Commit 6af2a01d authored by caoping's avatar caoping Committed by Jakub Kicinski
Browse files

net/handshake: restore destructor on submit failure 



handshake_req_submit() replaces sk->sk_destruct but never restores it when
submission fails before the request is hashed. handshake_sk_destruct() then
returns early and the original destructor never runs, leaking the socket.
Restore sk_destruct on the error path.

Fixes: 3b3009ea ("net/handshake: Create a NETLINK service for handling handshake requests")
Reviewed-by: default avatarChuck Lever <chuck.lever@oracle.com>
Cc: stable@vger.kernel.org
Signed-off-by: default avatarcaoping <caoping@cmss.chinamobile.com>
Link: https://patch.msgid.link/20251204091058.1545151-1-caoping@cmss.chinamobile.com


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parent 9e7477a4

net/handshake/request.c

+2 −0
Original line number Diff line number Diff line
@@ -276,6 +276,8 @@ int handshake_req_submit(struct socket *sock, struct handshake_req *req, 
out_unlock:

	spin_unlock(&hn->hn_lock);

out_err:

	/* Restore original destructor so socket teardown still runs on failure */

	req->hr_sk->sk_destruct = req->hr_odestruct;

	trace_handshake_submit_err(net, req, req->hr_sk, ret);

	handshake_req_destroy(req);

	return ret;