[PATCH net v11 2/5] rxrpc: release secured-connection reference when purging skb

[Zihan Xi]

A SERVICE_CONN_SECURED skb holds a connection reference in sp->poke_conn.
The normal I/O-thread path drops that reference, but rxrpc_purge_queue()
only consumed the skb. If the skb was still queued when the local receive
queue was purged, the connection reference remained held.

Drop the reference from the purge path. The leak was identified during
AI-assisted review of the RxRPC queue teardown.

Fixes: 4241a702e0d0 ("rxrpc: Fix the rxrpc_connection attend queue handling")
Cc: stable at vger.kernel.org
Link: https://lore.kernel.org/all/cover.1792168462.git.zihanx@nebusec.ai/
Reported-by: Vega <vega at nebusec.ai>
Assisted-by: LLM
Co-developed-by: Luxing Yin <root at tr0jan.top>
Signed-off-by: Luxing Yin <root at tr0jan.top>
Signed-off-by: Zihan Xi <zihanx at nebusec.ai>
---
changes in v11:
  - Split SERVICE_CONN_SECURED skb reference cleanup into a standalone
    patch.
  - v10 Link: https://lore.kernel.org/all/cover.1792168462.git.zihanx@nebusec.ai/
---
 net/rxrpc/skbuff.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/net/rxrpc/skbuff.c b/net/rxrpc/skbuff.c
index e2169d1a14b5f..d759715be02c1 100644
--- a/net/rxrpc/skbuff.c
+++ b/net/rxrpc/skbuff.c
@@ -67,6 +67,11 @@ void rxrpc_purge_queue(struct sk_buff_head *list)
 
 	while ((skb = skb_dequeue((list))) != NULL) {
 		int n = atomic_dec_return(select_skb_count(skb));
+		if (skb->mark == RXRPC_SKB_MARK_SERVICE_CONN_SECURED) {
+			struct rxrpc_skb_priv *sp = rxrpc_skb(skb);
+
+			rxrpc_put_connection(sp->poke_conn, rxrpc_conn_put_poke);
+		}
 		trace_rxrpc_skb(skb, refcount_read(&skb->users), n,
 				rxrpc_skb_put_purge);
 		consume_skb(skb);
-- 
2.43.0