During network namespace teardown, rxrpc_destroy_all_peers() iterates over
the rxnet->peer_hash table to print leaked peers without holding
rxnet->peer_hash_lock. If concurrent activity drops the last reference to
a peer, __rxrpc_put_peer() unlinks the peer from rxnet->peer_hash under
rxnet->peer_hash_lock and frees it via kfree_rcu(). Without locking,
traversal can race with hash unlinking and RCU reclamation, triggering a
KASAN slab-use-after-free.
BUG: KASAN: slab-use-after-free in rxrpc_destroy_all_peers+0xcc/0x150
net/rxrpc/peer_object.c:461
Read of size 8 at addr ffff88811089e420 by task kworker/u8:1/13
Call Trace:
rxrpc_destroy_all_peers+0xcc/0x150 net/rxrpc/peer_object.c:461
rxrpc_exit_net+0x7f/0xc0 net/rxrpc/net_ns.c:114
ops_exit_list net/core/net_namespace.c:199 [inline]
ops_undo_list+0x43d/0x8d0 net/core/net_namespace.c:252
cleanup_net+0x572/0x810 net/core/net_namespace.c:702
process_one_work kernel/workqueue.c:3322 [inline]
process_scheduled_works+0xa8e/0x14e0 kernel/workqueue.c:3405
worker_thread+0x92d/0xe10 kernel/workqueue.c:3486
kthread+0x388/0x470 kernel/kthread.c:436
ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Fix the slab-use-after-free by acquiring rxnet->peer_hash_lock with
spin_lock_bh() while iterating over rxnet->peer_hash in
rxrpc_destroy_all_peers().
Fixes: 17226f124038 ("rxrpc: Fix leak of rxrpc_peer objects")
Reported-by: syzbot+c876adfab6362679008c@syzkaller.appspotmail.com
Assisted-by: Gemini:gemini-3.6-flash Gemini:gemini-3.1-pro-preview syzbot
Closes: https://syzkaller.appspot.com/bug?extid=c876adfab6362679008c
Link: https://syzkaller.appspot.com/ai_job?id=7fecbeb2-cd9b-4ca2-8149-48663e20b153
Signed-off-by: Marco Elver
---
v3:
* syzbot reported "INFO: task hung in rxrpc_destroy_all_calls" on v2:
Drop .pre_exit split. rxrpc_destroy_all_calls() blocks in
wait_var_event() on RCU call freeing; executing this in .pre_exit
under pernet_ops_rwsem deadlocks netns cleanup before
synchronize_rcu() and device teardown can run.
v2:
* Split teardown and use .pre_exit instead of rcu_barrier() (Eric).
---
net/rxrpc/peer_object.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/net/rxrpc/peer_object.c b/net/rxrpc/peer_object.c
index fa9a406e1168..faa2983638b2 100644
--- a/net/rxrpc/peer_object.c
+++ b/net/rxrpc/peer_object.c
@@ -454,6 +454,12 @@ void rxrpc_destroy_all_peers(struct rxrpc_net *rxnet)
struct rxrpc_peer *peer;
int i;
+ /*
+ * Prevent use-after-free if a peer is concurrently unlinked from the
+ * hash table and freed via RCU during iteration.
+ */
+ spin_lock_bh(&rxnet->peer_hash_lock);
+
for (i = 0; i < HASH_SIZE(rxnet->peer_hash); i++) {
if (hlist_empty(&rxnet->peer_hash[i]))
continue;
@@ -465,6 +471,8 @@ void rxrpc_destroy_all_peers(struct rxrpc_net *rxnet)
&peer->srx.transport);
}
}
+
+ spin_unlock_bh(&rxnet->peer_hash_lock);
}
/**
--
2.55.0.1003.g10538fe699-goog