+++ /dev/null
-From 98161e706afb453d29111787f4365b1e6d7b3d4f Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 11 May 2023 11:49:17 -0400
-Subject: net/handshake: Unpin sock->file if a handshake is cancelled
-
-From: Chuck Lever <chuck.lever@oracle.com>
-
-[ Upstream commit f921bd41001ccff2249f5f443f2917f7ef937daf ]
-
-If user space never calls DONE, sock->file's reference count remains
-elevated. Enable sock->file to be freed eventually in this case.
-
-Reported-by: Jakub Kacinski <kuba@kernel.org>
-Fixes: 3b3009ea8abb ("net/handshake: Create a NETLINK service for handling handshake requests")
-Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
-Signed-off-by: David S. Miller <davem@davemloft.net>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- net/handshake/handshake.h | 1 +
- net/handshake/request.c | 4 ++++
- 2 files changed, 5 insertions(+)
-
-diff --git a/net/handshake/handshake.h b/net/handshake/handshake.h
-index 4dac965c99df0..8aeaadca844fd 100644
---- a/net/handshake/handshake.h
-+++ b/net/handshake/handshake.h
-@@ -31,6 +31,7 @@ struct handshake_req {
- struct list_head hr_list;
- struct rhash_head hr_rhash;
- unsigned long hr_flags;
-+ struct file *hr_file;
- const struct handshake_proto *hr_proto;
- struct sock *hr_sk;
- void (*hr_odestruct)(struct sock *sk);
-diff --git a/net/handshake/request.c b/net/handshake/request.c
-index 94d5cef3e048b..d78d41abb3d99 100644
---- a/net/handshake/request.c
-+++ b/net/handshake/request.c
-@@ -239,6 +239,7 @@ int handshake_req_submit(struct socket *sock, struct handshake_req *req,
- }
- req->hr_odestruct = req->hr_sk->sk_destruct;
- req->hr_sk->sk_destruct = handshake_sk_destruct;
-+ req->hr_file = sock->file;
-
- ret = -EOPNOTSUPP;
- net = sock_net(req->hr_sk);
-@@ -334,6 +335,9 @@ bool handshake_req_cancel(struct sock *sk)
- return false;
- }
-
-+ /* Request accepted and waiting for DONE */
-+ fput(req->hr_file);
-+
- out_true:
- trace_handshake_cancel(net, req, sk);
-
---
-2.39.2
-