[PATCH net v4 15/15] rxrpc: fix reference count leak in rxrpc_server_keyring()

[Anderson Nascimento]

On 4/1/26 7:56 AM, David Howells wrote:
> From: Luxiao Xu <rakukuip at gmail.com>
>
> This patch fixes a reference count leak in rxrpc_server_keyring()
> by checking if rx->securities is already set.
>
> Fixes: 17926a79320a ("[AF_RXRPC]: Provide secure RxRPC sockets for use by userspace and kernel both")
> Reported-by: Yifan Wu <yifanwucs at gmail.com>
> Reported-by: Juefei Pu <tomapufckgml at gmail.com>
> Co-developed-by: Yuan Tan <yuantan098 at gmail.com>
> Signed-off-by: Yuan Tan <yuantan098 at gmail.com>
> Suggested-by: Xin Liu <bird at lzu.edu.cn>
> Tested-by: Ren Wei <enjou1224z at gmail.com>
> Signed-off-by: Luxiao Xu <rakukuip at gmail.com>
> Signed-off-by: Ren Wei <n05ec at lzu.edu.cn>
> Signed-off-by: David Howells <dhowells at redhat.com>
> cc: Marc Dionne <marc.dionne at auristor.com>
> cc: Eric Dumazet <edumazet at google.com>
> cc: "David S. Miller" <davem at davemloft.net>
> cc: Jakub Kicinski <kuba at kernel.org>
> cc: Paolo Abeni <pabeni at redhat.com>
> cc: Simon Horman <horms at kernel.org>
> cc: linux-afs at lists.infradead.org
> cc: netdev at vger.kernel.org
> cc: stable at kernel.org
> ---
>   net/rxrpc/server_key.c | 3 +++
>   1 file changed, 3 insertions(+)
>
> diff --git a/net/rxrpc/server_key.c b/net/rxrpc/server_key.c
> index 36b05fd842a7..d4777851079f 100644
> --- a/net/rxrpc/server_key.c
> +++ b/net/rxrpc/server_key.c
> @@ -125,6 +125,9 @@ int rxrpc_server_keyring(struct rxrpc_sock *rx, sockptr_t optval, int optlen)
>   
>   	_enter("");
>   
> +	if (rx->securities)
> +		return -EEXIST;
> +
>   	if (optlen <= 0 || optlen > PAGE_SIZE - 1)
>   		return -EINVAL;
>   
>
Isn't this the same issue addressed by my patch "[PATCH net v4 08/15] 
rxrpc: Fix keyring reference count leak in rxrpc_setsockopt()"? Just 
asking to make sure this is intended.

--
Anderson Nascimento
Allele Security Intelligence
https://www.allelesecurity.com