* [PATCH net v2 01/10] rxrpc: Fix key quota calculation for multitoken keys
2026-03-23 15:04 [PATCH net v2 00/10] rxrpc: Miscellaneous fixes David Howells
@ 2026-03-23 15:04 ` David Howells
2026-03-23 15:04 ` [PATCH net v2 02/10] rxrpc: Fix key parsing memleak David Howells
` (8 subsequent siblings)
9 siblings, 0 replies; 13+ messages in thread
From: David Howells @ 2026-03-23 15:04 UTC (permalink / raw)
To: netdev
Cc: David Howells, Marc Dionne, Jakub Kicinski, David S. Miller,
Eric Dumazet, Paolo Abeni, linux-afs, linux-kernel,
Jeffrey Altman, Simon Horman, stable
In the rxrpc key preparsing, every token extracted sets the proposed quota
value, but for multitoken keys, this will overwrite the previous proposed
quota, losing it.
Fix this by adding to the proposed quota instead.
Fixes: 8a7a3eb4ddbe ("KEYS: RxRPC: Use key preparsing")
Closes: https://sashiko.dev/#/patchset/20260319150150.4189381-1-dhowells%40redhat.com
Signed-off-by: David Howells <dhowells@redhat.com>
cc: Marc Dionne <marc.dionne@auristor.com>
cc: Jeffrey Altman <jaltman@auristor.com>
cc: Eric Dumazet <edumazet@google.com>
cc: "David S. Miller" <davem@davemloft.net>
cc: Jakub Kicinski <kuba@kernel.org>
cc: Paolo Abeni <pabeni@redhat.com>
cc: Simon Horman <horms@kernel.org>
cc: linux-afs@lists.infradead.org
cc: netdev@vger.kernel.org
cc: stable@kernel.org
---
net/rxrpc/key.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/net/rxrpc/key.c b/net/rxrpc/key.c
index 85078114b2dd..af403f0ccab5 100644
--- a/net/rxrpc/key.c
+++ b/net/rxrpc/key.c
@@ -72,7 +72,7 @@ static int rxrpc_preparse_xdr_rxkad(struct key_preparsed_payload *prep,
return -EKEYREJECTED;
plen = sizeof(*token) + sizeof(*token->kad) + tktlen;
- prep->quotalen = datalen + plen;
+ prep->quotalen += datalen + plen;
plen -= sizeof(*token);
token = kzalloc_obj(*token);
@@ -199,7 +199,7 @@ static int rxrpc_preparse_xdr_yfs_rxgk(struct key_preparsed_payload *prep,
}
plen = sizeof(*token) + sizeof(*token->rxgk) + tktlen + keylen;
- prep->quotalen = datalen + plen;
+ prep->quotalen += datalen + plen;
plen -= sizeof(*token);
token = kzalloc_obj(*token);
@@ -460,6 +460,7 @@ static int rxrpc_preparse(struct key_preparsed_payload *prep)
memcpy(&kver, prep->data, sizeof(kver));
prep->data += sizeof(kver);
prep->datalen -= sizeof(kver);
+ prep->quotalen = 0;
_debug("KEY I/F VERSION: %u", kver);
@@ -497,7 +498,7 @@ static int rxrpc_preparse(struct key_preparsed_payload *prep)
goto error;
plen = sizeof(*token->kad) + v1->ticket_length;
- prep->quotalen = plen + sizeof(*token);
+ prep->quotalen += plen + sizeof(*token);
ret = -ENOMEM;
token = kzalloc_obj(*token);
^ permalink raw reply related [flat|nested] 13+ messages in thread* [PATCH net v2 02/10] rxrpc: Fix key parsing memleak
2026-03-23 15:04 [PATCH net v2 00/10] rxrpc: Miscellaneous fixes David Howells
2026-03-23 15:04 ` [PATCH net v2 01/10] rxrpc: Fix key quota calculation for multitoken keys David Howells
@ 2026-03-23 15:04 ` David Howells
2026-03-23 15:04 ` [PATCH net v2 03/10] rxrpc: Fix anonymous key handling David Howells
` (7 subsequent siblings)
9 siblings, 0 replies; 13+ messages in thread
From: David Howells @ 2026-03-23 15:04 UTC (permalink / raw)
To: netdev
Cc: David Howells, Marc Dionne, Jakub Kicinski, David S. Miller,
Eric Dumazet, Paolo Abeni, linux-afs, linux-kernel,
Jeffrey Altman, Simon Horman, stable
In rxrpc_preparse_xdr_yfs_rxgk(), the memory attached to token->rxgk can be
leaked in a few error paths after it's allocated.
Fix this by freeing it in the "reject_token:" case.
Fixes: 0ca100ff4df6 ("rxrpc: Add YFS RxGK (GSSAPI) security class")
Closes: https://sashiko.dev/#/patchset/20260319150150.4189381-1-dhowells%40redhat.com
Signed-off-by: David Howells <dhowells@redhat.com>
cc: Marc Dionne <marc.dionne@auristor.com>
cc: Jeffrey Altman <jaltman@auristor.com>
cc: Eric Dumazet <edumazet@google.com>
cc: "David S. Miller" <davem@davemloft.net>
cc: Jakub Kicinski <kuba@kernel.org>
cc: Paolo Abeni <pabeni@redhat.com>
cc: Simon Horman <horms@kernel.org>
cc: linux-afs@lists.infradead.org
cc: netdev@vger.kernel.org
cc: stable@kernel.org
---
net/rxrpc/key.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/net/rxrpc/key.c b/net/rxrpc/key.c
index af403f0ccab5..26d4336a4a02 100644
--- a/net/rxrpc/key.c
+++ b/net/rxrpc/key.c
@@ -274,6 +274,7 @@ static int rxrpc_preparse_xdr_yfs_rxgk(struct key_preparsed_payload *prep,
nomem:
return -ENOMEM;
reject_token:
+ kfree(token->rxgk);
kfree(token);
reject:
return -EKEYREJECTED;
^ permalink raw reply related [flat|nested] 13+ messages in thread* [PATCH net v2 03/10] rxrpc: Fix anonymous key handling
2026-03-23 15:04 [PATCH net v2 00/10] rxrpc: Miscellaneous fixes David Howells
2026-03-23 15:04 ` [PATCH net v2 01/10] rxrpc: Fix key quota calculation for multitoken keys David Howells
2026-03-23 15:04 ` [PATCH net v2 02/10] rxrpc: Fix key parsing memleak David Howells
@ 2026-03-23 15:04 ` David Howells
2026-03-23 15:04 ` [PATCH net v2 04/10] list: Move on_list_rcu() to list.h and add on_list() also David Howells
` (6 subsequent siblings)
9 siblings, 0 replies; 13+ messages in thread
From: David Howells @ 2026-03-23 15:04 UTC (permalink / raw)
To: netdev
Cc: David Howells, Marc Dionne, Jakub Kicinski, David S. Miller,
Eric Dumazet, Paolo Abeni, linux-afs, linux-kernel,
Jeffrey Altman, Simon Horman, stable
In rxrpc_new_client_call_for_sendmsg(), a key with no payload is meant to
be substituted for a NULL key pointer, but the variable this is done with
is subsequently not used.
