[PATCH v2] rxrpc: Fix use-after-free in rxrpc_destroy_all_peers()

[Marco Elver]

During network namespace teardown, rxrpc_destroy_all_peers() iterates over
the rxnet->peer_hash table to print leaked peers without holding
rxnet->peer_hash_lock. If concurrent activity or asynchronous teardown
drops the last reference to a peer, __rxrpc_put_peer() unlinks the peer
from rxnet->peer_hash and frees it via kfree_rcu(). Without locking,
traversal can follow an unlinked peer or race with RCU reclamation,
triggering a KASAN slab-use-after-free.

BUG: KASAN: slab-use-after-free in rxrpc_destroy_all_peers+0xcc/0x150
net/rxrpc/peer_object.c:461
Read of size 8 at addr ffff88811089e420 by task kworker/u8:1/13
Call Trace:
 <TASK>
 rxrpc_destroy_all_peers+0xcc/0x150 net/rxrpc/peer_object.c:461
 rxrpc_exit_net+0x7f/0xc0 net/rxrpc/net_ns.c:114
 ops_exit_list net/core/net_namespace.c:199 [inline]
 ops_undo_list+0x43d/0x8d0 net/core/net_namespace.c:252
 cleanup_net+0x572/0x810 net/core/net_namespace.c:702
 process_one_work kernel/workqueue.c:3322 [inline]
 process_scheduled_works+0xa8e/0x14e0 kernel/workqueue.c:3405
 worker_thread+0x92d/0xe10 kernel/workqueue.c:3486
 kthread+0x388/0x470 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>

To fix the slab-use-after-free, acquire rxnet->peer_hash_lock with
spin_lock_bh() while iterating over rxnet->peer_hash in
rxrpc_destroy_all_peers().

Additionally, split netns teardown by implementing .pre_exit in
rxrpc_net_ops to clean up calls, connections, and keepalive work. This
ensures in-flight references are released before cleanup_net() executes
its intermediate synchronize_rcu(), so that peer and local endpoint leak
checks in rxrpc_exit_net() run only after deferred RCU releases complete,
avoiding spurious leak warnings.

Fixes: 17226f124038 ("rxrpc: Fix leak of rxrpc_peer objects")
Reported-by: syzbot+c876adfab6362679008c@xxxxxxxxxxxxxxxxxxxxxxxxx
Closes: https://syzkaller.appspot.com/bug?extid=c876adfab6362679008c
Link: https://syzkaller.appspot.com/ai_job?id=7fecbeb2-cd9b-4ca2-8149-48663e20b153
Signed-off-by: Marco Elver <elver@xxxxxxxxxx>
---
v2:
* Split teardown and use .pre_exit instead of rcu_barrier() (Eric).
---
 net/rxrpc/net_ns.c      | 23 +++++++++++++++--------
 net/rxrpc/peer_object.c |  8 ++++++++
 2 files changed, 23 insertions(+), 8 deletions(-)

diff --git a/net/rxrpc/net_ns.c b/net/rxrpc/net_ns.c
index 9a9834145e81..169116735366 100644
--- a/net/rxrpc/net_ns.c
+++ b/net/rxrpc/net_ns.c
@@ -97,10 +97,7 @@ static __net_init int rxrpc_init_net(struct net *net)
 	return ret;
 }
 
-/*
- * Clean up a per-network namespace record.
- */
-static __net_exit void rxrpc_exit_net(struct net *net)
+static __net_exit void rxrpc_pre_exit_net(struct net *net)
 {
 	struct rxrpc_net *rxnet = rxrpc_net(net);
 
@@ -111,14 +108,24 @@ static __net_exit void rxrpc_exit_net(struct net *net)
 	timer_delete_sync(&rxnet->peer_keepalive_timer);
 	rxrpc_destroy_all_calls(rxnet);
 	rxrpc_destroy_all_connections(rxnet);
+}
+
+/*
+ * Clean up a per-network namespace record.
+ */
+static __net_exit void rxrpc_exit_net(struct net *net)
+{
+	struct rxrpc_net *rxnet = rxrpc_net(net);
+
 	rxrpc_destroy_all_peers(rxnet);
 	rxrpc_destroy_all_locals(rxnet);
 	proc_remove(rxnet->proc_net);
 }
 
 struct pernet_operations rxrpc_net_ops = {
-	.init	= rxrpc_init_net,
-	.exit	= rxrpc_exit_net,
-	.id	= &rxrpc_net_id,
-	.size	= sizeof(struct rxrpc_net),
+	.init		= rxrpc_init_net,
+	.pre_exit	= rxrpc_pre_exit_net,
+	.exit		= rxrpc_exit_net,
+	.id		= &rxrpc_net_id,
+	.size		= sizeof(struct rxrpc_net),
 };
diff --git a/net/rxrpc/peer_object.c b/net/rxrpc/peer_object.c
index fa9a406e1168..faa2983638b2 100644
--- a/net/rxrpc/peer_object.c
+++ b/net/rxrpc/peer_object.c
@@ -454,6 +454,12 @@ void rxrpc_destroy_all_peers(struct rxrpc_net *rxnet)
 	struct rxrpc_peer *peer;
 	int i;
 
+	/*
+	 * Prevent use-after-free if a peer is concurrently unlinked from the
+	 * hash table and freed via RCU during iteration.
+	 */
+	spin_lock_bh(&rxnet->peer_hash_lock);
+
 	for (i = 0; i < HASH_SIZE(rxnet->peer_hash); i++) {
 		if (hlist_empty(&rxnet->peer_hash[i]))
 			continue;
@@ -465,6 +471,8 @@ void rxrpc_destroy_all_peers(struct rxrpc_net *rxnet)
 			       &peer->srx.transport);
 		}
 	}
+
+	spin_unlock_bh(&rxnet->peer_hash_lock);
 }
 
 /**
-- 
2.55.0.1003.g10538fe699-goog