summaryrefslogtreecommitdiff
path: root/Documentation/networking
diff options
context:
space:
mode:
authorDavid Howells <dhowells@redhat.com>2023-04-22 01:03:46 +0300
committerDavid S. Miller <davem@davemloft.net>2023-04-22 17:16:39 +0300
commite0416e7d33361d2ad0bf9f007428346579ac854a (patch)
tree9c840c2d1f4c72e457db4b9106dbbf54c6ba3281 /Documentation/networking
parent92ce288ccb0d472977b24bd0b7240fc2490a6145 (diff)
downloadlinux-e0416e7d33361d2ad0bf9f007428346579ac854a.tar.xz
rxrpc: Fix potential race in error handling in afs_make_call()
If the rxrpc call set up by afs_make_call() receives an error whilst it is transmitting the request, there's the possibility that it may get to the point the rxrpc call is ended (after the error_kill_call label) just as the call is queued for async processing. This could manifest itself as call->rxcall being seen as NULL in afs_deliver_to_call() when it tries to lock the call. Fix this by splitting rxrpc_kernel_end_call() into a function to shut down an rxrpc call and a function to release the caller's reference and calling the latter only when we get to afs_put_call(). Reported-by: Jeffrey Altman <jaltman@auristor.com> Signed-off-by: David Howells <dhowells@redhat.com> Tested-by: kafs-testing+fedora36_64checkkafs-build-306@auristor.com cc: Marc Dionne <marc.dionne@auristor.com> cc: "David S. Miller" <davem@davemloft.net> cc: Eric Dumazet <edumazet@google.com> cc: Jakub Kicinski <kuba@kernel.org> cc: Paolo Abeni <pabeni@redhat.com> cc: linux-afs@lists.infradead.org cc: netdev@vger.kernel.org Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'Documentation/networking')
-rw-r--r--Documentation/networking/rxrpc.rst17
1 files changed, 12 insertions, 5 deletions
diff --git a/Documentation/networking/rxrpc.rst b/Documentation/networking/rxrpc.rst
index ec1323d92c96..e807e18ba32a 100644
--- a/Documentation/networking/rxrpc.rst
+++ b/Documentation/networking/rxrpc.rst
@@ -848,14 +848,21 @@ The kernel interface functions are as follows:
returned. The caller now holds a reference on this and it must be
properly ended.
- (#) End a client call::
+ (#) Shut down a client call::
- void rxrpc_kernel_end_call(struct socket *sock,
+ void rxrpc_kernel_shutdown_call(struct socket *sock,
+ struct rxrpc_call *call);
+
+ This is used to shut down a previously begun call. The user_call_ID is
+ expunged from AF_RXRPC's knowledge and will not be seen again in
+ association with the specified call.
+
+ (#) Release the ref on a client call::
+
+ void rxrpc_kernel_put_call(struct socket *sock,
struct rxrpc_call *call);
- This is used to end a previously begun call. The user_call_ID is expunged
- from AF_RXRPC's knowledge and will not be seen again in association with
- the specified call.
+ This is used to release the caller's ref on an rxrpc call.
(#) Send data through a call::