During network namespace teardown, rxrpc_destroy_all_peers() iterates over
the rxnet->peer_hash table to print leaked peers without holding
rxnet->peer_hash_lock. If concurrent activity or asynchronous teardown
drops the last reference to a peer, __rxrpc_put_peer() unlinks the peer
from rxnet->peer_hash and frees it via kfree_rcu(). Without locking,
traversal can follow an unlinked peer or race with RCU reclamation,
triggering a KASAN slab-use-after-free.
BUG: KASAN: slab-use-after-free in rxrpc_destroy_all_peers+0xcc/0x150
net/rxrpc/peer_object.c:461
Read of size 8 at addr ffff88811089e420 by task kworker/u8:1/13
Call Trace:
rxrpc_destroy_all_peers+0xcc/0x150 net/rxrpc/peer_object.c:461
rxrpc_exit_net+0x7f/0xc0 net/rxrpc/net_ns.c:114
ops_exit_list net/core/net_namespace.c:199 [inline]
ops_undo_list+0x43d/0x8d0 net/core/net_namespace.c:252
cleanup_net+0x572/0x810 net/core/net_namespace.c:702
process_one_work kernel/workqueue.c:3322 [inline]
process_scheduled_works+0xa8e/0x14e0 kernel/workqueue.c:3405
worker_thread+0x92d/0xe10 kernel/workqueue.c:3486
kthread+0x388/0x470 kernel/kthread.c:436
ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
To fix the slab-use-after-free, acquire rxnet->peer_hash_lock with
spin_lock_bh() while iterating over rxnet->peer_hash in
rxrpc_destroy_all_peers().
Additionally, split netns teardown by implementing .pre_exit in
rxrpc_net_ops to clean up calls, connections, and keepalive work. This
ensures in-flight references are released before cleanup_net() executes
its intermediate synchronize_rcu(), so that peer and local endpoint leak
checks in rxrpc_exit_net() run only after deferred RCU releases complete,
avoiding spurious leak warnings.
Fixes: 17226f124038 ("rxrpc: Fix leak of rxrpc_peer objects")
Reported-by: syzbot+c876adfab6362679008c@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=c876adfab6362679008c
Link: https://syzkaller.appspot.com/ai_job?id=7fecbeb2-cd9b-4ca2-8149-48663e20b153
Signed-off-by: Marco Elver
---
v2:
* Split teardown and use .pre_exit instead of rcu_barrier() (Eric).
---
net/rxrpc/net_ns.c | 23 +++++++++++++++--------
net/rxrpc/peer_object.c | 8 ++++++++
2 files changed, 23 insertions(+), 8 deletions(-)
diff --git a/net/rxrpc/net_ns.c b/net/rxrpc/net_ns.c
index 9a9834145e81..169116735366 100644
--- a/net/rxrpc/net_ns.c
+++ b/net/rxrpc/net_ns.c
@@ -97,10 +97,7 @@ static __net_init int rxrpc_init_net(struct net *net)
return ret;
}
-/*
- * Clean up a per-network namespace record.
- */
-static __net_exit void rxrpc_exit_net(struct net *net)
+static __net_exit void rxrpc_pre_exit_net(struct net *net)
{
struct rxrpc_net *rxnet = rxrpc_net(net);
@@ -111,14 +108,24 @@ static __net_exit void rxrpc_exit_net(struct net *net)
timer_delete_sync(&rxnet->peer_keepalive_timer);
rxrpc_destroy_all_calls(rxnet);
rxrpc_destroy_all_connections(rxnet);
+}
+
+/*
+ * Clean up a per-network namespace record.
+ */
+static __net_exit void rxrpc_exit_net(struct net *net)
+{
+ struct rxrpc_net *rxnet = rxrpc_net(net);
+
rxrpc_destroy_all_peers(rxnet);
rxrpc_destroy_all_locals(rxnet);
proc_remove(rxnet->proc_net);
}
struct pernet_operations rxrpc_net_ops = {
- .init = rxrpc_init_net,
- .exit = rxrpc_exit_net,
- .id = &rxrpc_net_id,
- .size = sizeof(struct rxrpc_net),
+ .init = rxrpc_init_net,
+ .pre_exit = rxrpc_pre_exit_net,
+ .exit = rxrpc_exit_net,
+ .id = &rxrpc_net_id,
+ .size = sizeof(struct rxrpc_net),
};
diff --git a/net/rxrpc/peer_object.c b/net/rxrpc/peer_object.c
index fa9a406e1168..faa2983638b2 100644
--- a/net/rxrpc/peer_object.c
+++ b/net/rxrpc/peer_object.c
@@ -454,6 +454,12 @@ void rxrpc_destroy_all_peers(struct rxrpc_net *rxnet)
struct rxrpc_peer *peer;
int i;
+ /*
+ * Prevent use-after-free if a peer is concurrently unlinked from the
+ * hash table and freed via RCU during iteration.
+ */
+ spin_lock_bh(&rxnet->peer_hash_lock);
+
for (i = 0; i < HASH_SIZE(rxnet->peer_hash); i++) {
if (hlist_empty(&rxnet->peer_hash[i]))
continue;
@@ -465,6 +471,8 @@ void rxrpc_destroy_all_peers(struct rxrpc_net *rxnet)
&peer->srx.transport);
}
}
+
+ spin_unlock_bh(&rxnet->peer_hash_lock);
}
/**
--
2.55.0.1003.g10538fe699-goog