Patch "net/handshake: fix file ref count in handshake_nl_accept_doit()" has been added to the 6.5-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    net/handshake: fix file ref count in handshake_nl_accept_doit()

to the 6.5-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     net-handshake-fix-file-ref-count-in-handshake_nl_acc.patch
and it can be found in the queue-6.5 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 2c307fd167276a5b7ca5df018f7e2dd808f9e723
Author: Moritz Wanzenböck <moritz.wanzenboeck@xxxxxxxxxx>
Date:   Thu Oct 19 14:58:47 2023 +0200

    net/handshake: fix file ref count in handshake_nl_accept_doit()
    
    [ Upstream commit 7798b59409c345d4a6034a4326bceb9f7e2e8b58 ]
    
    If req->hr_proto->hp_accept() fail, we call fput() twice:
    Once in the error path, but also a second time because sock->file
    is at that point already associated with the file descriptor. Once
    the task exits, as it would probably do after receiving an error
    reading from netlink, the fd is closed, calling fput() a second time.
    
    To fix, we move installing the file after the error path for the
    hp_accept() call. In the case of errors we simply put the unused fd.
    In case of success we can use fd_install() to link the sock->file
    to the reserved fd.
    
    Fixes: 7ea9c1ec66bc ("net/handshake: Fix handshake_dup() ref counting")
    Signed-off-by: Moritz Wanzenböck <moritz.wanzenboeck@xxxxxxxxxx>
    Reviewed-by: Chuck Lever <chuck.lever@xxxxxxxxxx>
    Link: https://lore.kernel.org/r/20231019125847.276443-1-moritz.wanzenboeck@xxxxxxxxxx
    Signed-off-by: Jakub Kicinski <kuba@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/net/handshake/netlink.c b/net/handshake/netlink.c
index d0bc1dd8e65a8..80c7302692c74 100644
--- a/net/handshake/netlink.c
+++ b/net/handshake/netlink.c
@@ -87,29 +87,6 @@ struct nlmsghdr *handshake_genl_put(struct sk_buff *msg,
 }
 EXPORT_SYMBOL(handshake_genl_put);
 
-/*
- * dup() a kernel socket for use as a user space file descriptor
- * in the current process. The kernel socket must have an
- * instatiated struct file.
- *
- * Implicit argument: "current()"
- */
-static int handshake_dup(struct socket *sock)
-{
-	struct file *file;
-	int newfd;
-
-	file = get_file(sock->file);
-	newfd = get_unused_fd_flags(O_CLOEXEC);
-	if (newfd < 0) {
-		fput(file);
-		return newfd;
-	}
-
-	fd_install(newfd, file);
-	return newfd;
-}
-
 int handshake_nl_accept_doit(struct sk_buff *skb, struct genl_info *info)
 {
 	struct net *net = sock_net(skb->sk);
@@ -133,17 +110,20 @@ int handshake_nl_accept_doit(struct sk_buff *skb, struct genl_info *info)
 		goto out_status;
 
 	sock = req->hr_sk->sk_socket;
-	fd = handshake_dup(sock);
+	fd = get_unused_fd_flags(O_CLOEXEC);
 	if (fd < 0) {
 		err = fd;
 		goto out_complete;
 	}
+
 	err = req->hr_proto->hp_accept(req, info, fd);
 	if (err) {
-		fput(sock->file);
+		put_unused_fd(fd);
 		goto out_complete;
 	}
 
+	fd_install(fd, get_file(sock->file));
+
 	trace_handshake_cmd_accept(net, req, req->hr_sk, fd);
 	return 0;