linux/net/rxrpc
Xuanqiang Luo 745fb794c3 rxrpc: fix io_thread race in rxrpc_wake_up_io_thread()
rxrpc_wake_up_io_thread() checks local->io_thread before waking it, but
then reloads the pointer for wake_up_process().

local->io_thread is cleared with WRITE_ONCE() when the I/O thread exits, so
the second load can see NULL even if the first load did not.

Take a READ_ONCE() snapshot and use it for both the NULL check and the
wake_up_process() call, as rxrpc_encap_rcv() already does.

Fixes: 5800b1cf3f ("rxrpc: Allow CHALLENGEs to the passed to the app for a RESPONSE")
Signed-off-by: Xuanqiang Luo <luoxuanqiang@kylinos.cn>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20260708093534.53486-1-xuanqiang.luo@linux.dev
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-21 11:52:29 +02:00
..
tests net/rxrpc: Reimplement DES-PCBC using DES library 2026-06-09 17:03:03 -07:00
.kunitconfig net/rxrpc: Add local FCrypt-PCBC implementation 2026-06-09 17:03:03 -07:00
af_rxrpc.c rxrpc: convert to getsockopt_iter 2026-05-22 11:11:10 -07:00
ar-internal.h rxrpc: fix io_thread race in rxrpc_wake_up_io_thread() 2026-07-21 11:52:29 +02:00
call_accept.c rxrpc: serialize kernel accept preallocation with socket teardown 2026-06-12 16:48:55 -07:00
call_event.c rxrpc: Fix ACKALL packet handling 2026-06-25 10:07:17 -07:00
call_object.c rxrpc: Fix ACKALL packet handling 2026-06-25 10:07:17 -07:00
call_state.c
conn_client.c rxrpc: Fix ACKALL packet handling 2026-06-25 10:07:17 -07:00
conn_event.c rxrpc: Fix oob challenge leak in cleanup after notification failure 2026-06-25 10:07:18 -07:00
conn_object.c treewide: Replace kmalloc with kmalloc_obj for non-scalar types 2026-02-21 01:02:28 -08:00
conn_service.c rxrpc_find_service_conn_rcu: fix the usage of read_seqbegin_or_lock() 2023-12-24 15:22:49 +00:00
fcrypt.c net/rxrpc: Add local FCrypt-PCBC implementation 2026-06-09 17:03:03 -07:00
input_rack.c rxrpc: Fix rack timer warning to report unexpected mode 2026-04-08 18:44:32 -07:00
input.c rxrpc: Fix rxrpc_rotate_tx_rotate() to check there's something to rotate 2026-06-25 10:07:19 -07:00
insecure.c rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer 2026-05-20 16:36:45 -07:00
io_thread.c rxrpc: Fix potential UAF after skb_unshare() failure 2026-04-23 12:40:52 -07:00
Kconfig net/rxrpc: Reimplement DES-PCBC using DES library 2026-06-09 17:03:03 -07:00
key.c net/rxrpc: Reimplement DES-PCBC using DES library 2026-06-09 17:03:03 -07:00
local_event.c
local_object.c udp_tunnel: Pass struct sock to setup_udp_tunnel_sock(). 2026-05-05 17:47:04 -07:00
Makefile net/rxrpc: Add local FCrypt-PCBC implementation 2026-06-09 17:03:03 -07:00
misc.c rxrpc: Implement path-MTU probing using padded PING ACKs (RFC8899) 2024-12-09 13:48:25 -08:00
net_ns.c treewide: Switch/rename to timer_delete[_sync]() 2025-04-05 10:30:12 +02:00
oob.c rxrpc: Fix oob challenge leak in cleanup after notification failure 2026-06-25 10:07:18 -07:00
output.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2026-04-09 13:20:59 -07:00
peer_event.c rxrpc: Fix data-race warning and potential load/store tearing 2026-01-21 19:59:29 -08:00
peer_object.c treewide: Replace kmalloc with kmalloc_obj for non-scalar types 2026-02-21 01:02:28 -08:00
proc.c rxrpc: proc: size address buffers for %pISpc output 2026-04-08 18:45:32 -07:00
protocol.h rxrpc: rxgk: Implement the yfs-rxgk security class (GSSAPI) 2025-04-14 17:36:42 -07:00
recvmsg.c rxrpc: Fix leak of released call in recvmsg(MSG_PEEK) 2026-06-25 10:07:19 -07:00
rtt.c rxrpc: Manage RTT per-call rather than per-peer 2024-12-09 13:48:32 -08:00
rxgk_app.c rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer 2026-05-20 16:36:45 -07:00
rxgk_common.h rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer 2026-05-20 16:36:45 -07:00
rxgk_kdf.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
rxgk.c rxrpc: Fix UAF in rxgk_issue_challenge() 2026-06-12 16:48:54 -07:00
rxkad.c net/rxrpc: Reimplement DES-PCBC using DES library 2026-06-09 17:03:03 -07:00
rxperf.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
security.c rxrpc: Fix to use conn aborts for conn-wide failures 2025-07-17 07:50:48 -07:00
sendmsg.c rxrpc: Fix ACKALL packet handling 2026-06-25 10:07:17 -07:00
server_key.c net/rxrpc: Reimplement DES-PCBC using DES library 2026-06-09 17:03:03 -07:00
skbuff.c rxrpc: Fix potential UAF after skb_unshare() failure 2026-04-23 12:40:52 -07:00
sysctl.c rxrpc: Implement path-MTU probing using padded PING ACKs (RFC8899) 2024-12-09 13:48:25 -08:00
txbuf.c treewide: Replace kmalloc with kmalloc_obj for non-scalar types 2026-02-21 01:02:28 -08:00
utils.c