tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

net/handshake: restore destructor on submit failure

handshake_req_submit() replaces sk->sk_destruct but never restores it when
submission fails before the request is hashed. handshake_sk_destruct() then
returns early and the original destructor never runs, leaking the socket.
Restore sk_destruct on the error path.

Fixes: 3b3009ea8abb ("net/handshake: Create a NETLINK service for handling handshake requests")
Reviewed-by: Chuck Lever <chuck.lever@oracle.com>
Cc: stable@vger.kernel.org
Signed-off-by: caoping <caoping@cmss.chinamobile.com>
Link: https://patch.msgid.link/20251204091058.1545151-1-caoping@cmss.chinamobile.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

authored by

caoping and committed by
Jakub Kicinski 6af2a01d 9e7477a4

+2
+2
net/handshake/request.c
··· 276 276 out_unlock: 277 277 spin_unlock(&hn->hn_lock); 278 278 out_err: 279 + /* Restore original destructor so socket teardown still runs on failure */ 280 + req->hr_sk->sk_destruct = req->hr_odestruct; 279 281 trace_handshake_submit_err(net, req, req->hr_sk, ret); 280 282 handshake_req_destroy(req); 281 283 return ret;