Executive brief
The Linux kernel's RDS (Reliable Datagram Sockets) networking module contains a deadlock vulnerability where socket locking was incorrectly held during work cancellation in the TCP reset handler. This can cause the system to hang or become unresponsive when RDS connections are reset, impacting network availability for applications relying on RDS communication.
Technical details
The vulnerability is a deadlock condition in the RDS TCP module's rds_tcp_reset_callbacks() function. The root cause is that cancel_delayed_work_sync() was being called while holding a socket lock (lock_sock()), and the work being cancelled (rds_send_xmit) might also attempt to acquire the same socket lock, creating a circular lock dependency. This triggers a lockdep warning and potential system hang. The fix moves the cancel_delayed_work_sync() calls outside the lock_sock() protected region, as the work cancellation does not require socket protection—even if work is re-queued after cancellation begins, it will be a no-op due to the connection state having been set to RDS_CONN_RESETTING. The patch was accepted upstream and backported to stable kernel branches.
Affected products
- Linux Linux kernel multiple versions with RDS TCP support (5.x through 6.x branches)
Timeline
- 2022-09-29: disclosed: Vulnerability reported by syzbot
- 2022-10-26: patched: Fix committed to stable kernel tree