[PATCH net] rxrpc: fix use-after-free in rxrpc_poke_conn()

[PATCH net] rxrpc: fix use-after-free in rxrpc_poke_conn()

[Seungwon Bae]

rxrpc_poke_conn() takes a reference on the connection with no liveness
check, unlike its sibling rxrpc_queue_conn() which gates on
atomic_read(&conn->active) >= 0.  The per-connection timer is armed with
no reference held for it, and rxrpc_put_connection() cancels it with a
non-synchronous timer_delete() only after the refcount reaches 0.
refcount_t saturates rather than resurrecting, so the connection can be
kfree()d while still linked in local->conn_attend_q (nothing in teardown
unlinks attend_link).  The rxrpc I/O thread then performs a UAF write
(list_del_init) plus UAF reads and indirect calls through conn->security.

Reproduced on a KASAN + PREEMPT kernel: 56 "refcount_t: addition on 0"
saturations at load, escalating to

  BUG: KASAN: slab-use-after-free in rxrpc_io_thread   Write of size 8

AF_RXRPC socket creation (rxrpc_create) has no capability check, so this
is reachable by an unprivileged user.

Guard rxrpc_poke_conn() with the same liveness/refcount check the sibling
rxrpc_queue_conn() uses before taking the poke reference, so a connection
past its last-active point is not poked/requeued after teardown began.

Verified before/after on KASAN+PREEMPT at equal timer volume: 56
saturations + 15 KASAN reports unpatched vs 0 and 0 patched.

Signed-off-by: Seungwon Bae <qotmddnjs@ajou.ac.kr>
---
 net/rxrpc/conn_object.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/net/rxrpc/conn_object.c b/net/rxrpc/conn_object.c
index 0ece717db..1be50e0c9 100644
--- a/net/rxrpc/conn_object.c
+++ b/net/rxrpc/conn_object.c
@@ -34,7 +34,10 @@ void rxrpc_poke_conn(struct rxrpc_connection *conn, enum rxrpc_conn_trace why)
 	spin_lock_irq(&local->lock);
 	busy = !list_empty(&conn->attend_link);
 	if (!busy) {
-		rxrpc_get_connection(conn, why);
+		if (!rxrpc_get_connection_maybe(conn, why)) {
+			spin_unlock_irq(&local->lock);
+			return;
+		}
 		list_add_tail(&conn->attend_link, &local->conn_attend_q);
 	}
 	spin_unlock_irq(&local->lock);
-- 
2.43.0

Re: [PATCH net] rxrpc: fix use-after-free in rxrpc_poke_conn()

[Simon Horman]

On Tue, Sep 01, 2026 at 02:10:45PM +0900, Seungwon Bae wrote:
> rxrpc_poke_conn() takes a reference on the connection with no liveness
> check, unlike its sibling rxrpc_queue_conn() which gates on
> atomic_read(&conn->active) >= 0.  The per-connection timer is armed with
> no reference held for it, and rxrpc_put_connection() cancels it with a
> non-synchronous timer_delete() only after the refcount reaches 0.
> refcount_t saturates rather than resurrecting, so the connection can be
> kfree()d while still linked in local->conn_attend_q (nothing in teardown
> unlinks attend_link).  The rxrpc I/O thread then performs a UAF write
> (list_del_init) plus UAF reads and indirect calls through conn->security.
> 
> Reproduced on a KASAN + PREEMPT kernel: 56 "refcount_t: addition on 0"
> saturations at load, escalating to
> 
>   BUG: KASAN: slab-use-after-free in rxrpc_io_thread   Write of size 8
> 
> AF_RXRPC socket creation (rxrpc_create) has no capability check, so this
> is reachable by an unprivileged user.
> 
> Guard rxrpc_poke_conn() with the same liveness/refcount check the sibling
> rxrpc_queue_conn() uses before taking the poke reference, so a connection
> past its last-active point is not poked/requeued after teardown began.
> 
> Verified before/after on KASAN+PREEMPT at equal timer volume: 56
> saturations + 15 KASAN reports unpatched vs 0 and 0 patched.
> 

I think a Fixes tag is needed here, citing the patch where
this problem first manifested.

Perhaps this one?

Fixes: f2cce89a074e ("rxrpc: Implement a mechanism to send an event notification to a connection")

If so, there shouldn't be any further action required to that end.
But if you do re-post for some other reason note that
there should not be a blank line between the Fixes and
Signed-off-by tags (or between any other tags).

> Signed-off-by: Seungwon Bae <qotmddnjs@ajou.ac.kr>

...

Re: [PATCH net] rxrpc: fix use-after-free in rxrpc_poke_conn()

[David Howells]

Hi Seungwon,

Do you have a stack trace available that I could look at?

Thanks,
David