CVE-2023-53345

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

rxrpc: Fix potential data race in rxrpc_wait_to_be_connected()

Inside the loop in rxrpc_wait_to_be_connected() it checks call->error to

see if it should exit the loop without first checking the call state. This

is probably safe as if call->error is set, the call is dead anyway, but we

should probably wait for the call state to have been set to completion

first, lest it cause surprise on the way out.

Fix this by only accessing call->error if the call is complete. We don't

actually need to access the error inside the loop as we'll do that after.

This caused the following report:

BUG: KCSAN: data-race in rxrpc_send_data / rxrpc_set_call_completion

write to 0xffff888159cf3c50 of 4 bytes by task 25673 on cpu 1:

rxrpc_set_call_completion+0x71/0x1c0 net/rxrpc/call_state.c:22

rxrpc_send_data_packet+0xba9/0x1650 net/rxrpc/output.c:479

rxrpc_transmit_one+0x1e/0x130 net/rxrpc/output.c:714

rxrpc

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References