From: David Howells <dhowells@redhat.com>
To: netdev@vger.kernel.org
Cc: David Howells <dhowells@redhat.com>,
Marc Dionne <marc.dionne@auristor.com>,
Jakub Kicinski <kuba@kernel.org>,
"David S. Miller" <davem@davemloft.net>,
Eric Dumazet <edumazet@google.com>,
Paolo Abeni <pabeni@redhat.com>, Simon Horman <horms@kernel.org>,
linux-afs@lists.infradead.org, linux-kernel@vger.kernel.org,
Li Daming <d4n.for.sec@gmail.com>, Ren Wei <n05ec@lzu.edu.cn>,
Jeffrey Altman <jaltman@auristor.com>,
stable@kernel.org
Subject: [PATCH net v3 04/11] afs: Fix further netns teardown to cancel the preallocation charger
Date: Wed, 24 Jun 2026 17:38:11 +0100 [thread overview]
Message-ID: <20260624163819.3017002-5-dhowells@redhat.com> (raw)
In-Reply-To: <20260624163819.3017002-1-dhowells@redhat.com>
When an afs network namespace is torn down, it cancels and waits for the
work item that keeps the preallocated rxrpc call/conn/peer queue charged
before disabling incoming (i.e. listen 0), but there's a small window in
which it can be requeued by an incoming call wending through the I/O
thread.
Fix this by cancelling the charger work item again after reducing the
listen backlog to zero.
Fixes: 47694fbc9d24 ("afs: Fix netns teardown to cancel the preallocation charger")
Reported-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: David Howells <dhowells@redhat.com>
Link: https://sashiko.dev/#/patchset/20260609140911.838677-1-dhowells%40redhat.com
cc: Li Daming <d4n.for.sec@gmail.com>
cc: Ren Wei <n05ec@lzu.edu.cn>
cc: Marc Dionne <marc.dionne@auristor.com>
cc: Jeffrey Altman <jaltman@auristor.com>
cc: Eric Dumazet <edumazet@google.com>
cc: "David S. Miller" <davem@davemloft.net>
cc: Paolo Abeni <pabeni@redhat.com>
cc: Simon Horman <horms@kernel.org>
cc: linux-afs@lists.infradead.org
cc: stable@kernel.org
---
fs/afs/rxrpc.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/fs/afs/rxrpc.c b/fs/afs/rxrpc.c
index d5cfd24e815b..6714a189d58f 100644
--- a/fs/afs/rxrpc.c
+++ b/fs/afs/rxrpc.c
@@ -128,8 +128,13 @@ void afs_close_socket(struct afs_net *net)
_enter("");
cancel_work_sync(&net->charge_preallocation_work);
+ /* Future work items should now see ->live is false. */
+
kernel_listen(net->socket, 0);
+
+ /* Make sure work items are no longer running. */
flush_workqueue(afs_async_calls);
+ cancel_work_sync(&net->charge_preallocation_work);
if (net->spare_incoming_call) {
afs_put_call(net->spare_incoming_call);
next prev parent reply other threads:[~2026-06-24 16:38 UTC|newest]
Thread overview: 14+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-06-24 16:38 [PATCH net v3 00/11] rxrpc: Miscellaneous fixes David Howells
2026-06-24 16:38 ` [PATCH net v3 01/11] rxrpc: Fix ACKALL packet handling David Howells
2026-06-25 3:31 ` Jeffrey E Altman
2026-06-24 16:38 ` [PATCH net v3 02/11] rxrpc: Fix leak of connection from OOB challenge David Howells
2026-06-24 16:38 ` [PATCH net v3 03/11] rxrpc: Fix double unlock in rxrpc_recvmsg() David Howells
2026-06-24 16:38 ` David Howells [this message]
2026-06-24 16:38 ` [PATCH net v3 05/11] afs: Fix uncancelled rxrpc OOB message handler David Howells
2026-06-24 16:38 ` [PATCH net v3 06/11] rxrpc: Fix the reception of a reply packet before data transmission David Howells
2026-06-24 16:38 ` [PATCH net v3 07/11] rxrpc: Fix oob challenge leak in cleanup after notification failure David Howells
2026-06-24 16:38 ` [PATCH net v3 08/11] rxrpc: Fix potential infinite loop in rxrpc_recvmsg() David Howells
2026-06-24 16:38 ` [PATCH net v3 09/11] rxrpc: Fix socket notification race David Howells
2026-06-24 16:38 ` [PATCH net v3 10/11] rxrpc: Fix leak of released call in recvmsg(MSG_PEEK) David Howells
2026-06-24 16:38 ` [PATCH net v3 11/11] rxrpc: Fix rxrpc_rotate_tx_rotate() to check there's something to rotate David Howells
2026-06-26 2:31 ` [PATCH net v3 00/11] rxrpc: Miscellaneous fixes patchwork-bot+netdevbpf
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260624163819.3017002-5-dhowells@redhat.com \
--to=dhowells@redhat.com \
--cc=d4n.for.sec@gmail.com \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=horms@kernel.org \
--cc=jaltman@auristor.com \
--cc=kuba@kernel.org \
--cc=linux-afs@lists.infradead.org \
--cc=linux-kernel@vger.kernel.org \
--cc=marc.dionne@auristor.com \
--cc=n05ec@lzu.edu.cn \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=stable@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.