path: root/net/rxrpc/call_object.c
diff options
authorDavid Howells <dhowells@redhat.com>2020-09-30 21:27:18 +0100
committerDavid Howells <dhowells@redhat.com>2020-10-05 16:35:57 +0100
commit2d914c1bf079491d1113051a7232250267f3f2e4 (patch)
tree13abaf75ff328d1f3248d871985df0e0057a390d /net/rxrpc/call_object.c
parentfa1d113a0f96f9ab7e4fe4f8825753ba1e34a9d3 (diff)
rxrpc: Fix accept on a connection that need securing
When a new incoming call arrives at an userspace rxrpc socket on a new connection that has a security class set, the code currently pushes it onto the accept queue to hold a ref on it for the socket. This doesn't work, however, as recvmsg() pops it off, notices that it's in the SERVER_SECURING state and discards the ref. This means that the call runs out of refs too early and the kernel oopses. By contrast, a kernel rxrpc socket manually pre-charges the incoming call pool with calls that already have user call IDs assigned, so they are ref'd by the call tree on the socket. Change the mode of operation for userspace rxrpc server sockets to work like this too. Although this is a UAPI change, server sockets aren't currently functional. Fixes: 248f219cb8bc ("rxrpc: Rewrite the data and ack handling code") Signed-off-by: David Howells <dhowells@redhat.com>
Diffstat (limited to 'net/rxrpc/call_object.c')
1 files changed, 1 insertions, 4 deletions
diff --git a/net/rxrpc/call_object.c b/net/rxrpc/call_object.c
index a40fae013942..ed49769b459d 100644
--- a/net/rxrpc/call_object.c
+++ b/net/rxrpc/call_object.c
@@ -23,7 +23,6 @@ const char *const rxrpc_call_states[NR__RXRPC_CALL_STATES] = {
@@ -352,9 +351,7 @@ void rxrpc_incoming_call(struct rxrpc_sock *rx,
call->call_id = sp->hdr.callNumber;
call->service_id = sp->hdr.serviceId;
call->cid = sp->hdr.cid;
- if (sp->hdr.securityIndex > 0)
call->cong_tstamp = skb->tstamp;
/* Set the channel for this call. We don't get channel_lock as we're