Patch "net/handshake: Unpin sock->file if a handshake is cancelled" has been added to the 6.4-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    net/handshake: Unpin sock->file if a handshake is cancelled

to the 6.4-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     net-handshake-unpin-sock-file-if-a-handshake-is-canc.patch
and it can be found in the queue-6.4 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 98161e706afb453d29111787f4365b1e6d7b3d4f
Author: Chuck Lever <chuck.lever@xxxxxxxxxx>
Date:   Thu May 11 11:49:17 2023 -0400

    net/handshake: Unpin sock->file if a handshake is cancelled
    
    [ Upstream commit f921bd41001ccff2249f5f443f2917f7ef937daf ]
    
    If user space never calls DONE, sock->file's reference count remains
    elevated. Enable sock->file to be freed eventually in this case.
    
    Reported-by: Jakub Kacinski <kuba@xxxxxxxxxx>
    Fixes: 3b3009ea8abb ("net/handshake: Create a NETLINK service for handling handshake requests")
    Signed-off-by: Chuck Lever <chuck.lever@xxxxxxxxxx>
    Signed-off-by: David S. Miller <davem@xxxxxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/net/handshake/handshake.h b/net/handshake/handshake.h
index 4dac965c99df0..8aeaadca844fd 100644
--- a/net/handshake/handshake.h
+++ b/net/handshake/handshake.h
@@ -31,6 +31,7 @@ struct handshake_req {
 	struct list_head		hr_list;
 	struct rhash_head		hr_rhash;
 	unsigned long			hr_flags;
+	struct file			*hr_file;
 	const struct handshake_proto	*hr_proto;
 	struct sock			*hr_sk;
 	void				(*hr_odestruct)(struct sock *sk);
diff --git a/net/handshake/request.c b/net/handshake/request.c
index 94d5cef3e048b..d78d41abb3d99 100644
--- a/net/handshake/request.c
+++ b/net/handshake/request.c
@@ -239,6 +239,7 @@ int handshake_req_submit(struct socket *sock, struct handshake_req *req,
 	}
 	req->hr_odestruct = req->hr_sk->sk_destruct;
 	req->hr_sk->sk_destruct = handshake_sk_destruct;
+	req->hr_file = sock->file;
 
 	ret = -EOPNOTSUPP;
 	net = sock_net(req->hr_sk);
@@ -334,6 +335,9 @@ bool handshake_req_cancel(struct sock *sk)
 		return false;
 	}
 
+	/* Request accepted and waiting for DONE */
+	fput(req->hr_file);
+
 out_true:
 	trace_handshake_cancel(net, req, sk);