CVE-2025-21809: rxrpc, afs: Fix peer hash locking vs RCU callback

In the Linux kernel, the following vulnerability has been resolved:

rxrpc, afs: Fix peer hash locking vs RCU callback

In its address list, afs now retains pointers to and refs on one or more rxrpcpeer objects. The address list is freed under RCU and at this time, it puts the refs on those peers.

Now, when an rxrpcpeer object runs out of refs, it gets removed from the peer hash table and, for that, rxrpc has to take a spinlock. However, it is now being called from afs's RCU cleanup, which takes place in BH context - but it is just taking an ordinary spinlock.

The put may also be called from non-BH context, and so there exists the possibility of deadlock if the BH-based RCU cleanup happens whilst the hash spinlock is held. This led to the attached lockdep complaint.

Fix this by changing spinlocks of rxnet->peerhashlock back to BH-disabling locks.

================================ WARNING: inconsistent lock state 6.13.0-rc5-build2+ #1223 Tainted: G E -------------------------------- inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage. swapper/1/0 [HC0[0]:SC1[1]:HE1:SE0] takes: ffff88810babe228 (&rxnet->peerhashlock){+.?.}-{3:3}, at: rxrpcputpeer+0xcb/0x180 {SOFTIRQ-ON-W} state was registered at: markusage+0x164/0x180 lockacquire+0x544/0x990 lockacquire.part.0+0x103/0x280 rawspinlock+0x2f/0x40 rxrpcpeerkeepaliveworker+0x144/0x440 processonework+0x486/0x7c0 processscheduledworks+0x73/0x90 workerthread+0x1c8/0x2a0 kthread+0x19b/0x1b0 retfromfork+0x24/0x40 retfromforkasm+0x1a/0x30 irq event stamp: 972402 hardirqs last enabled at (972402): [<ffffffff8244360e>] rawspinunlockirqrestore+0x2e/0x50 hardirqs last disabled at (972401): [<ffffffff82443328>] rawspinlockirqsave+0x18/0x60 softirqs last enabled at (972300): [<ffffffff810ffbbe>] handlesoftirqs+0x3ee/0x430 softirqs last disabled at (972313): [<ffffffff810ffc54>] irqexitrcu+0x44/0x110

other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(&rxnet->peerhashlock); <Interrupt> lock(&rxnet->peerhashlock);

DEADLOCK 1 lock held by swapper/1/0: #0: ffffffff83576be0 (rcucallback){....}-{0:0}, at: rculockacquire+0x7/0x30

stack backtrace: CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Tainted: G E 6.13.0-rc5-build2+ #1223 Tainted: [E]=UNSIGNEDMODULE Hardware name: ASUS All Series/H97-PLUS, BIOS 2306 10/09/2014 Call Trace: <IRQ> dumpstacklvl+0x57/0x80 printusagebug.part.0+0x227/0x240 validstate+0x53/0x70 marklockirq+0xa5/0x2f0 marklock+0xf7/0x170 markusage+0xe1/0x180 lockacquire+0x544/0x990 lockacquire.part.0+0x103/0x280 rawspinlock+0x2f/0x40 rxrpcputpeer+0xcb/0x180 afsfreeaddrlist+0x46/0x90 [kafs] rcudobatch+0x2d2/0x640 rcucore+0x2f7/0x350 handlesoftirqs+0x1ee/0x430 irqexitrcu+0x44/0x110 irqexitrcu+0xa/0x30 sysvecapictimerinterrupt+0x7f/0xa0 </IRQ>