From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0E7DC350849 for ; Wed, 17 Sep 2025 14:58:05 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1758121086; cv=none; b=cENYwkoZkIf3NWm4DMs3QS70jgTp0ZMmcLeWOO6F+Ngn9wDLJ6nlnkI5odwFARFtglEtb/uyrIqT7XlaSa164ExfYEK0JMXAAiUFbte0MyjQeEYez9Gh31HMmeOGP7U9S1zA58nR0yI1wxlElnlzpQpOlzu32cPYPvEK1CzQjdE= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1758121086; c=relaxed/simple; bh=qFv8cMFgeLcRNba4NCjfh8k13KPtMmi2FPqtR/O9yCY=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=ZcjXiA+ghsgRFS6bDoQk0kYidskNm+N8LOIBT71zHAqSbV8PD7+CbQ6ToKUKqL/332T+eAE+zePFC7owGCPhq5DpEzddfFUldHpGwSsTrUdloq6wf6hqru+rD01XxvLrPu7dhYV+eHuQsXdlF9UX2agCEjJMkT8cFzZrPEXCsDY= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=T/T92cRx; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="T/T92cRx" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 00604C4CEE7; Wed, 17 Sep 2025 14:58:04 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1758121085; bh=qFv8cMFgeLcRNba4NCjfh8k13KPtMmi2FPqtR/O9yCY=; h=From:To:Cc:Subject:Date:Reply-to:From; b=T/T92cRxjdC13yIt6AW921cGeXYQNtHToTdCBaSfZwFQb+/LeSgX/0W4mWoVinPMR nRTyPUF4uBaFDDhwbbdE2gKhOZdi5FJx2C1ymasyg0mBPb4YrmOMS9dwWOOXHYwY4X jyKmd+b39NoXK2GphvkT/RnqX92Fg1t1Timsh3Gs= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2023-53345: rxrpc: Fix potential data race in rxrpc_wait_to_be_connected() Date: Wed, 17 Sep 2025 16:56:44 +0200 Message-ID: <2025091719-CVE-2023-53345-0807@gregkh> X-Mailer: git-send-email 2.51.0 Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Reply-to: , X-Developer-Signature: v=1; a=openpgp-sha256; l=4088; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=Bds5/c1Qb0B4b2DXPiA4DOy/N0eb3mjZB+qTS4ngyYg=; b=owGbwMvMwCRo6H6F97bub03G02pJDBmnzggfPMl42fjVAvFFs9dxyJulJflO+shgPNX95uTXL 51ut75c2BHLwiDIxCArpsjyZRvP0f0VhxS9DG1Pw8xhZQIZwsDFKQATMWxiWHD98ddclo97V30I 7D3NWSJowLQsNZ5hwdQdlmqTTl498mbPizMHFrhP1RflaQMA X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix potential data race in rxrpc_wait_to_be_connected() Inside the loop in rxrpc_wait_to_be_connected() it checks call->error to see if it should exit the loop without first checking the call state. This is probably safe as if call->error is set, the call is dead anyway, but we should probably wait for the call state to have been set to completion first, lest it cause surprise on the way out. Fix this by only accessing call->error if the call is complete. We don't actually need to access the error inside the loop as we'll do that after. This caused the following report: BUG: KCSAN: data-race in rxrpc_send_data / rxrpc_set_call_completion write to 0xffff888159cf3c50 of 4 bytes by task 25673 on cpu 1: rxrpc_set_call_completion+0x71/0x1c0 net/rxrpc/call_state.c:22 rxrpc_send_data_packet+0xba9/0x1650 net/rxrpc/output.c:479 rxrpc_transmit_one+0x1e/0x130 net/rxrpc/output.c:714 rxrpc_decant_prepared_tx net/rxrpc/call_event.c:326 [inline] rxrpc_transmit_some_data+0x496/0x600 net/rxrpc/call_event.c:350 rxrpc_input_call_event+0x564/0x1220 net/rxrpc/call_event.c:464 rxrpc_io_thread+0x307/0x1d80 net/rxrpc/io_thread.c:461 kthread+0x1ac/0x1e0 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308 read to 0xffff888159cf3c50 of 4 bytes by task 25672 on cpu 0: rxrpc_send_data+0x29e/0x1950 net/rxrpc/sendmsg.c:296 rxrpc_do_sendmsg+0xb7a/0xc20 net/rxrpc/sendmsg.c:726 rxrpc_sendmsg+0x413/0x520 net/rxrpc/af_rxrpc.c:565 sock_sendmsg_nosec net/socket.c:724 [inline] sock_sendmsg net/socket.c:747 [inline] ____sys_sendmsg+0x375/0x4c0 net/socket.c:2501 ___sys_sendmsg net/socket.c:2555 [inline] __sys_sendmmsg+0x263/0x500 net/socket.c:2641 __do_sys_sendmmsg net/socket.c:2670 [inline] __se_sys_sendmmsg net/socket.c:2667 [inline] __x64_sys_sendmmsg+0x57/0x60 net/socket.c:2667 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd value changed: 0x00000000 -> 0xffffffea The Linux kernel CVE team has assigned CVE-2023-53345 to this issue. Affected and fixed versions =========================== Issue introduced in 6.2 with commit 9d35d880e0e4a3ab32d8c12f9e4d76198aadd42d and fixed in 6.2.16 with commit 3e8ba61a3fe4475a9b5c9fbfc664435c6795d872 Issue introduced in 6.2 with commit 9d35d880e0e4a3ab32d8c12f9e4d76198aadd42d and fixed in 6.3.3 with commit 454e48a9ff04c5fa1631bb172070fcb6389b97f9 Issue introduced in 6.2 with commit 9d35d880e0e4a3ab32d8c12f9e4d76198aadd42d and fixed in 6.4 with commit 2b5fdc0f5caa505afe34d608e2eefadadf2ee67a Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2023-53345 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: net/rxrpc/sendmsg.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/3e8ba61a3fe4475a9b5c9fbfc664435c6795d872 https://git.kernel.org/stable/c/454e48a9ff04c5fa1631bb172070fcb6389b97f9 https://git.kernel.org/stable/c/2b5fdc0f5caa505afe34d608e2eefadadf2ee67a