Fix this by using "key" rather than "rx->key" when filling in the
connection parameters.
Note that this only affects direct use of AF_RXRPC; the kAFS filesystem
doesn't use sendmsg() directly and so bypasses the issue. Further,
AF_RXRPC passes a NULL key in if no key is set, so using an anonymous key
in that manner works. Since this hasn't been noticed to this point, it
might be better just to remove the "key" variable and the code that sets it
- and, arguably, rxrpc_init_client_call_security() would be a better place
to handle it.
Fixes: 19ffa01c9c45 ("rxrpc: Use structs to hold connection params and protocol info")
Closes: https://sashiko.dev/#/patchset/20260319150150.4189381-1-dhowells%40redhat.com
Signed-off-by: David Howells <dhowells@redhat.com>
cc: Marc Dionne <marc.dionne@auristor.com>
cc: Jeffrey Altman <jaltman@auristor.com>
cc: Eric Dumazet <edumazet@google.com>
cc: "David S. Miller" <davem@davemloft.net>
cc: Jakub Kicinski <kuba@kernel.org>
cc: Paolo Abeni <pabeni@redhat.com>
cc: Simon Horman <horms@kernel.org>
cc: linux-afs@lists.infradead.org
cc: netdev@vger.kernel.org
cc: stable@kernel.org
---
net/rxrpc/sendmsg.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/rxrpc/sendmsg.c b/net/rxrpc/sendmsg.c
index 04f9c5f2dc24..c35de4fd75e3 100644
--- a/net/rxrpc/sendmsg.c
+++ b/net/rxrpc/sendmsg.c
@@ -637,7 +637,7 @@ rxrpc_new_client_call_for_sendmsg(struct rxrpc_sock *rx, struct msghdr *msg,
memset(&cp, 0, sizeof(cp));
cp.local = rx->local;
cp.peer = peer;
- cp.key = rx->key;
+ cp.key = key;
cp.security_level = rx->min_sec_level;
cp.exclusive = rx->exclusive | p->exclusive;
cp.upgrade = p->upgrade;
^ permalink raw reply related [flat|nested] 13+ messages in thread* [PATCH net v2 04/10] list: Move on_list_rcu() to list.h and add on_list() also
2026-03-23 15:04 [PATCH net v2 00/10] rxrpc: Miscellaneous fixes David Howells
` (2 preceding siblings ...)
2026-03-23 15:04 ` [PATCH net v2 03/10] rxrpc: Fix anonymous key handling David Howells
@ 2026-03-23 15:04 ` David Howells
2026-03-23 22:44 ` kernel test robot
2026-03-23 22:55 ` kernel test robot
2026-03-23 15:04 ` [PATCH net v2 05/10] rxrpc: Fix call removal to use RCU safe deletion David Howells
` (5 subsequent siblings)
9 siblings, 2 replies; 13+ messages in thread
From: David Howells @ 2026-03-23 15:04 UTC (permalink / raw)
To: netdev
Cc: David Howells, Marc Dionne, Jakub Kicinski, David S. Miller,
Eric Dumazet, Paolo Abeni, linux-afs, linux-kernel,
Mathieu Desnoyers, John Johansen, Simon Horman, apparmor, stable
Unfortunately, list_empty() is not usable with an entry that has been
removed from a list with list_del_rcu() as ->next must be left pointing at
the following entry so as not to break traversal under RCU.
Solve this by moving on_list_rcu() from AppArmor to linux/list.h, and
turning it into an inline function.
Also add an on_list() counterpart (functionally, this is just an antonym
for list_empty()), but the name looks less awkward when applied to a
non-head element. We probably don't want to use on_list_rcu() generally
because it requires an extra check as ->prev is set differently in the two
cases.
Signed-off-by: David Howells <dhowells@redhat.com>
cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
cc: John Johansen <john.johansen@canonical.com>
cc: Marc Dionne <marc.dionne@auristor.com>
cc: Eric Dumazet <edumazet@google.com>
cc: "David S. Miller" <davem@davemloft.net>
cc: Jakub Kicinski <kuba@kernel.org>
cc: Paolo Abeni <pabeni@redhat.com>
cc: Simon Horman <horms@kernel.org>
cc: linux-afs@lists.infradead.org
cc: apparmor@lists.ubuntu.com
cc: netdev@vger.kernel.org
cc: stable@kernel.org
---
include/linux/list.h | 26 ++++++++++++++++++++++++++
security/apparmor/include/policy.h | 2 --
2 files changed, 26 insertions(+), 2 deletions(-)
diff --git a/include/linux/list.h b/include/linux/list.h
index 00ea8e5fb88b..d224e7210d1b 100644
--- a/include/linux/list.h
+++ b/include/linux/list.h
@@ -381,6 +381,32 @@ static inline int list_empty(const struct list_head *head)
return READ_ONCE(head->next) == head;
}
+/**
+ * on_list - Test whether an entry is on a list.
+ * @entry: The entry to check
+ *
+ * Test whether an entry is on a list. Safe to use on an entry initialised
+ * with INIT_LIST_HEAD() or LIST_HEAD() or removed with things like
+ * list_del_init(). Not safe for use with list_del() or list_del_rcu().
+ */
+static inline bool on_list(const struct list_head *entry)
+{
+ return !list_empty(entry);
+}
+
+/**
+ * on_list_rcu - Test whether an entry is on a list (RCU-del safe).
+ * @entry: The entry to check
+ *
+ * Test whether an entry is on a list. Safe to use on an entry initialised
+ * with INIT_LIST_HEAD() or LIST_HEAD() or removed with things like
+ * list_del_init(). Also safe for use with list_del() or list_del_rcu().
