mirror of
https://mirrors.bfsu.edu.cn/git/linux.git
synced 2024-12-26 04:25:27 +08:00
net/handshake: Unpin sock->file if a handshake is cancelled
If user space never calls DONE, sock->file's reference count remains
elevated. Enable sock->file to be freed eventually in this case.
Reported-by: Jakub Kacinski <kuba@kernel.org>
Fixes: 3b3009ea8a
("net/handshake: Create a NETLINK service for handling handshake requests")
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
parent
e36a93e172
commit
f921bd4100
@ -31,6 +31,7 @@ struct handshake_req {
|
||||
struct list_head hr_list;
|
||||
struct rhash_head hr_rhash;
|
||||
unsigned long hr_flags;
|
||||
struct file *hr_file;
|
||||
const struct handshake_proto *hr_proto;
|
||||
struct sock *hr_sk;
|
||||
void (*hr_odestruct)(struct sock *sk);
|
||||
|
@ -239,6 +239,7 @@ int handshake_req_submit(struct socket *sock, struct handshake_req *req,
|
||||
}
|
||||
req->hr_odestruct = req->hr_sk->sk_destruct;
|
||||
req->hr_sk->sk_destruct = handshake_sk_destruct;
|
||||
req->hr_file = sock->file;
|
||||
|
||||
ret = -EOPNOTSUPP;
|
||||
net = sock_net(req->hr_sk);
|
||||
@ -334,6 +335,9 @@ bool handshake_req_cancel(struct sock *sk)
|
||||
return false;
|
||||
}
|
||||
|
||||
/* Request accepted and waiting for DONE */
|
||||
fput(req->hr_file);
|
||||
|
||||
out_true:
|
||||
trace_handshake_cancel(net, req, sk);
|
||||
|
||||
|
Loading…
Reference in New Issue
Block a user