[PATCH net v2 0/7] net/handshake: anchor request lifetime to a pinned file reference

[Chuck Lever]

On Mon, May 25, 2026, at 2:35 PM, Jakub Kicinski wrote:
> On Thu, 21 May 2026 10:47:06 -0400 Chuck Lever wrote:
>> Three things in this restructuring want a careful look.  In
>> handshake_complete(), the fput() of the request's file
>> reference has to come after hp_done() -- fput() can transitively
>> run handshake_sk_destruct() and free the request, so the patch
>> stashes hr_file in a local first.  handshake_sk_destruct()
>> itself is kept on purpose: it owns rhashtable removal and
>> kfree, and remains the backstop if a consumer path bypasses
>> handshake_complete() entirely.  Third, handshake_req_next() now
>> returns its request with an extra get_file() held under
>> hn_lock; accept_doit must consume that reference (FD_PREPARE on
>> success, explicit fput on the fdf.err path), and any future
>> caller has to honor the same contract.
>
> Sashiko indicates races with handshake_req_cancel() remain,
> and impact the code re-written by this series. What's your take?

I examined the v2 reviews over the weekend and reworked the series
to address those concerns. v3 was posted earlier today, but sashiko
has it marked embargoed at the moment.

I’m aware of a couple of pre-existing issues that are not addressed,
as they are a bit out of scope.


-- 
Chuck Lever