+ */
+static inline bool on_list_rcu(const struct list_head *entry)
+{
+ return !list_empty(entry) && entry->prev != LIST_POISON2;
+}
+
/**
* list_del_init_careful - deletes entry from list and reinitialize it.
* @entry: the element to delete from the list.
diff --git a/security/apparmor/include/policy.h b/security/apparmor/include/policy.h
index 3895f8774a3f..c3697c23bbed 100644
--- a/security/apparmor/include/policy.h
+++ b/security/apparmor/include/policy.h
@@ -57,8 +57,6 @@ extern const char *const aa_profile_mode_names[];
#define profile_is_stale(_profile) (label_is_stale(&(_profile)->label))
-#define on_list_rcu(X) (!list_empty(X) && (X)->prev != LIST_POISON2)
-
/* flags in the dfa accept2 table */
enum dfa_accept_flags {
ACCEPT_FLAG_OWNER = 1,
^ permalink raw reply related [flat|nested] 13+ messages in thread* Re: [PATCH net v2 04/10] list: Move on_list_rcu() to list.h and add on_list() also
2026-03-23 15:04 ` [PATCH net v2 04/10] list: Move on_list_rcu() to list.h and add on_list() also David Howells
@ 2026-03-23 22:44 ` kernel test robot
2026-03-23 22:55 ` kernel test robot
1 sibling, 0 replies; 13+ messages in thread
From: kernel test robot @ 2026-03-23 22:44 UTC (permalink / raw)
To: David Howells, netdev
Cc: llvm, oe-kbuild-all, David Howells, Marc Dionne, Jakub Kicinski,
Eric Dumazet, Paolo Abeni, linux-afs, linux-kernel,
Mathieu Desnoyers, John Johansen, Simon Horman, apparmor, stable
Hi David,
kernel test robot noticed the following build errors:
[auto build test ERROR on net/main]
url: https://github.com/intel-lab-lkp/linux/commits/David-Howells/rxrpc-Fix-key-quota-calculation-for-multitoken-keys/20260323-234846
base: net/main
patch link: https://lore.kernel.org/r/20260323150505.3513839-5-dhowells%40redhat.com
patch subject: [PATCH net v2 04/10] list: Move on_list_rcu() to list.h and add on_list() also
config: arm-randconfig-004-20260324 (https://download.01.org/0day-ci/archive/20260324/202603240630.eCfHPMhL-lkp@intel.com/config)
compiler: clang version 23.0.0git (https://github.com/llvm/llvm-project 054e11d1a17e5ba88bb1a8ef32fad3346e80b186)
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260324/202603240630.eCfHPMhL-lkp@intel.com/reproduce)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202603240630.eCfHPMhL-lkp@intel.com/
All errors (new ones prefixed by >>):
drivers/usb/dwc2/gadget.c:4313:13: error: conflicting types for 'on_list'
4313 | static bool on_list(struct dwc2_hsotg_ep *ep, struct dwc2_hsotg_req *test)
| ^
include/linux/list.h:392:20: note: previous definition is here
392 | static inline bool on_list(const struct list_head *entry)
| ^
>> drivers/usb/dwc2/gadget.c:4341:22: error: too many arguments to function call, expected single argument 'entry', have 2 arguments
4341 | if (!on_list(hs_ep, hs_req)) {
| ~~~~~~~ ^~~~~~
include/linux/list.h:392:20: note: 'on_list' declared here
392 | static inline bool on_list(const struct list_head *entry)
| ^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
2 errors generated.
vim +/entry +4341 drivers/usb/dwc2/gadget.c
5b7d70c6dbf2db drivers/usb/gadget/s3c-hsotg.c Ben Dooks 2009-06-02 4324
8b9bc4608eefeb drivers/usb/gadget/s3c-hsotg.c Lukasz Majewski 2012-05-04 4325 /**
1f91b4cc03556b drivers/usb/dwc2/gadget.c Felipe Balbi 2015-08-06 4326 * dwc2_hsotg_ep_dequeue - dequeue given endpoint
8b9bc4608eefeb drivers/usb/gadget/s3c-hsotg.c Lukasz Majewski 2012-05-04 4327 * @ep: The endpoint to dequeue.
8b9bc4608eefeb drivers/usb/gadget/s3c-hsotg.c Lukasz Majewski 2012-05-04 4328 * @req: The request to be removed from a queue.
8b9bc4608eefeb drivers/usb/gadget/s3c-hsotg.c Lukasz Majewski 2012-05-04 4329 */
1f91b4cc03556b drivers/usb/dwc2/gadget.c Felipe Balbi 2015-08-06 4330 static int dwc2_hsotg_ep_dequeue(struct usb_ep *ep, struct usb_request *req)
5b7d70c6dbf2db drivers/usb/gadget/s3c-hsotg.c Ben Dooks 2009-06-02 4331 {
1f91b4cc03556b drivers/usb/dwc2/gadget.c Felipe Balbi 2015-08-06 4332 struct dwc2_hsotg_req *hs_req = our_req(req);
1f91b4cc03556b drivers/usb/dwc2/gadget.c Felipe Balbi 2015-08-06 4333 struct dwc2_hsotg_ep *hs_ep = our_ep(ep);
941fcce4ff6701 drivers/usb/dwc2/gadget.c Dinh Nguyen 2014-11-11 4334 struct dwc2_hsotg *hs = hs_ep->parent;
5b7d70c6dbf2db drivers/usb/gadget/s3c-hsotg.c Ben Dooks 2009-06-02 4335 unsigned long flags;
5b7d70c6dbf2db drivers/usb/gadget/s3c-hsotg.c Ben Dooks 2009-06-02 4336
