[PATCH net] rxrpc: Serialize client connection IDR updates

[Chengfeng Ye]

Client connection allocation runs in the local endpoint's I/O thread,
but the final connection reference can be dropped by another thread.
Connection cleanup then calls rxrpc_put_client_connection_id() directly
or from a workqueue, without synchronizing with the I/O thread.

The I/O thread can be traversing or updating local->conn_ids in
idr_alloc_cyclic() while a cleanup worker calls idr_remove() on the same
IDR. The removal can change or retire a radix-tree node still being used
by the allocator. Concurrent removals are also possible. These
unsynchronized updates can corrupt the IDR and crash the kernel.

KCSAN reported:

  BUG: KCSAN: data-race in node_tag_clear / radix_tree_delete_item

  read (marked) to 0xffff9d03804b9fd0 of 8 bytes by task 109 on cpu 1:
   radix_tree_delete_item+0x132/0x160
   idr_remove+0x32/0x50
   rxrpc_put_client_connection_id+0x53/0xe0
   rxrpc_kill_client_conn+0x7d/0x190
   rxrpc_clean_up_connection+0x193/0x370
   rxrpc_put_connection+0x3d9/0x3e0
   rxrpc_destroy_call+0x192/0x2e0
   process_one_work+0x325/0x710
   worker_thread+0x31d/0x5c0

  write to 0xffff9d03804b9fd0 of 8 bytes by task 97 on cpu 0:
   node_tag_clear+0x7a/0x110
   radix_tree_iter_tag_clear+0x47/0x60
   idr_alloc_u32+0x13e/0x1a0
   idr_alloc_cyclic+0x7a/0xf0
   rxrpc_connect_client_calls+0x375/0xa40
   rxrpc_io_thread+0x79c/0xe20

Serialize allocation and removal with the IDR's existing lock. Both
paths run in process context and allocation already uses GFP_ATOMIC,
so no additional lock or allocation changes are needed. RCU-protected
lookups remain unchanged.

Fixes: 9d35d880e0e4 ("rxrpc: Move client call connection to the I/O thread")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Chengfeng Ye <nicoyip.dev@xxxxxxxxx>
---
 net/rxrpc/conn_client.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/net/rxrpc/conn_client.c b/net/rxrpc/conn_client.c
index 48519f0de185..93e08a13a236 100644
--- a/net/rxrpc/conn_client.c
+++ b/net/rxrpc/conn_client.c
@@ -45,7 +45,9 @@ static void rxrpc_activate_bundle(struct rxrpc_bundle *bundle)
 static void rxrpc_put_client_connection_id(struct rxrpc_local *local,
 					   struct rxrpc_connection *conn)
 {
+	idr_lock(&local->conn_ids);
 	idr_remove(&local->conn_ids, conn->proto.cid >> RXRPC_CIDSHIFT);
+	idr_unlock(&local->conn_ids);
 }
 
 /*
@@ -162,8 +164,10 @@ rxrpc_alloc_client_connection(struct rxrpc_bundle *bundle)
 	if (!conn)
 		return ERR_PTR(-ENOMEM);
 
+	idr_lock(&local->conn_ids);
 	id = idr_alloc_cyclic(&local->conn_ids, conn, 1, 0x40000000,
 			      GFP_ATOMIC | __GFP_NOWARN);
+	idr_unlock(&local->conn_ids);
 	if (id < 0) {
 		kfree(conn);
 		return ERR_PTR(id);
-- 
2.43.0