Commit f125846e authored Apr 08, 2026 by Luxiao Xu Committed by Jakub Kicinski Apr 08, 2026

rxrpc: fix reference count leak in rxrpc_server_keyring()



This patch fixes a reference count leak in rxrpc_server_keyring()
by checking if rx->securities is already set.

Fixes: 17926a79 ("[AF_RXRPC]: Provide secure RxRPC sockets for use by userspace and kernel both")
Reported-by: Yifan Wu <yifanwucs@gmail.com>
Reported-by: Juefei Pu <tomapufckgml@gmail.com>
Co-developed-by: Yuan Tan <yuantan098@gmail.com>
Signed-off-by: Yuan Tan <yuantan098@gmail.com>
Suggested-by: Xin Liu <bird@lzu.edu.cn>
Tested-by: Ren Wei <enjou1224z@gmail.com>
Signed-off-by: Luxiao Xu <rakukuip@gmail.com>
Signed-off-by: Ren Wei <n05ec@lzu.edu.cn>
Signed-off-by: David Howells <dhowells@redhat.com>
cc: Marc Dionne <marc.dionne@auristor.com>
cc: Simon Horman <horms@kernel.org>
cc: linux-afs@lists.infradead.org
cc: stable@kernel.org
Link: https://patch.msgid.link/20260408121252.2249051-15-dhowells@redhat.com


Signed-off-by: Jakub Kicinski <kuba@kernel.org>

parent a2567217

net/rxrpc/server_key.c

+3 −0

Original line number	Diff line number	Diff line
		@@ -125,6 +125,9 @@ int rxrpc_server_keyring(struct rxrpc_sock *rx, sockptr_t optval, int optlen)

		_enter("");

		if (rx->securities)
		return -EINVAL;

		if (optlen <= 0 \|\| optlen > PAGE_SIZE - 1)
		return -EINVAL;