1e01129373f757 drivers/usb/dwc2/gadget.c Marek Szyprowski 2014-09-09 4337 dev_dbg(hs->dev, "ep_dequeue(%p,%p)\n", ep, req);
5b7d70c6dbf2db drivers/usb/gadget/s3c-hsotg.c Ben Dooks 2009-06-02 4338
22258f4906aa87 drivers/usb/gadget/s3c-hsotg.c Lukasz Majewski 2012-06-14 4339 spin_lock_irqsave(&hs->lock, flags);
5b7d70c6dbf2db drivers/usb/gadget/s3c-hsotg.c Ben Dooks 2009-06-02 4340
5b7d70c6dbf2db drivers/usb/gadget/s3c-hsotg.c Ben Dooks 2009-06-02 @4341 if (!on_list(hs_ep, hs_req)) {
22258f4906aa87 drivers/usb/gadget/s3c-hsotg.c Lukasz Majewski 2012-06-14 4342 spin_unlock_irqrestore(&hs->lock, flags);
5b7d70c6dbf2db drivers/usb/gadget/s3c-hsotg.c Ben Dooks 2009-06-02 4343 return -EINVAL;
5b7d70c6dbf2db drivers/usb/gadget/s3c-hsotg.c Ben Dooks 2009-06-02 4344 }
5b7d70c6dbf2db drivers/usb/gadget/s3c-hsotg.c Ben Dooks 2009-06-02 4345
c524dd5f432a06 drivers/usb/dwc2/gadget.c Mian Yousaf Kaukab 2015-09-29 4346 /* Dequeue already started request */
c524dd5f432a06 drivers/usb/dwc2/gadget.c Mian Yousaf Kaukab 2015-09-29 4347 if (req == &hs_ep->req->req)
c524dd5f432a06 drivers/usb/dwc2/gadget.c Mian Yousaf Kaukab 2015-09-29 4348 dwc2_hsotg_ep_stop_xfr(hs, hs_ep);
c524dd5f432a06 drivers/usb/dwc2/gadget.c Mian Yousaf Kaukab 2015-09-29 4349
1f91b4cc03556b drivers/usb/dwc2/gadget.c Felipe Balbi 2015-08-06 4350 dwc2_hsotg_complete_request(hs, hs_ep, hs_req, -ECONNRESET);
22258f4906aa87 drivers/usb/gadget/s3c-hsotg.c Lukasz Majewski 2012-06-14 4351 spin_unlock_irqrestore(&hs->lock, flags);
5b7d70c6dbf2db drivers/usb/gadget/s3c-hsotg.c Ben Dooks 2009-06-02 4352
5b7d70c6dbf2db drivers/usb/gadget/s3c-hsotg.c Ben Dooks 2009-06-02 4353 return 0;
5b7d70c6dbf2db drivers/usb/gadget/s3c-hsotg.c Ben Dooks 2009-06-02 4354 }
5b7d70c6dbf2db drivers/usb/gadget/s3c-hsotg.c Ben Dooks 2009-06-02 4355
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply [flat|nested] 13+ messages in thread* Re: [PATCH net v2 04/10] list: Move on_list_rcu() to list.h and add on_list() also
2026-03-23 15:04 ` [PATCH net v2 04/10] list: Move on_list_rcu() to list.h and add on_list() also David Howells
2026-03-23 22:44 ` kernel test robot
@ 2026-03-23 22:55 ` kernel test robot
1 sibling, 0 replies; 13+ messages in thread
From: kernel test robot @ 2026-03-23 22:55 UTC (permalink / raw)
To: David Howells, netdev
Cc: oe-kbuild-all, David Howells, Marc Dionne, Jakub Kicinski,
Eric Dumazet, Paolo Abeni, linux-afs, linux-kernel,
Mathieu Desnoyers, John Johansen, Simon Horman, apparmor, stable
Hi David,
kernel test robot noticed the following build errors:
[auto build test ERROR on net/main]
url: https://github.com/intel-lab-lkp/linux/commits/David-Howells/rxrpc-Fix-key-quota-calculation-for-multitoken-keys/20260323-234846
base: net/main
patch link: https://lore.kernel.org/r/20260323150505.3513839-5-dhowells%40redhat.com
patch subject: [PATCH net v2 04/10] list: Move on_list_rcu() to list.h and add on_list() also
config: arc-randconfig-r071-20260324 (https://download.01.org/0day-ci/archive/20260324/202603240650.DP6vwmk9-lkp@intel.com/config)
compiler: arc-linux-gcc (GCC) 10.5.0
smatch: v0.5.0-9004-gb810ac53
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260324/202603240650.DP6vwmk9-lkp@intel.com/reproduce)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202603240650.DP6vwmk9-lkp@intel.com/
All errors (new ones prefixed by >>):
>> drivers/usb/dwc2/gadget.c:4313:13: error: conflicting types for 'on_list'
4313 | static bool on_list(struct dwc2_hsotg_ep *ep, struct dwc2_hsotg_req *test)
| ^~~~~~~
In file included from include/linux/module.h:12,
from drivers/usb/dwc2/gadget.c:15:
include/linux/list.h:392:20: note: previous definition of 'on_list' was here
392 | static inline bool on_list(const struct list_head *entry)
| ^~~~~~~
vim +/on_list +4313 drivers/usb/dwc2/gadget.c
4fe4f9fecc3695 drivers/usb/dwc2/gadget.c Minas Harutyunyan 2018-12-10 4307
5b7d70c6dbf2db drivers/usb/gadget/s3c-hsotg.c Ben Dooks 2009-06-02 4308 /**
5b7d70c6dbf2db drivers/usb/gadget/s3c-hsotg.c Ben Dooks 2009-06-02 4309 * on_list - check request is on the given endpoint
5b7d70c6dbf2db drivers/usb/gadget/s3c-hsotg.c Ben Dooks 2009-06-02 4310 * @ep: The endpoint to check.
5b7d70c6dbf2db drivers/usb/gadget/s3c-hsotg.c Ben Dooks 2009-06-02 4311 * @test: The request to test if it is on the endpoint.
