[PATCH net v11 1/5] rxrpc: release challenge reference after aborted event

[Zihan Xi]

A queued CHALLENGE holds a connection reference in sp->chall.conn.
When rxrpc_process_event() sees an already-aborted connection, it returns
before the CHALLENGE case releases that reference. Drop it after event
processing if the pointer is still set; the normal CHALLENGE path clears
the pointer when it releases the reference.

The leak was identified during AI-assisted review of the receive-queue
lifetime.

Fixes: 5800b1cf3fd8 ("rxrpc: Allow CHALLENGEs to the passed to the app for a RESPONSE")
Cc: stable at vger.kernel.org
Link: https://lore.kernel.org/all/cover.1792168462.git.zihanx@nebusec.ai/
Reported-by: Vega <vega at nebusec.ai>
Assisted-by: LLM
Co-developed-by: Luxing Yin <root at tr0jan.top>
Signed-off-by: Luxing Yin <root at tr0jan.top>
Signed-off-by: Zihan Xi <zihanx at nebusec.ai>
---
changes in v11:
  - Split aborted-connection CHALLENGE reference cleanup into a standalone
    patch.
  - v10 Link: https://lore.kernel.org/all/cover.1792168462.git.zihanx@nebusec.ai/
---
 net/rxrpc/conn_event.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/net/rxrpc/conn_event.c b/net/rxrpc/conn_event.c
index 611c790bc6d0c..02e9b18ee534d 100644
--- a/net/rxrpc/conn_event.c
+++ b/net/rxrpc/conn_event.c
@@ -391,8 +391,15 @@ static void rxrpc_do_process_connection(struct rxrpc_connection *conn)
 	/* go through the conn-level event packets, releasing the ref on this
 	 * connection that each one has when we've finished with it */
 	while ((skb = skb_dequeue(&conn->rx_queue))) {
+		struct rxrpc_skb_priv *sp = rxrpc_skb(skb);
+
 		rxrpc_see_skb(skb, rxrpc_skb_see_conn_work);
 		rxrpc_process_event(conn, skb);
+		if (sp->hdr.type == RXRPC_PACKET_TYPE_CHALLENGE && sp->chall.conn) {
+			rxrpc_put_connection(sp->chall.conn,
+					     rxrpc_conn_put_challenge_input);
+			sp->chall.conn = NULL;
+		}
 		rxrpc_free_skb(skb, rxrpc_skb_put_conn_work);
 	}
 }
-- 
2.43.0