linux/net/rxrpc
David Howells c08cf31419 rxrpc: Fix data-race warning and potential load/store tearing
[ Upstream commit 5d5fe8bcd3 ]

Fix the following:

        BUG: KCSAN: data-race in rxrpc_peer_keepalive_worker / rxrpc_send_data_packet

which is reporting an issue with the reads and writes to ->last_tx_at in:

        conn->peer->last_tx_at = ktime_get_seconds();

and:

        keepalive_at = peer->last_tx_at + RXRPC_KEEPALIVE_TIME;

The lockless accesses to these to values aren't actually a problem as the
read only needs an approximate time of last transmission for the purposes
of deciding whether or not the transmission of a keepalive packet is
warranted yet.

Also, as ->last_tx_at is a 64-bit value, tearing can occur on a 32-bit
arch.

Fix both of these by switching to an unsigned int for ->last_tx_at and only
storing the LSW of the time64_t.  It can then be reconstructed at need
provided no more than 68 years has elapsed since the last transmission.

Fixes: ace45bec6d ("rxrpc: Fix firewall route keepalive")
Reported-by: syzbot+6182afad5045e6703b3d@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/r/695e7cfb.050a0220.1c677c.036b.GAE@google.com/
Signed-off-by: David Howells <dhowells@redhat.com>
cc: Marc Dionne <marc.dionne@auristor.com>
cc: Simon Horman <horms@kernel.org>
cc: linux-afs@lists.infradead.org
cc: stable@kernel.org
Link: https://patch.msgid.link/1107124.1768903985@warthog.procyon.org.uk
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
[ different struct fields (peer->mtu, peer->srtt_us, peer->rto_us) and different output.c code structure ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2026-02-06 16:55:49 +01:00
..
af_rxrpc.c rxrpc: Improve setsockopt() handling of malformed user input 2024-12-05 14:02:35 +01:00
ar-internal.h rxrpc: Fix data-race warning and potential load/store tearing 2026-02-06 16:55:49 +01:00
call_accept.c rxrpc: Fix recv-recv race of completed call 2025-07-24 08:56:35 +02:00
call_event.c rxrpc: Extract useful fields from a received ACK to skb priv data 2024-03-05 23:35:26 +00:00
call_object.c rxrpc: Fix call state set to not include the SERVER_SECURING state 2025-02-17 10:05:02 +01:00
call_state.c rxrpc: Move client call connection to the I/O thread 2023-01-06 09:43:33 +00:00
conn_client.c rxrpc: Fix missing locking causing hanging calls 2024-11-07 11:30:34 -08:00
conn_event.c rxrpc: Fix data-race warning and potential load/store tearing 2026-02-06 16:55:49 +01:00
conn_object.c rxrpc: Fix the rxrpc_connection attend queue handling 2025-02-17 10:05:00 +01:00
conn_service.c rxrpc_find_service_conn_rcu: fix the usage of read_seqbegin_or_lock() 2023-12-24 15:22:49 +00:00
input.c rxrpc: Fix call state set to not include the SERVER_SECURING state 2025-02-17 10:05:02 +01:00
insecure.c rxrpc: Fix using alignmask being zero for __page_frag_alloc_align() 2024-04-30 18:30:43 -07:00
io_thread.c rxrpc: Fix a race between socket set up and I/O thread creation 2024-10-03 16:23:20 -07:00
Kconfig rxrpc: Allow a delay to be injected into packet reception 2023-01-31 16:38:09 +00:00
key.c rxrpc: Fix error when reading rxrpc tokens 2023-04-23 13:38:28 +01:00
local_event.c rxrpc: Truncate UTS_RELEASE for rxrpc version 2023-05-30 10:01:06 +02:00
local_object.c rxrpc: Fix a race between socket set up and I/O thread creation 2024-10-03 16:23:20 -07:00
Makefile rxrpc: Split out the call state changing functions into their own file 2023-01-06 09:43:32 +00:00
misc.c rxrpc: Use ktimes for call timeout tracking and set the timer lazily 2024-03-05 23:35:25 +00:00
net_ns.c rxrpc: Create a procfile to display outstanding client conn bundles 2023-12-24 15:22:56 +00:00
output.c rxrpc: Fix data-race warning and potential load/store tearing 2026-02-06 16:55:49 +01:00
peer_event.c rxrpc: Fix data-race warning and potential load/store tearing 2026-02-06 16:55:49 +01:00
peer_object.c rxrpc, afs: Fix peer hash locking vs RCU callback 2025-02-08 09:58:05 +01:00
proc.c rxrpc: Fix data-race warning and potential load/store tearing 2026-02-06 16:55:49 +01:00
protocol.h rxrpc: Fix the names of the fields in the ACK trailer struct 2024-02-29 15:49:57 +00:00
recvmsg.c rxrpc: Fix recv-recv race of completed call 2025-07-24 08:56:35 +02:00
rtt.c rxrpc: Use ktimes for call timeout tracking and set the timer lazily 2024-03-05 23:35:25 +00:00
rxkad.c rxrpc: Fix data-race warning and potential load/store tearing 2026-02-06 16:55:49 +01:00
rxperf.c rxrpc: rxperf: Fix missing decoding of terminal magic cookie 2025-03-07 18:25:29 +01:00
security.c rxrpc: Fix incoming call setup race 2023-01-07 09:30:26 +00:00
sendmsg.c rxrpc: Fix call state set to not include the SERVER_SECURING state 2025-02-17 10:05:02 +01:00
server_key.c rxrpc: Implement an in-kernel rxperf server for testing purposes 2022-12-01 13:36:37 +00:00
skbuff.c rxrpc: Use consume_skb() rather than kfree_skb_reason() 2023-02-07 23:11:20 +00:00
sysctl.c net: Remove ctl_table sentinel elements from several networking subsystems 2024-05-03 13:29:42 +01:00
txbuf.c rxrpc: Fix using alignmask being zero for __page_frag_alloc_align() 2024-04-30 18:30:43 -07:00
utils.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 36 2019-05-24 17:27:11 +02:00