5b7d70c6dbf2db drivers/usb/gadget/s3c-hsotg.c Ben Dooks 2009-06-02 4312 */
1f91b4cc03556b drivers/usb/dwc2/gadget.c Felipe Balbi 2015-08-06 @4313 static bool on_list(struct dwc2_hsotg_ep *ep, struct dwc2_hsotg_req *test)
5b7d70c6dbf2db drivers/usb/gadget/s3c-hsotg.c Ben Dooks 2009-06-02 4314 {
1f91b4cc03556b drivers/usb/dwc2/gadget.c Felipe Balbi 2015-08-06 4315 struct dwc2_hsotg_req *req, *treq;
5b7d70c6dbf2db drivers/usb/gadget/s3c-hsotg.c Ben Dooks 2009-06-02 4316
5b7d70c6dbf2db drivers/usb/gadget/s3c-hsotg.c Ben Dooks 2009-06-02 4317 list_for_each_entry_safe(req, treq, &ep->queue, queue) {
5b7d70c6dbf2db drivers/usb/gadget/s3c-hsotg.c Ben Dooks 2009-06-02 4318 if (req == test)
5b7d70c6dbf2db drivers/usb/gadget/s3c-hsotg.c Ben Dooks 2009-06-02 4319 return true;
5b7d70c6dbf2db drivers/usb/gadget/s3c-hsotg.c Ben Dooks 2009-06-02 4320 }
5b7d70c6dbf2db drivers/usb/gadget/s3c-hsotg.c Ben Dooks 2009-06-02 4321
5b7d70c6dbf2db drivers/usb/gadget/s3c-hsotg.c Ben Dooks 2009-06-02 4322 return false;
5b7d70c6dbf2db drivers/usb/gadget/s3c-hsotg.c Ben Dooks 2009-06-02 4323 }
5b7d70c6dbf2db drivers/usb/gadget/s3c-hsotg.c Ben Dooks 2009-06-02 4324
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply [flat|nested] 13+ messages in thread
* [PATCH net v2 05/10] rxrpc: Fix call removal to use RCU safe deletion
2026-03-23 15:04 [PATCH net v2 00/10] rxrpc: Miscellaneous fixes David Howells
` (3 preceding siblings ...)
2026-03-23 15:04 ` [PATCH net v2 04/10] list: Move on_list_rcu() to list.h and add on_list() also David Howells
@ 2026-03-23 15:04 ` David Howells
2026-03-23 15:04 ` [PATCH net v2 06/10] rxrpc: Fix RxGK token loading to check bounds David Howells
` (4 subsequent siblings)
9 siblings, 0 replies; 13+ messages in thread
From: David Howells @ 2026-03-23 15:04 UTC (permalink / raw)
To: netdev
Cc: David Howells, Marc Dionne, Jakub Kicinski, David S. Miller,
Eric Dumazet, Paolo Abeni, linux-afs, linux-kernel,
Jeffrey Altman, Simon Horman, stable
Fix rxrpc call removal from the rxnet->calls list to use list_del_rcu()
rather than list_del_init() to prevent stuffing up reading
/proc/net/rxrpc/calls from potentially getting into an infinite loop.
Closes: https://sashiko.dev/#/patchset/20260319150150.4189381-1-dhowells%40redhat.com
Signed-off-by: David Howells <dhowells@redhat.com>
cc: Marc Dionne <marc.dionne@auristor.com>
cc: Jeffrey Altman <jaltman@auristor.com>
cc: Eric Dumazet <edumazet@google.com>
cc: "David S. Miller" <davem@davemloft.net>
cc: Jakub Kicinski <kuba@kernel.org>
cc: Paolo Abeni <pabeni@redhat.com>
cc: Simon Horman <horms@kernel.org>
cc: linux-afs@lists.infradead.org
cc: netdev@vger.kernel.org
cc: stable@kernel.org
---
net/rxrpc/call_object.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/net/rxrpc/call_object.c b/net/rxrpc/call_object.c
index 918f41d97a2f..0e47751d5937 100644
--- a/net/rxrpc/call_object.c
+++ b/net/rxrpc/call_object.c
@@ -654,9 +654,9 @@ void rxrpc_put_call(struct rxrpc_call *call, enum rxrpc_call_trace why)
if (dead) {
ASSERTCMP(__rxrpc_call_state(call), ==, RXRPC_CALL_COMPLETE);
- if (!list_empty(&call->link)) {
+ if (on_list_rcu(&call->link)) {
spin_lock(&rxnet->call_lock);
- list_del_init(&call->link);
+ list_del_rcu(&call->link);
spin_unlock(&rxnet->call_lock);
}
@@ -738,7 +738,7 @@ void rxrpc_destroy_all_calls(struct rxrpc_net *rxnet)
_debug("Zapping call %p", call);
rxrpc_see_call(call, rxrpc_call_see_zap);
- list_del_init(&call->link);
+ list_del_rcu(&call->link);
pr_err("Call %p still in use (%d,%s,%lx,%lx)!\n",
call, refcount_read(&call->ref),
^ permalink raw reply related [flat|nested] 13+ messages in thread* [PATCH net v2 06/10] rxrpc: Fix RxGK token loading to check bounds
2026-03-23 15:04 [PATCH net v2 00/10] rxrpc: Miscellaneous fixes David Howells
` (4 preceding siblings ...)
2026-03-23 15:04 ` [PATCH net v2 05/10] rxrpc: Fix call removal to use RCU safe deletion David Howells
@ 2026-03-23 15:04 ` David Howells
2026-03-23 15:04 ` [PATCH net v2 07/10] rxrpc: Fix use of wrong skb when comparing queued RESP challenge serial David Howells
` (3 subsequent siblings)
9 siblings, 0 replies; 13+ messages in thread
From: David Howells @ 2026-03-23 15:04 UTC (permalink / raw)
To: netdev
Cc: David Howells, Marc Dionne, Jakub Kicinski, David S. Miller,
Eric Dumazet, Paolo Abeni, linux-afs, linux-kernel, Oleh Konko,
Jeffrey Altman, Simon Horman, stable
From: Oleh Konko <security@1seal.org>
rxrpc_preparse_xdr_yfs_rxgk() reads the raw key length and ticket length
from the XDR token as u32 values and passes each through round_up(x, 4)
before using the rounded value for validation and allocation. When the raw
length is >= 0xfffffffd, round_up() wraps to 0, so the bounds check and
kzalloc both use 0 while the subsequent memcpy still copies the original
~4 GiB value, producing a heap buffer overflow reachable from an
unprivileged add_key() call.
Fix this by:
(1) Rejecting raw key lengths above AFSTOKEN_GK_KEY_MAX and raw ticket
lengths above AFSTOKEN_GK_TOKEN_MAX before rounding, consistent with
the caps that the RxKAD path already enforces via AFSTOKEN_RK_TIX_MAX.
(2) Sizing the flexible-array allocation from the validated raw key
length via struct_size_t() instead of the rounded value.
(3) Caching the raw lengths so that the later field assignments and
memcpy calls do not re-read from the token, eliminating a class of
TOCTOU re-parse.
The control path (valid token with lengths within bounds) is unaffected.
