[PATCH v5 08/12] rxrpc: Release conn->key when init_connection_security() fails

[Jarkko Sakkinen]

Clear conn->key before calling key_put() when init_connection_security()
fails, and pair with READ_ONCE() in rxrpc_connection_seq_show().

Fixes: 17926a79320a ("[AF_RXRPC]: Provide secure RxRPC sockets for use by userspace and kernel both")
Signed-off-by: Jarkko Sakkinen <jarkko at kernel.org>
---
 net/rxrpc/conn_event.c | 7 ++++++-
 net/rxrpc/proc.c       | 2 +-
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/net/rxrpc/conn_event.c b/net/rxrpc/conn_event.c
index 611c790bc6d0..096807f13354 100644
--- a/net/rxrpc/conn_event.c
+++ b/net/rxrpc/conn_event.c
@@ -298,8 +298,13 @@ static int rxrpc_process_event(struct rxrpc_connection *conn,
 
 		ret = conn->security->init_connection_security(
 			conn, conn->key->payload.data[0]);
-		if (ret < 0)
+		if (ret < 0) {
+			struct key *key = conn->key;
+
+			WRITE_ONCE(conn->key, NULL);
+			key_put(key);
 			return ret;
+		}
 
 		spin_lock_irq(&conn->state_lock);
 		if (conn->state == RXRPC_CONN_SERVICE_CHALLENGING) {
diff --git a/net/rxrpc/proc.c b/net/rxrpc/proc.c
index e9a27fa7b25d..2bf34b85c2f9 100644
--- a/net/rxrpc/proc.c
+++ b/net/rxrpc/proc.c
@@ -182,7 +182,7 @@ static int rxrpc_connection_seq_show(struct seq_file *seq, void *v)
 		   refcount_read(&conn->ref),
 		   atomic_read(&conn->active),
 		   state,
-		   key_serial(conn->key),
+		   key_serial(READ_ONCE(conn->key)),
 		   conn->tx_serial,
 		   conn->hi_serial,
 		   conn->channels[0].call_id,
-- 
2.47.3