From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 975A638425B for ; Fri, 10 Jul 2026 19:23:10 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.133.124 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783711392; cv=none; b=ei8ojROfO8EEZ/UYSlbUOrqWYjO9txm+xN/kdnuIlffkVHF7vW7NrilrUXgjQ5nSH9i7kiR67F45OpteN9W6iLpThzn0SdXIsYJE4/BXHc9iBbgLLzjbOyhRlOQNFgPyKDK0X5hgoXfGrTEuXO8Q3DrLN+LA5jGdJVxpVP4LgAw= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783711392; c=relaxed/simple; bh=RqEZ8V3VTBLUYMWessvmE35+orqVW6T6gXuF1INaQHs=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=hedpHFkM6o3pEVZ4ZPkrVMBGtCEkWM0pUogBXYPFIqKVJc60pi/S8LDV3hFSXVQShXC13IZu3wpUaWZm8NsXu7v8m79JA9ox9Fz5UfJST4+ikqLrA0UYG+kS3W/m1mVgvYrB6VVMCOMohieFIEETyAyt7Ks54K0pgEl+d86Lxs0= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=QAA5cywb; arc=none smtp.client-ip=170.10.133.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="QAA5cywb" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1783711389; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=5tnXvZhH3Uv8RMIWKCx6J8r5QB8JHDWA9/+oQzZb+wc=; b=QAA5cywb6ordFn7UhEJbFEN+Yzky/+TaoREiLniHVemPtic3zGBShdu0cEqw0eDcTGRpA5 +UyUlJa8fbYZ17uB3ypAPCeSY81+6sL+wSM8H6MRMfKDeV8Pt+94jld/eKAcoU5PQvuAHF Cl+cKEcgMg42mTpKnavGiyL6behO3TA= Received: from mx-prod-mc-01.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-644-xh74SyEAN1KLSqSNfDz63w-1; Fri, 10 Jul 2026 15:23:04 -0400 X-MC-Unique: xh74SyEAN1KLSqSNfDz63w-1 X-Mimecast-MFC-AGG-ID: xh74SyEAN1KLSqSNfDz63w_1783711382 Received: from mx-prod-int-08.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-08.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.111]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-01.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 91CC81955F07; Fri, 10 Jul 2026 19:23:02 +0000 (UTC) Received: from warthog.procyon.org.com (unknown [10.44.33.159]) by mx-prod-int-08.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 75CCA1800661; Fri, 10 Jul 2026 19:22:59 +0000 (UTC) From: David Howells To: netdev@vger.kernel.org Cc: David Howells , Marc Dionne , Jakub Kicinski , "David S. Miller" , Eric Dumazet , Paolo Abeni , Simon Horman , linux-afs@lists.infradead.org, linux-kernel@vger.kernel.org, stable@kernel.org Subject: [PATCH net v2 07/16] rxrpc: Fix update of call->tx_pending without holding lock Date: Fri, 10 Jul 2026 20:22:09 +0100 Message-ID: <20260710192220.1922433-8-dhowells@redhat.com> In-Reply-To: <20260710192220.1922433-1-dhowells@redhat.com> References: <20260710192220.1922433-1-dhowells@redhat.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.111 Currently, rxrpc_send_data() updates call->tx_pending just before it returns - but it won't be holding the call->lock when it does this if a wait was interrupted by a signal. This would allow a parallel sendmsg() to race. Further, both the callers of rxrpc_send_data() call it with the lock held, and then it returns an indication through the parameter list to say whether it has dropped the lock or not - after which the callers both just drop the lock if it's still held. Fix this by: (1) Moving the release of call->lock down into rxrpc_send_data() and get rid of the indicator parameter. This makes it easier to see where the lock is held. (2) Make the wait_for_space path move the value in txb back into call->tx_pending before dropping the lock prior to the wait. (3) After waiting, if the attempt to reacquire the mutex is interrupted, just return directly there rather than going to out_unlock Fixes: b0f571ecd794 ("rxrpc: Fix locking in rxrpc's sendmsg") Closes: https://sashiko.dev/#/patchset/20260702144919.172295-1-dhowells%40redhat.com Signed-off-by: David Howells cc: Marc Dionne cc: Eric Dumazet cc: "David S. Miller" cc: Jakub Kicinski cc: Paolo Abeni cc: Simon Horman cc: linux-afs@lists.infradead.org cc: stable@kernel.org --- net/rxrpc/sendmsg.c | 52 +++++++++++++++++++++++++-------------------- 1 file changed, 29 insertions(+), 23 deletions(-) diff --git a/net/rxrpc/sendmsg.c b/net/rxrpc/sendmsg.c index d5060fd9631a..71343998b87d 100644 --- a/net/rxrpc/sendmsg.c +++ b/net/rxrpc/sendmsg.c @@ -320,8 +320,8 @@ static int rxrpc_alloc_txqueue(struct sock *sk, struct rxrpc_call *call) static int rxrpc_send_data(struct rxrpc_sock *rx, struct rxrpc_call *call, struct msghdr *msg, size_t len, - rxrpc_notify_end_tx_t notify_end_tx, - bool *_dropped_lock) + rxrpc_notify_end_tx_t notify_end_tx) + __releases(&call->user_mutex) { struct rxrpc_txbuf *txb; struct sock *sk = &rx->sk; @@ -334,25 +334,27 @@ static int rxrpc_send_data(struct rxrpc_sock *rx, trace_rxrpc_abort(call->debug_id, rxrpc_sendmsg_late_send, call->cid, call->call_id, call->rx_consumed, 0, -EPROTO); - return -EPROTO; + ret = -EPROTO; + goto out_unlock; } if (unlikely(test_bit(RXRPC_CALL_TX_ERROR, &call->flags))) { trace_rxrpc_abort(call->debug_id, rxrpc_sendmsg_tx_error, call->cid, call->call_id, call->rx_consumed, 0, -EIO); - return -EIO; + ret = -EIO; + goto out_unlock; } timeo = sock_sndtimeo(sk, msg->msg_flags & MSG_DONTWAIT); ret = rxrpc_wait_to_be_connected(call, &timeo); if (ret < 0) - return ret; + goto out_unlock; if (call->conn->state == RXRPC_CONN_CLIENT_UNSECURED) { ret = rxrpc_init_client_conn_security(call->conn); if (ret < 0) - return ret; + goto out_unlock; } /* this should be in poll */ @@ -456,7 +458,7 @@ static int rxrpc_send_data(struct rxrpc_sock *rx, if (ret == -ENOMEM) goto maybe_error; set_bit(RXRPC_CALL_TX_ERROR, &call->flags); - goto out; + goto out_txb; } if (msg_data_left(msg) == 0 && !more) @@ -468,51 +470,58 @@ static int rxrpc_send_data(struct rxrpc_sock *rx, success: ret = copied; -out: +out_txb: call->tx_pending = txb; +out_unlock: + mutex_unlock(&call->user_mutex); _leave(" = %d", ret); return ret; call_terminated: rxrpc_put_txbuf(txb, rxrpc_txbuf_put_send_aborted); - _leave(" = %d", call->error); - return call->error; + call->tx_pending = NULL; + ret = call->error; + goto out_unlock; maybe_error: if (copied) { if (rxrpc_call_is_complete(call) && call->error < 0) { ret = call->error; - goto out; + goto out_unlock; } goto success; } - goto out; + goto out_txb; efault: ret = -EFAULT; - goto out; + goto out_txb; wait_for_space: ret = -EAGAIN; if (msg->msg_flags & MSG_DONTWAIT) goto maybe_error; + call->tx_pending = txb; + txb = NULL; mutex_unlock(&call->user_mutex); - *_dropped_lock = true; + ret = rxrpc_wait_for_tx_window(rx, call, &timeo, msg->msg_flags & MSG_WAITALL); if (ret < 0) - goto maybe_error; + goto out_nolock; if (call->interruptibility == RXRPC_INTERRUPTIBLE) { if (mutex_lock_interruptible(&call->user_mutex) < 0) { ret = sock_intr_errno(timeo); - goto maybe_error; + goto out_nolock; } } else { mutex_lock(&call->user_mutex); } - *_dropped_lock = false; goto reload; +out_nolock: + _leave(" = %d [intr]", ret); + return copied ?: ret; } /* @@ -787,8 +796,8 @@ int rxrpc_do_sendmsg(struct rxrpc_sock *rx, struct msghdr *msg, size_t len) ret = 0; break; case RXRPC_CMD_SEND_DATA: - ret = rxrpc_send_data(rx, call, msg, len, NULL, &dropped_lock); - break; + ret = rxrpc_send_data(rx, call, msg, len, NULL); + goto error_put; default: ret = -EINVAL; break; @@ -826,7 +835,6 @@ int rxrpc_kernel_send_data(struct socket *sock, struct rxrpc_call *call, struct msghdr *msg, size_t len, rxrpc_notify_end_tx_t notify_end_tx) { - bool dropped_lock = false; int ret; _enter("{%d},", call->debug_id); @@ -837,12 +845,10 @@ int rxrpc_kernel_send_data(struct socket *sock, struct rxrpc_call *call, mutex_lock(&call->user_mutex); ret = rxrpc_send_data(rxrpc_sk(sock->sk), call, msg, len, - notify_end_tx, &dropped_lock); + notify_end_tx); if (ret == -ESHUTDOWN) ret = call->error; - if (!dropped_lock) - mutex_unlock(&call->user_mutex); _leave(" = %d", ret); return ret; }