Patch "rxrpc: Make it so that a waiting process can be aborted" has been added to the 6.2-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    rxrpc: Make it so that a waiting process can be aborted

to the 6.2-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     rxrpc-make-it-so-that-a-waiting-process-can-be-abort.patch
and it can be found in the queue-6.2 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit ef12ce381714f9476d3b2b2e4594ffbc110d64e5
Author: David Howells <dhowells@xxxxxxxxxx>
Date:   Fri Apr 28 21:27:55 2023 +0100

    rxrpc: Make it so that a waiting process can be aborted
    
    [ Upstream commit 0eb362d254814ce04848730bf32e75b8ee1a4d6c ]
    
    When sendmsg() creates an rxrpc call, it queues it to wait for a connection
    and channel to be assigned and then waits before it can start shovelling
    data as the encrypted DATA packet content includes a summary of the
    connection parameters.
    
    However, sendmsg() may get interrupted before a connection gets assigned
    and further sendmsg() calls will fail with EBUSY until an assignment is
    made.
    
    Fix this so that the call can at least be aborted without failing on
    EBUSY.  We have to be careful here as sendmsg() mustn't be allowed to start
    the call timer if the call doesn't yet have a connection assigned as an
    oops may follow shortly thereafter.
    
    Fixes: 540b1c48c37a ("rxrpc: Fix deadlock between call creation and sendmsg/recvmsg")
    Reported-by: Marc Dionne <marc.dionne@xxxxxxxxxxxx>
    Signed-off-by: David Howells <dhowells@xxxxxxxxxx>
    cc: "David S. Miller" <davem@xxxxxxxxxxxxx>
    cc: Eric Dumazet <edumazet@xxxxxxxxxx>
    cc: Jakub Kicinski <kuba@xxxxxxxxxx>
    cc: Paolo Abeni <pabeni@xxxxxxxxxx>
    cc: linux-afs@xxxxxxxxxxxxxxxxxxx
    cc: netdev@xxxxxxxxxxxxxxx
    cc: linux-kernel@xxxxxxxxxxxxxxx
    Signed-off-by: David S. Miller <davem@xxxxxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/net/rxrpc/sendmsg.c b/net/rxrpc/sendmsg.c
index 7498a77b5d397..c1b074c17b33e 100644
--- a/net/rxrpc/sendmsg.c
+++ b/net/rxrpc/sendmsg.c
@@ -656,10 +656,13 @@ int rxrpc_do_sendmsg(struct rxrpc_sock *rx, struct msghdr *msg, size_t len)
 			goto out_put_unlock;
 	} else {
 		switch (rxrpc_call_state(call)) {
-		case RXRPC_CALL_UNINITIALISED:
 		case RXRPC_CALL_CLIENT_AWAIT_CONN:
-		case RXRPC_CALL_SERVER_PREALLOC:
 		case RXRPC_CALL_SERVER_SECURING:
+			if (p.command == RXRPC_CMD_SEND_ABORT)
+				break;
+			fallthrough;
+		case RXRPC_CALL_UNINITIALISED:
+		case RXRPC_CALL_SERVER_PREALLOC:
 			rxrpc_put_call(call, rxrpc_call_put_sendmsg);
 			ret = -EBUSY;
 			goto error_release_sock;