| Message ID | 168333403089.7813.511134747683134976.stgit@oracle-102.nfsv4bat.org (mailing list archive) |
|---|---|
| State | Superseded |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | Bug fixes for net/handshake | expand |
On Fri, May 05, 2023 at 08:47:13PM -0400, Chuck Lever wrote: > From: Chuck Lever <chuck.lever@oracle.com> > > If user space never calls DONE, sock->file's reference count remains > elevated. Enable sock->file to be freed eventually in this case. > > Reported-by: Jakub Kacinski <kuba@kernel.org> > Fixes: 3b3009ea8abb ("net/handshake: Create a NETLINK service for handling handshake requests") > Signed-off-by: Chuck Lever <chuck.lever@oracle.com> Reviewed-by: Simon Horman <simon.horman@corigine.com>
On Fri, May 05, 2023 at 08:47:13PM -0400, Chuck Lever wrote: > From: Chuck Lever <chuck.lever@oracle.com> > > If user space never calls DONE, sock->file's reference count remains > elevated. Enable sock->file to be freed eventually in this case. > > Reported-by: Jakub Kacinski <kuba@kernel.org> > Fixes: 3b3009ea8abb ("net/handshake: Create a NETLINK service for handling handshake requests") > Signed-off-by: Chuck Lever <chuck.lever@oracle.com> > --- > net/handshake/handshake.h | 1 + > net/handshake/request.c | 4 ++++ > 2 files changed, 5 insertions(+) > Thanks, Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
diff --git a/net/handshake/handshake.h b/net/handshake/handshake.h index 4dac965c99df..8aeaadca844f 100644 --- a/net/handshake/handshake.h +++ b/net/handshake/handshake.h @@ -31,6 +31,7 @@ struct handshake_req { struct list_head hr_list; struct rhash_head hr_rhash; unsigned long hr_flags; + struct file *hr_file; const struct handshake_proto *hr_proto; struct sock *hr_sk; void (*hr_odestruct)(struct sock *sk); diff --git a/net/handshake/request.c b/net/handshake/request.c index 94d5cef3e048..d78d41abb3d9 100644 --- a/net/handshake/request.c +++ b/net/handshake/request.c @@ -239,6 +239,7 @@ int handshake_req_submit(struct socket *sock, struct handshake_req *req, } req->hr_odestruct = req->hr_sk->sk_destruct; req->hr_sk->sk_destruct = handshake_sk_destruct; + req->hr_file = sock->file; ret = -EOPNOTSUPP; net = sock_net(req->hr_sk); @@ -334,6 +335,9 @@ bool handshake_req_cancel(struct sock *sk) return false; } + /* Request accepted and waiting for DONE */ + fput(req->hr_file); + out_true: trace_handshake_cancel(net, req, sk);