Fixes: 0ca100ff4df6 ("rxrpc: Add YFS RxGK (GSSAPI) security class")
Signed-off-by: Oleh Konko <security@1seal.org>
Signed-off-by: David Howells <dhowells@redhat.com>
Reviewed-by: Jeffrey Altman <jaltman@auristor.com>
cc: Marc Dionne <marc.dionne@auristor.com>
cc: Eric Dumazet <edumazet@google.com>
cc: "David S. Miller" <davem@davemloft.net>
cc: Jakub Kicinski <kuba@kernel.org>
cc: Paolo Abeni <pabeni@redhat.com>
cc: Simon Horman <horms@kernel.org>
cc: linux-afs@lists.infradead.org
cc: netdev@vger.kernel.org
cc: stable@kernel.org
---
net/rxrpc/key.c | 30 +++++++++++++++++-------------
1 file changed, 17 insertions(+), 13 deletions(-)
diff --git a/net/rxrpc/key.c b/net/rxrpc/key.c
index 26d4336a4a02..77237a82be3b 100644
--- a/net/rxrpc/key.c
+++ b/net/rxrpc/key.c
@@ -13,6 +13,7 @@
#include <crypto/skcipher.h>
#include <linux/module.h>
#include <linux/net.h>
+#include <linux/overflow.h>
#include <linux/skbuff.h>
#include <linux/key-type.h>
#include <linux/ctype.h>
@@ -171,7 +172,7 @@ static int rxrpc_preparse_xdr_yfs_rxgk(struct key_preparsed_payload *prep,
size_t plen;
const __be32 *ticket, *key;
s64 tmp;
- u32 tktlen, keylen;
+ size_t raw_keylen, raw_tktlen, keylen, tktlen;
_enter(",{%x,%x,%x,%x},%x",
ntohl(xdr[0]), ntohl(xdr[1]), ntohl(xdr[2]), ntohl(xdr[3]),
@@ -181,18 +182,22 @@ static int rxrpc_preparse_xdr_yfs_rxgk(struct key_preparsed_payload *prep,
goto reject;
key = xdr + (6 * 2 + 1);
- keylen = ntohl(key[-1]);
- _debug("keylen: %x", keylen);
- keylen = round_up(keylen, 4);
+ raw_keylen = ntohl(key[-1]);
+ _debug("keylen: %zx", raw_keylen);
+ if (raw_keylen > AFSTOKEN_GK_KEY_MAX)
+ goto reject;
+ keylen = round_up(raw_keylen, 4);
if ((6 * 2 + 2) * 4 + keylen > toklen)
goto reject;
ticket = xdr + (6 * 2 + 1 + (keylen / 4) + 1);
- tktlen = ntohl(ticket[-1]);
- _debug("tktlen: %x", tktlen);
- tktlen = round_up(tktlen, 4);
+ raw_tktlen = ntohl(ticket[-1]);
+ _debug("tktlen: %zx", raw_tktlen);
+ if (raw_tktlen > AFSTOKEN_GK_TOKEN_MAX)
+ goto reject;
+ tktlen = round_up(raw_tktlen, 4);
if ((6 * 2 + 2) * 4 + keylen + tktlen != toklen) {
- kleave(" = -EKEYREJECTED [%x!=%x, %x,%x]",
+ kleave(" = -EKEYREJECTED [%zx!=%x, %zx,%zx]",
(6 * 2 + 2) * 4 + keylen + tktlen, toklen,
keylen, tktlen);
goto reject;
@@ -206,7 +211,7 @@ static int rxrpc_preparse_xdr_yfs_rxgk(struct key_preparsed_payload *prep,
if (!token)
goto nomem;
- token->rxgk = kzalloc(sizeof(*token->rxgk) + keylen, GFP_KERNEL);
+ token->rxgk = kzalloc(struct_size_t(struct rxgk_key, _key, raw_keylen), GFP_KERNEL);
if (!token->rxgk)
goto nomem_token;
@@ -221,9 +226,9 @@ static int rxrpc_preparse_xdr_yfs_rxgk(struct key_preparsed_payload *prep,
token->rxgk->enctype = tmp = xdr_dec64(xdr + 5 * 2);
if (tmp < 0 || tmp > UINT_MAX)
goto reject_token;
- token->rxgk->key.len = ntohl(key[-1]);
+ token->rxgk->key.len = raw_keylen;
token->rxgk->key.data = token->rxgk->_key;
- token->rxgk->ticket.len = ntohl(ticket[-1]);
+ token->rxgk->ticket.len = raw_tktlen;
if (token->rxgk->endtime != 0) {
expiry = rxrpc_s64_to_time64(token->rxgk->endtime);
@@ -236,8 +241,7 @@ static int rxrpc_preparse_xdr_yfs_rxgk(struct key_preparsed_payload *prep,
memcpy(token->rxgk->key.data, key, token->rxgk->key.len);
/* Pad the ticket so that we can use it directly in XDR */
- token->rxgk->ticket.data = kzalloc(round_up(token->rxgk->ticket.len, 4),
- GFP_KERNEL);
+ token->rxgk->ticket.data = kzalloc(tktlen, GFP_KERNEL);
if (!token->rxgk->ticket.data)
goto nomem_yrxgk;
memcpy(token->rxgk->ticket.data, ticket, token->rxgk->ticket.len);
^ permalink raw reply related [flat|nested] 13+ messages in thread* [PATCH net v2 07/10] rxrpc: Fix use of wrong skb when comparing queued RESP challenge serial
2026-03-23 15:04 [PATCH net v2 00/10] rxrpc: Miscellaneous fixes David Howells
` (5 preceding siblings ...)
2026-03-23 15:04 ` [PATCH net v2 06/10] rxrpc: Fix RxGK token loading to check bounds David Howells
@ 2026-03-23 15:04 ` David Howells
2026-03-23 15:04 ` [PATCH net v2 08/10] rxrpc: Fix rack timer warning to report unexpected mode David Howells
` (2 subsequent siblings)
9 siblings, 0 replies; 13+ messages in thread
From: David Howells @ 2026-03-23 15:04 UTC (permalink / raw)
To: netdev
Cc: David Howells, Marc Dionne, Jakub Kicinski, David S. Miller,
Eric Dumazet, Paolo Abeni, linux-afs, linux-kernel, Alok Tiwari,
Jeffrey Altman, Simon Horman, stable
From: Alok Tiwari <alok.a.tiwari@oracle.com>
In rxrpc_post_response(), the code should be comparing the challenge serial
number from the cached response before deciding to switch to a newer
response, but looks at the newer packet private data instead, rendering the
comparison always false.
