The service connection reaper changes conn->active from 0 to -1 before unpublishing an idle connection. The I/O thread can have already found that connection and acquired an input reference. If it then allocates a new call, rxrpc_alloc_incoming_call() unconditionally increments conn->active, changing -1 back to 0. This violates the reaper's final assertion and can panic the kernel: I/O thread Reaper Look up conn and take input ref Set active from 0 to -1 Allocate an incoming call Increment active from -1 to 0 Assert active == -1 The kernel reported: kernel BUG at net/rxrpc/conn_object.c:465! Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI Workqueue: krxrpcd rxrpc_service_connection_reaper RIP: 0010:rxrpc_service_connection_reaper+0x768/0xbc0 Call Trace: process_one_work+0x5f2/0xf20 worker_thread+0x46e/0xda0 kthread+0x2b2/0x390 ret_from_fork+0x36e/0x5a0 Use atomic_inc_unless_negative() before taking the call's connection reference. If reaping won the race, leave the activity count untouched and return through the existing BUSY rejection path without consuming a preallocated call. The caller's input reference keeps the connection live during this check. If call allocation wins, the positive activity count prevents the reaper from claiming the connection. Fixes: 3cec055c5695 ("rxrpc: Don't hold a ref for connection workqueue") Cc: stable@vger.kernel.org Signed-off-by: Chengfeng Ye --- net/rxrpc/call_accept.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/rxrpc/call_accept.c b/net/rxrpc/call_accept.c index 47824120f1da..87bc3af2208b 100644 --- a/net/rxrpc/call_accept.c +++ b/net/rxrpc/call_accept.c @@ -299,8 +299,9 @@ static struct rxrpc_call *rxrpc_alloc_incoming_call(struct rxrpc_sock *rx, rxrpc_see_connection(conn, rxrpc_conn_see_new_service_conn); rxrpc_new_incoming_connection(rx, conn, sec, skb); } else { + if (!atomic_inc_unless_negative(&conn->active)) + return NULL; rxrpc_get_connection(conn, rxrpc_conn_get_service_conn); - atomic_inc(&conn->active); } /* And now we can allocate and set up a new call */ -- 2.43.0