[PATCH net v2 0/7] net/handshake: anchor request lifetime to a pinned file reference

[Jakub Kicinski]

On Thu, 21 May 2026 10:47:06 -0400 Chuck Lever wrote:
> Three things in this restructuring want a careful look.  In
> handshake_complete(), the fput() of the request's file
> reference has to come after hp_done() -- fput() can transitively
> run handshake_sk_destruct() and free the request, so the patch
> stashes hr_file in a local first.  handshake_sk_destruct()
> itself is kept on purpose: it owns rhashtable removal and
> kfree, and remains the backstop if a consumer path bypasses
> handshake_complete() entirely.  Third, handshake_req_next() now
> returns its request with an extra get_file() held under
> hn_lock; accept_doit must consume that reference (FD_PREPARE on
> success, explicit fput on the fdf.err path), and any future
> caller has to honor the same contract.

Sashiko indicates races with handshake_req_cancel() remain,
and impact the code re-written by this series. What's your take?