[PATCH net] rxrpc: Prevent reusing service connections marked for reaping

[PATCH net] rxrpc: Prevent reusing service connections marked for reaping

[Chengfeng Ye]

The service connection reaper changes conn->active from 0 to -1 before
unpublishing an idle connection. The I/O thread can have already found
that connection and acquired an input reference. If it then allocates a
new call, rxrpc_alloc_incoming_call() unconditionally increments
conn->active, changing -1 back to 0. This violates the reaper's final
assertion and can panic the kernel:

  I/O thread                           Reaper
  Look up conn and take input ref
                                       Set active from 0 to -1
  Allocate an incoming call
    Increment active from -1 to 0
                                       Assert active == -1

The kernel reported:

  kernel BUG at net/rxrpc/conn_object.c:465!
  Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI
  Workqueue: krxrpcd rxrpc_service_connection_reaper
  RIP: 0010:rxrpc_service_connection_reaper+0x768/0xbc0
  Call Trace:
   process_one_work+0x5f2/0xf20
   worker_thread+0x46e/0xda0
   kthread+0x2b2/0x390
   ret_from_fork+0x36e/0x5a0

Use atomic_inc_unless_negative() before taking the call's connection
reference. If reaping won the race, leave the activity count untouched
and return through the existing BUSY rejection path without consuming a
preallocated call. The caller's input reference keeps the connection
live during this check. If call allocation wins, the positive activity
count prevents the reaper from claiming the connection.

Fixes: 3cec055c5695 ("rxrpc: Don't hold a ref for connection workqueue")
Cc: stable@vger.kernel.org
Signed-off-by: Chengfeng Ye <nicoyip.dev@gmail.com>
---
 net/rxrpc/call_accept.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/rxrpc/call_accept.c b/net/rxrpc/call_accept.c
index 47824120f1da..87bc3af2208b 100644
--- a/net/rxrpc/call_accept.c
+++ b/net/rxrpc/call_accept.c
@@ -299,8 +299,9 @@ static struct rxrpc_call *rxrpc_alloc_incoming_call(struct rxrpc_sock *rx,
 		rxrpc_see_connection(conn, rxrpc_conn_see_new_service_conn);
 		rxrpc_new_incoming_connection(rx, conn, sec, skb);
 	} else {
+		if (!atomic_inc_unless_negative(&conn->active))
+			return NULL;
 		rxrpc_get_connection(conn, rxrpc_conn_get_service_conn);
-		atomic_inc(&conn->active);
 	}
 
 	/* And now we can allocate and set up a new call */
-- 
2.43.0

Re: [PATCH net] rxrpc: Prevent reusing service connections marked for reaping

[Chengfeng Ye]

On Sun, Sep 27, 2026 at 2:45 PM Chengfeng Ye <nicoyip.dev@gmail.com> wrote:
>
> The service connection reaper changes conn->active from 0 to -1 before
> unpublishing an idle connection. The I/O thread can have already found
> that connection and acquired an input reference. If it then allocates a
> new call, rxrpc_alloc_incoming_call() unconditionally increments
> conn->active, changing -1 back to 0. This violates the reaper's final
> assertion and can panic the kernel:
>
>   I/O thread                           Reaper
>   Look up conn and take input ref
>                                        Set active from 0 to -1
>   Allocate an incoming call
>     Increment active from -1 to 0
>                                        Assert active == -1
>
> The kernel reported:
>
>   kernel BUG at net/rxrpc/conn_object.c:465!
>   Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI
>   Workqueue: krxrpcd rxrpc_service_connection_reaper
>   RIP: 0010:rxrpc_service_connection_reaper+0x768/0xbc0
>   Call Trace:
>    process_one_work+0x5f2/0xf20
>    worker_thread+0x46e/0xda0
>    kthread+0x2b2/0x390
>    ret_from_fork+0x36e/0x5a0
>
> Use atomic_inc_unless_negative() before taking the call's connection
> reference. If reaping won the race, leave the activity count untouched
> and return through the existing BUSY rejection path without consuming a
> preallocated call. The caller's input reference keeps the connection
> live during this check. If call allocation wins, the positive activity
> count prevents the reaper from claiming the connection.
>
> Fixes: 3cec055c5695 ("rxrpc: Don't hold a ref for connection workqueue")
> Cc: stable@vger.kernel.org
> Signed-off-by: Chengfeng Ye <nicoyip.dev@gmail.com>
> ---
>  net/rxrpc/call_accept.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/net/rxrpc/call_accept.c b/net/rxrpc/call_accept.c
> index 47824120f1da..87bc3af2208b 100644
> --- a/net/rxrpc/call_accept.c
> +++ b/net/rxrpc/call_accept.c
> @@ -299,8 +299,9 @@ static struct rxrpc_call *rxrpc_alloc_incoming_call(struct rxrpc_sock *rx,
>                 rxrpc_see_connection(conn, rxrpc_conn_see_new_service_conn);
>                 rxrpc_new_incoming_connection(rx, conn, sec, skb);
>         } else {
> +               if (!atomic_inc_unless_negative(&conn->active))
> +                       return NULL;
>                 rxrpc_get_connection(conn, rxrpc_conn_get_service_conn);
> -               atomic_inc(&conn->active);
>         }
>
>         /* And now we can allocate and set up a new call */
> --
> 2.43.0
>

Gentle ping on this patch. Any feedback would be appreciated.

Best regards,
Chengfeng