Thread (1 message) 1 message, 1 author, 2026-03-30
DORMANTno replies REVIEWED: 1 (0M)

1 review trailer.

[PATCH 1/1] rxrpc: fix reference count leak in rxrpc_server_keyring()

From: Ren Wei <hidden>
Date: 2026-03-30 04:03:12
Also in: lkml
Subsystem: networking [general], rxrpc sockets (af_rxrpc), the rest · Maintainers: "David S. Miller", Eric Dumazet, Jakub Kicinski, Paolo Abeni, David Howells, Marc Dionne, Linus Torvalds

From: Luxiao Xu <redacted>

This patch fixes a reference count leak in rxrpc_server_keyring()
by checking if rx->securities is already set.

Fixes: 17926a79320a ("[AF_RXRPC]: Provide secure RxRPC sockets for use by userspace and kernel both")
Reported-by: Yifan Wu <redacted>
Reported-by: Juefei Pu <redacted>
Co-developed-by: Yuan Tan <redacted>
Signed-off-by: Yuan Tan <redacted>
Suggested-by: Xin Liu <redacted>
Tested-by: Ren Wei <redacted>
Signed-off-by: Luxiao Xu <redacted>
Signed-off-by: Ren Wei <redacted>
---
 net/rxrpc/server_key.c | 3 +++
 1 file changed, 3 insertions(+)
diff --git a/net/rxrpc/server_key.c b/net/rxrpc/server_key.c
index 36b05fd842a7..d4777851079f 100644
--- a/net/rxrpc/server_key.c
+++ b/net/rxrpc/server_key.c
@@ -125,6 +125,9 @@ int rxrpc_server_keyring(struct rxrpc_sock *rx, sockptr_t optval, int optlen)
 
 	_enter("");
 
+	if (rx->securities)
+		return -EEXIST;
+
 	if (optlen <= 0 || optlen > PAGE_SIZE - 1)
 		return -EINVAL;
 
-- 
2.43.0
Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help