[PATCH net] rxrpc: Prevent reusing service connections marked for reaping

[PATCH net] rxrpc: Prevent reusing service connections marked for reaping

[Chengfeng Ye]

The service connection reaper changes conn->active from 0 to -1 before
unpublishing an idle connection. The I/O thread can have already found
that connection and acquired an input reference. If it then allocates a
new call, rxrpc_alloc_incoming_call() unconditionally increments
conn->active, changing -1 back to 0. This violates the reaper's final
assertion and can panic the kernel:

  I/O thread                           Reaper
  Look up conn and take input ref
                                       Set active from 0 to -1
  Allocate an incoming call
    Increment active from -1 to 0
                                       Assert active == -1

The kernel reported:

  kernel BUG at net/rxrpc/conn_object.c:465!
  Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI
  Workqueue: krxrpcd rxrpc_service_connection_reaper
  RIP: 0010:rxrpc_service_connection_reaper+0x768/0xbc0
  Call Trace:
   process_one_work+0x5f2/0xf20
   worker_thread+0x46e/0xda0
   kthread+0x2b2/0x390
   ret_from_fork+0x36e/0x5a0

Use atomic_inc_unless_negative() before taking the call's connection
reference. If reaping won the race, leave the activity count untouched
and return through the existing BUSY rejection path without consuming a
preallocated call. The caller's input reference keeps the connection
live during this check. If call allocation wins, the positive activity
count prevents the reaper from claiming the connection.

Fixes: 3cec055c5695 ("rxrpc: Don't hold a ref for connection workqueue")
Cc: stable@vger.kernel.org
Signed-off-by: Chengfeng Ye <nicoyip.dev@gmail.com>
---
 net/rxrpc/call_accept.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/rxrpc/call_accept.c b/net/rxrpc/call_accept.c
index 47824120f1da..87bc3af2208b 100644
--- a/net/rxrpc/call_accept.c
+++ b/net/rxrpc/call_accept.c
@@ -299,8 +299,9 @@ static struct rxrpc_call *rxrpc_alloc_incoming_call(struct rxrpc_sock *rx,
 		rxrpc_see_connection(conn, rxrpc_conn_see_new_service_conn);
 		rxrpc_new_incoming_connection(rx, conn, sec, skb);
 	} else {
+		if (!atomic_inc_unless_negative(&conn->active))
+			return NULL;
 		rxrpc_get_connection(conn, rxrpc_conn_get_service_conn);
-		atomic_inc(&conn->active);
 	}
 
 	/* And now we can allocate and set up a new call */
-- 
2.43.0