[PATCH 0/3] rxrpc: fix three bugs found by autokbug fuzzing

[Henry Martin <bsdhenrymartin@gmail.com>]

These three patches fix independent rxrpc bugs found by the autokbug
dynamic kernel fuzzer at Tencent Yunding Lab.

  [1/3] Stack OOB read in TLP soft-ACK processing. A malicious peer
        can deterministically trigger it over an unencrypted
        (security-none) AF_RXRPC association - an immediate KASAN
        stack-out-of-bounds report even at the minimum offset.

  [2/3] kernel BUG in netns teardown: the conn_proc_list assertion
        in rxrpc_destroy_all_connections() races with connection
        destructors deferred to system_wq and fires on a healthy
        state, killing the cleanup_net kworker. Unprivileged
        userns+netns reachable.

  [3/3] WARN_ON in rxrpc_alloc_txqueue(): the TX_NO_MORE entry check
        from commit ae4f89989479 ("rxrpc: Fix ability to add more
        data to a call once MSG_MORE deasserted") is not re-done
        after sleeping in wait_for_space, so a racing sendmsg on the
        same call reaches the WARN on a legal finalized-call state
        (spurious splat and -ENOMEM; panic_on_warn DoS).

Thanks,
Henry

Henry Martin (3):
  rxrpc: fix stack OOB read in TLP soft-ACK processing
  rxrpc: wait for deferred conn destruction before conn_proc_list check
  rxrpc: recheck RXRPC_CALL_TX_NO_MORE after sleeping in rxrpc_send_data()

 net/rxrpc/ar-internal.h | 3 ++-
 net/rxrpc/conn_object.c | 10 ++++++----
 net/rxrpc/sendmsg.c     | 8 ++++++++
 3 files changed, 16 insertions(+), 5 deletions(-)

-- 
2.43.0