In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix potential data race in rxrpcwaittobeconnected() Inside the loop in rxrpcwaittobeconnected() it checks call->error to see if it should exit the loop without first checking the call state. This is probably safe as if call->error is set, the call is dead anyway, but we should probably wait for the call state to have been set to completion first, lest it cause surprise on the way out. Fix this by only accessing call->error if the call is complete. We don't actually need to access the error inside the loop as we'll do that after. This caused the following report: BUG: KCSAN: data-race in rxrpcsenddata / rxrpcsetcallcompletion write to 0xffff888159cf3c50 of 4 bytes by task 25673 on cpu 1: rxrpcsetcallcompletion+0x71/0x1c0 net/rxrpc/callstate.c:22 rxrpcsenddatapacket+0xba9/0x1650 net/rxrpc/output.c:479 rxrpctransmitone+0x1e/0x130 net/rxrpc/output.c:714 rxrpcdecantpreparedtx net/rxrpc/callevent.c:326 [inline] rxrpctransmitsomedata+0x496/0x600 net/rxrpc/callevent.c:350 rxrpcinputcallevent+0x564/0x1220 net/rxrpc/callevent.c:464 rxrpciothread+0x307/0x1d80 net/rxrpc/iothread.c:461 kthread+0x1ac/0x1e0 kernel/kthread.c:376 retfromfork+0x1f/0x30 arch/x86/entry/entry64.S:308 read to 0xffff888159cf3c50 of 4 bytes by task 25672 on cpu 0: rxrpcsenddata+0x29e/0x1950 net/rxrpc/sendmsg.c:296 rxrpcdosendmsg+0xb7a/0xc20 net/rxrpc/sendmsg.c:726 rxrpcsendmsg+0x413/0x520 net/rxrpc/afrxrpc.c:565 socksendmsgnosec net/socket.c:724 [inline] sock_sendmsg net/socket.c:747 [inline] ____sys_sendmsg+0x375/0x4c0 net/socket.c:2501 ___sys_sendmsg net/socket.c:2555 [inline] __sys_sendmmsg+0x263/0x500 net/socket.c:2641 __dosyssendmmsg net/socket.c:2670 [inline] __sesyssendmmsg net/socket.c:2667 [inline] __x64syssendmmsg+0x57/0x60 net/socket.c:2667 dosyscallx64 arch/x86/entry/common.c:50 [inline] dosyscall64+0x41/0xc0 arch/x86/entry/common.c:80 entrySYSCALL64afterhwframe+0x63/0xcd value changed: 0x00000000 -> 0xffffffea