Fix this by switching to look at the older packet.
Fix further[1] to substitute the new packet in place of the old one if
newer and also to release whichever we don't use.
Fixes: 5800b1cf3fd8 ("rxrpc: Allow CHALLENGEs to the passed to the app for a RESPONSE")
Signed-off-by: Alok Tiwari <alok.a.tiwari@oracle.com>
Signed-off-by: David Howells <dhowells@redhat.com>
Reviewed-by: Jeffrey Altman <jaltman@auristor.com>
cc: Marc Dionne <marc.dionne@auristor.com>
cc: Eric Dumazet <edumazet@google.com>
cc: "David S. Miller" <davem@davemloft.net>
cc: Jakub Kicinski <kuba@kernel.org>
cc: Paolo Abeni <pabeni@redhat.com>
cc: Simon Horman <horms@kernel.org>
cc: linux-afs@lists.infradead.org
cc: netdev@vger.kernel.org
cc: stable@kernel.org
Link: https://sashiko.dev/#/patchset/20260319150150.4189381-1-dhowells%40redhat.com [1]
---
include/trace/events/rxrpc.h | 1 +
net/rxrpc/conn_event.c | 5 +++--
2 files changed, 4 insertions(+), 2 deletions(-)
diff --git a/include/trace/events/rxrpc.h b/include/trace/events/rxrpc.h
index 869f97c9bf73..5edad6a624ad 100644
--- a/include/trace/events/rxrpc.h
+++ b/include/trace/events/rxrpc.h
@@ -185,6 +185,7 @@
EM(rxrpc_skb_put_input, "PUT input ") \
EM(rxrpc_skb_put_jumbo_subpacket, "PUT jumbo-sub") \
EM(rxrpc_skb_put_oob, "PUT oob ") \
+ EM(rxrpc_skb_put_old_response, "PUT old-resp ") \
EM(rxrpc_skb_put_purge, "PUT purge ") \
EM(rxrpc_skb_put_purge_oob, "PUT purge-oob") \
EM(rxrpc_skb_put_response, "PUT response ") \
diff --git a/net/rxrpc/conn_event.c b/net/rxrpc/conn_event.c
index 98ad9b51ca2c..c50cbfc5a313 100644
--- a/net/rxrpc/conn_event.c
+++ b/net/rxrpc/conn_event.c
@@ -557,11 +557,11 @@ void rxrpc_post_response(struct rxrpc_connection *conn, struct sk_buff *skb)
spin_lock_irq(&local->lock);
old = conn->tx_response;
if (old) {
- struct rxrpc_skb_priv *osp = rxrpc_skb(skb);
+ struct rxrpc_skb_priv *osp = rxrpc_skb(old);
/* Always go with the response to the most recent challenge. */
if (after(sp->resp.challenge_serial, osp->resp.challenge_serial))
- conn->tx_response = old;
+ conn->tx_response = skb;
else
old = skb;
} else {
@@ -569,4 +569,5 @@ void rxrpc_post_response(struct rxrpc_connection *conn, struct sk_buff *skb)
}
spin_unlock_irq(&local->lock);
rxrpc_poke_conn(conn, rxrpc_conn_get_poke_response);
+ rxrpc_free_skb(old, rxrpc_skb_put_old_response);
}
^ permalink raw reply related [flat|nested] 13+ messages in thread* [PATCH net v2 08/10] rxrpc: Fix rack timer warning to report unexpected mode
2026-03-23 15:04 [PATCH net v2 00/10] rxrpc: Miscellaneous fixes David Howells
` (6 preceding siblings ...)
2026-03-23 15:04 ` [PATCH net v2 07/10] rxrpc: Fix use of wrong skb when comparing queued RESP challenge serial David Howells
@ 2026-03-23 15:04 ` David Howells
2026-03-23 15:05 ` [PATCH net v2 09/10] rxrpc: Fix keyring reference count leak in rxrpc_setsockopt() David Howells
2026-03-23 15:05 ` [PATCH net v2 10/10] rxrpc: Fix key reference count leak from call->key David Howells
9 siblings, 0 replies; 13+ messages in thread
From: David Howells @ 2026-03-23 15:04 UTC (permalink / raw)
To: netdev
Cc: David Howells, Marc Dionne, Jakub Kicinski, David S. Miller,
Eric Dumazet, Paolo Abeni, linux-afs, linux-kernel, Alok Tiwari,
Simon Horman, Jeffrey Altman, stable
From: Alok Tiwari <alok.a.tiwari@oracle.com>
rxrpc_rack_timer_expired() clears call->rack_timer_mode to OFF before
the switch. The default case warning therefore always prints OFF and
doesn't identify the unexpected timer mode.
Log the saved mode value instead so the warning reports the actual
unexpected rack timer mode.
Fixes: 7c482665931b ("rxrpc: Implement RACK/TLP to deal with transmission stalls [RFC8985]")
Signed-off-by: Alok Tiwari <alok.a.tiwari@oracle.com>
Signed-off-by: David Howells <dhowells@redhat.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Reviewed-by: Jeffrey Altman <jaltman@auristor.com>
cc: Marc Dionne <marc.dionne@auristor.com>
cc: Eric Dumazet <edumazet@google.com>
cc: "David S. Miller" <davem@davemloft.net>
cc: Jakub Kicinski <kuba@kernel.org>
cc: Paolo Abeni <pabeni@redhat.com>
cc: linux-afs@lists.infradead.org
cc: netdev@vger.kernel.org
cc: stable@kernel.org
---
net/rxrpc/input_rack.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/rxrpc/input_rack.c b/net/rxrpc/input_rack.c
index 13c371261e0a..9eb109ffba56 100644
--- a/net/rxrpc/input_rack.c
+++ b/net/rxrpc/input_rack.c
@@ -413,6 +413,6 @@ void rxrpc_rack_timer_expired(struct rxrpc_call *call, ktime_t overran_by)
break;
//case RXRPC_CALL_RACKTIMER_ZEROWIN:
default:
- pr_warn("Unexpected rack timer %u", call->rack_timer_mode);
+ pr_warn("Unexpected rack timer %u", mode);
}
}
^ permalink raw reply related [flat|nested] 13+ messages in thread* [PATCH net v2 09/10] rxrpc: Fix keyring reference count leak in rxrpc_setsockopt()
2026-03-23 15:04 [PATCH net v2 00/10] rxrpc: Miscellaneous fixes David Howells
` (7 preceding siblings ...)
