linux/Documentation
David Howells e0416e7d33 rxrpc: Fix potential race in error handling in afs_make_call()
If the rxrpc call set up by afs_make_call() receives an error whilst it is
transmitting the request, there's the possibility that it may get to the
point the rxrpc call is ended (after the error_kill_call label) just as the
call is queued for async processing.

This could manifest itself as call->rxcall being seen as NULL in
afs_deliver_to_call() when it tries to lock the call.

Fix this by splitting rxrpc_kernel_end_call() into a function to shut down
an rxrpc call and a function to release the caller's reference and calling
the latter only when we get to afs_put_call().

Reported-by: Jeffrey Altman <jaltman@auristor.com>
Signed-off-by: David Howells <dhowells@redhat.com>
Tested-by: kafs-testing+fedora36_64checkkafs-build-306@auristor.com
cc: Marc Dionne <marc.dionne@auristor.com>
cc: "David S. Miller" <davem@davemloft.net>
cc: Eric Dumazet <edumazet@google.com>
cc: Jakub Kicinski <kuba@kernel.org>
cc: Paolo Abeni <pabeni@redhat.com>
cc: linux-afs@lists.infradead.org
cc: netdev@vger.kernel.org
Signed-off-by: David S. Miller <davem@davemloft.net>
2023-04-22 15:16:39 +01:00
..
2023-02-21 15:27:48 -08:00
2023-03-14 11:31:57 -06:00
2023-01-30 16:40:15 +01:00
2023-02-22 18:28:03 -08:00
2023-02-15 20:59:44 +01:00
2023-02-23 15:09:31 -08:00
2023-04-05 18:06:23 -07:00
2023-04-02 10:10:16 -07:00
2023-02-25 11:52:57 -08:00
2023-02-22 13:41:41 -08:00
2023-01-27 12:14:17 +00:00
2023-01-26 12:43:33 +09:00