 0, -EPROTO); - return -EPROTO; + ret = -EPROTO; + goto out_unlock; } if (unlikely(test_bit(RXRPC_CALL_TX_ERROR, &call->flags))) { trace_rxrpc_abort(call->debug_id, rxrpc_sendmsg_tx_error, call->cid, call->call_id, call->rx_consumed, 0, -EIO); - return -EIO; + ret = -EIO; + goto out_unlock; } timeo = sock_sndtimeo(sk, msg->msg_flags & MSG_DONTWAIT); ret = rxrpc_wait_to_be_connected(call, &timeo); if (ret < 0) - return ret; + goto out_unlock; if (call->conn->state == RXRPC_CONN_CLIENT_UNSECURED) { ret = rxrpc_init_client_conn_security(call->conn); if (ret < 0) - return ret; + goto out_unlock; } /* this should be in poll */ @@ -456,7 +458,7 @@ static int rxrpc_send_data(struct rxrpc_sock *rx, if (ret == -ENOMEM) goto maybe_error; set_bit(RXRPC_CALL_TX_ERROR, &call->flags); - goto out; + goto out_txb; } if (msg_data_left(msg) == 0 && !more) @@ -468,51 +470,58 @@ static int rxrpc_send_data(struct rxrpc_sock *rx, success: ret = copied; -out: +out_txb: call->tx_pending = txb; +out_unlock: + mutex_unlock(&call->user_mutex); _leave(" = %d", ret); return ret; call_terminated: rxrpc_put_txbuf(txb, rxrpc_txbuf_put_send_aborted); - _leave(" = %d", call->error); - return call->error; + call->tx_pending = NULL; + ret = call->error; + goto out_unlock; maybe_error: if (copied) { if (rxrpc_call_is_complete(call) && call->error < 0) { ret = call->error; - goto out; + goto out_unlock; } goto success; } - goto out; + goto out_txb; efault: ret = -EFAULT; - goto out; + goto out_txb; wait_for_space: ret = -EAGAIN; if (msg->msg_flags & MSG_DONTWAIT) goto maybe_error; + call->tx_pending = txb; + txb = NULL; mutex_unlock(&call->user_mutex); - *_dropped_lock = true; + ret = rxrpc_wait_for_tx_window(rx, call, &timeo, msg->msg_flags & MSG_WAITALL); if (ret < 0) - goto maybe_error; + goto out_nolock; if (call->interruptibility == RXRPC_INTERRUPTIBLE) { if (mutex_lock_interruptible(&call->user_mutex) < 0) { ret = sock_intr_errno(timeo); - goto maybe_error; + goto out_nolock; } } else { mutex_lock(&call->user_mutex); } - *_dropped_lock = false; goto reload; +out_nolock: + _leave(" = %d [intr]", ret); + return copied ?: ret; } /* @@ -787,8 +796,8 @@ int rxrpc_do_sendmsg(struct rxrpc_sock *rx, struct msghdr *msg, size_t len) ret = 0; break; case RXRPC_CMD_SEND_DATA: - ret = rxrpc_send_data(rx, call, msg, len, NULL, &dropped_lock); - break; + ret = rxrpc_send_data(rx, call, msg, len, NULL); + goto error_put; default: ret = -EINVAL; break; @@ -826,7 +835,6 @@ int rxrpc_kernel_send_data(struct socket *sock, struct rxrpc_call *call, struct msghdr *msg, size_t len, rxrpc_notify_end_tx_t notify_end_tx) { - bool dropped_lock = false; int ret; _enter("{%d},", call->debug_id); @@ -837,12 +845,10 @@ int rxrpc_kernel_send_data(struct socket *sock, struct rxrpc_call *call, mutex_lock(&call->user_mutex); ret = rxrpc_send_data(rxrpc_sk(sock->sk), call, msg, len, - notify_end_tx, &dropped_lock); + notify_end_tx); if (ret == -ESHUTDOWN) ret = call->error; - if (!dropped_lock) - mutex_unlock(&call->user_mutex); _leave(" = %d", ret); return ret; }