2026-03-23 15:04 ` [PATCH net v2 08/10] rxrpc: Fix rack timer warning to report unexpected mode David Howells
@ 2026-03-23 15:05 ` David Howells
2026-03-23 15:05 ` [PATCH net v2 10/10] rxrpc: Fix key reference count leak from call->key David Howells
9 siblings, 0 replies; 13+ messages in thread
From: David Howells @ 2026-03-23 15:05 UTC (permalink / raw)
To: netdev
Cc: David Howells, Marc Dionne, Jakub Kicinski, David S. Miller,
Eric Dumazet, Paolo Abeni, linux-afs, linux-kernel,
Anderson Nascimento, Jeffrey Altman, Simon Horman, stable
From: Anderson Nascimento <anderson@allelesecurity.com>
In rxrpc_setsockopt(), the code checks 'rx->key' when handling the
RXRPC_SECURITY_KEYRING option. However, this appears to be a logic error.
The code should be checking 'rx->securities' to determine if a keyring has
already been defined for the socket.
Currently, if a user calls setsockopt(RXRPC_SECURITY_KEYRING) multiple
times on the same socket, the check 'if (rx->key)' fails to block
subsequent calls because 'rx->key' has not been defined by the function.
This results in a reference count leak on the keyring.
This patch changes the check to 'rx->securities' to correctly identify if
the socket security keyring has already been configured, returning -EINVAL
on subsequent attempts.
Before the patch:
It shows the keyring reference counter elevated.
$ cat /proc/keys | grep AFSkeys1
27aca8ae I--Q--- 24469721 perm 3f010000 1000 1000 keyring AFSkeys1: empty
$
After the patch:
The keyring reference counter remains stable and subsequent calls return an
error:
$ ./poc
setsockopt: Invalid argument
$
Fixes: 17926a79320a ("[AF_RXRPC]: Provide secure RxRPC sockets for use by userspace and kernel both")
Signed-off-by: Anderson Nascimento <anderson@allelesecurity.com>
Signed-off-by: David Howells <dhowells@redhat.com>
Reviewed-by: Jeffrey Altman <jaltman@auristor.com>
cc: Marc Dionne <marc.dionne@auristor.com>
cc: Eric Dumazet <edumazet@google.com>
cc: "David S. Miller" <davem@davemloft.net>
cc: Jakub Kicinski <kuba@kernel.org>
cc: Paolo Abeni <pabeni@redhat.com>
cc: Simon Horman <horms@kernel.org>
cc: linux-afs@lists.infradead.org
cc: netdev@vger.kernel.org
cc: stable@kernel.org
---
net/rxrpc/af_rxrpc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/rxrpc/af_rxrpc.c b/net/rxrpc/af_rxrpc.c
index 0f90272ac254..0b7ed99a3025 100644
--- a/net/rxrpc/af_rxrpc.c
+++ b/net/rxrpc/af_rxrpc.c
@@ -665,7 +665,7 @@ static int rxrpc_setsockopt(struct socket *sock, int level, int optname,
case RXRPC_SECURITY_KEYRING:
ret = -EINVAL;
- if (rx->key)
+ if (rx->securities)
goto error;
ret = -EISCONN;
if (rx->sk.sk_state != RXRPC_UNBOUND)
^ permalink raw reply related [flat|nested] 13+ messages in thread* [PATCH net v2 10/10] rxrpc: Fix key reference count leak from call->key
2026-03-23 15:04 [PATCH net v2 00/10] rxrpc: Miscellaneous fixes David Howells
` (8 preceding siblings ...)
2026-03-23 15:05 ` [PATCH net v2 09/10] rxrpc: Fix keyring reference count leak in rxrpc_setsockopt() David Howells
@ 2026-03-23 15:05 ` David Howells
9 siblings, 0 replies; 13+ messages in thread
From: David Howells @ 2026-03-23 15:05 UTC (permalink / raw)
To: netdev
Cc: David Howells, Marc Dionne, Jakub Kicinski, David S. Miller,
Eric Dumazet, Paolo Abeni, linux-afs, linux-kernel,
Anderson Nascimento, Jeffrey Altman, Simon Horman, stable
From: Anderson Nascimento <anderson@allelesecurity.com>
When creating a client call in rxrpc_alloc_client_call(), the code obtains
a reference to the key. This is never cleaned up and gets leaked when the
call is destroyed.
Fix this by freeing call->key in rxrpc_destroy_call().
Before the patch, it shows the key reference counter elevated:
$ cat /proc/keys | grep afs@54321
1bffe9cd I--Q--i 8053480 4169w 3b010000 1000 1000 rxrpc afs@54321: ka
$
After the patch, the invalidated key is removed when the code exits:
$ cat /proc/keys | grep afs@54321
$
Fixes: f3441d4125fc ("rxrpc: Copy client call parameters into rxrpc_call earlier")
Signed-off-by: Anderson Nascimento <anderson@allelesecurity.com>
Co-developed-by: David Howells <dhowells@redhat.com>
Signed-off-by: David Howells <dhowells@redhat.com>
Reviewed-by: Jeffrey Altman <jaltman@auristor.com>
cc: Marc Dionne <marc.dionne@auristor.com>
cc: Eric Dumazet <edumazet@google.com>
cc: "David S. Miller" <davem@davemloft.net>
cc: Jakub Kicinski <kuba@kernel.org>
cc: Paolo Abeni <pabeni@redhat.com>
cc: Simon Horman <horms@kernel.org>
cc: linux-afs@lists.infradead.org
cc: netdev@vger.kernel.org
cc: stable@kernel.org
---
net/rxrpc/call_object.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/net/rxrpc/call_object.c b/net/rxrpc/call_object.c
index 0e47751d5937..57c15aa1e9b5 100644
--- a/net/rxrpc/call_object.c
+++ b/net/rxrpc/call_object.c
@@ -694,6 +694,7 @@ static void rxrpc_destroy_call(struct work_struct *work)
rxrpc_put_bundle(call->bundle, rxrpc_bundle_put_call);
rxrpc_put_peer(call->peer, rxrpc_peer_put_call);
rxrpc_put_local(call->local, rxrpc_local_put_call);
+ key_put(call->key);
call_rcu(&call->rcu, rxrpc_rcu_free_call);
}
^ permalink raw reply related [flat|nested] 13+ messages in thread