rxrpc_poke_conn() takes a reference on the connection with no liveness check, unlike its sibling rxrpc_queue_conn() which gates on atomic_read(&conn->active) >= 0. The per-connection timer is armed with no reference held for it, and rxrpc_put_connection() cancels it with a non-synchronous timer_delete() only after the refcount reaches 0. refcount_t saturates rather than resurrecting, so the connection can be kfree()d while still linked in local->conn_attend_q (nothing in teardown unlinks attend_link). The rxrpc I/O thread then performs a UAF write (list_del_init) plus UAF reads and indirect calls through conn->security. Reproduced on a KASAN + PREEMPT kernel: 56 "refcount_t: addition on 0" saturations at load, escalating to BUG: KASAN: slab-use-after-free in rxrpc_io_thread Write of size 8 AF_RXRPC socket creation (rxrpc_create) has no capability check, so this is reachable by an unprivileged user. Guard rxrpc_poke_conn() with the same liveness/refcount check the sibling rxrpc_queue_conn() uses before taking the poke reference, so a connection past its last-active point is not poked/requeued after teardown began. Verified before/after on KASAN+PREEMPT at equal timer volume: 56 saturations + 15 KASAN reports unpatched vs 0 and 0 patched. Signed-off-by: Seungwon Bae --- net/rxrpc/conn_object.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/net/rxrpc/conn_object.c b/net/rxrpc/conn_object.c index 0ece717db..1be50e0c9 100644 --- a/net/rxrpc/conn_object.c +++ b/net/rxrpc/conn_object.c @@ -34,7 +34,10 @@ void rxrpc_poke_conn(struct rxrpc_connection *conn, enum rxrpc_conn_trace why) spin_lock_irq(&local->lock); busy = !list_empty(&conn->attend_link); if (!busy) { - rxrpc_get_connection(conn, why); + if (!rxrpc_get_connection_maybe(conn, why)) { + spin_unlock_irq(&local->lock); + return; + } list_add_tail(&conn->attend_link, &local->conn_attend_q); } spin_unlock_irq(&local->lock); -- 2.43.0