09dba37eee
handshake_nl_accept_doit() needs the file pointer backing req->hr_sk->sk_socket to survive the window between handshake_req_next() and the subsequent FD_PREPARE() and get_file(). The submit-side sock_hold() does not provide that. sk_refcnt keeps struct sock alive, but struct socket is owned by sock->file: when the consumer fputs the last file reference, sock_release() tears the socket down regardless of any sock_hold. Add an hr_file pointer to struct handshake_req and acquire an explicit reference on sock->file during handshake_req_submit(). handshake_complete() and handshake_req_cancel() release the reference on the completion-bit-winning path. The submit error path must also release the file reference, but after rhashtable insertion a concurrent handshake_req_cancel() can discover the request and race the error path. Gate the error-path cleanup -- sk_destruct restoration, fput, and request destruction -- with test_and_set_bit(HANDSHAKE_F_REQ_COMPLETED), the same serialization handshake_complete() and handshake_req_cancel() already use. When cancel has already claimed ownership, the submit error path returns without touching the request; socket teardown handles final destruction. The accept-side dereferences are not yet retargeted; that change comes in the next patch. Signed-off-by: Chuck Lever <chuck.lever@oracle.com> Link: https://patch.msgid.link/20260525-handshake-file-pin-v3-4-66c616906ead@oracle.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
95 lines
2.4 KiB
C
95 lines
2.4 KiB
C
/* SPDX-License-Identifier: GPL-2.0-only */
|
|
/*
|
|
* Generic netlink handshake service
|
|
*
|
|
* Author: Chuck Lever <chuck.lever@oracle.com>
|
|
*
|
|
* Copyright (c) 2023, Oracle and/or its affiliates.
|
|
*/
|
|
|
|
#ifndef _INTERNAL_HANDSHAKE_H
|
|
#define _INTERNAL_HANDSHAKE_H
|
|
|
|
/* Per-net namespace context */
|
|
struct handshake_net {
|
|
spinlock_t hn_lock; /* protects next 3 fields */
|
|
int hn_pending;
|
|
int hn_pending_max;
|
|
struct list_head hn_requests;
|
|
|
|
unsigned long hn_flags;
|
|
};
|
|
|
|
enum hn_flags_bits {
|
|
HANDSHAKE_F_NET_DRAINING,
|
|
};
|
|
|
|
struct file;
|
|
struct handshake_proto;
|
|
|
|
/* One handshake request */
|
|
struct handshake_req {
|
|
struct list_head hr_list;
|
|
struct rhash_head hr_rhash;
|
|
unsigned long hr_flags;
|
|
const struct handshake_proto *hr_proto;
|
|
struct file *hr_file;
|
|
struct sock *hr_sk;
|
|
void (*hr_odestruct)(struct sock *sk);
|
|
|
|
/* Always the last field */
|
|
char hr_priv[];
|
|
};
|
|
|
|
enum hr_flags_bits {
|
|
HANDSHAKE_F_REQ_COMPLETED,
|
|
HANDSHAKE_F_REQ_SESSION,
|
|
};
|
|
|
|
struct genl_info;
|
|
|
|
/* Invariants for all handshake requests for one transport layer
|
|
* security protocol
|
|
*/
|
|
struct handshake_proto {
|
|
int hp_handler_class;
|
|
size_t hp_privsize;
|
|
unsigned long hp_flags;
|
|
|
|
int (*hp_accept)(struct handshake_req *req,
|
|
struct genl_info *info, int fd);
|
|
void (*hp_done)(struct handshake_req *req,
|
|
int status,
|
|
struct genl_info *info);
|
|
void (*hp_destroy)(struct handshake_req *req);
|
|
};
|
|
|
|
enum hp_flags_bits {
|
|
HANDSHAKE_F_PROTO_NOTIFY,
|
|
};
|
|
|
|
/* alert.c */
|
|
int tls_alert_send(struct socket *sock, u8 level, u8 description);
|
|
|
|
/* netlink.c */
|
|
int handshake_genl_notify(struct net *net, const struct handshake_proto *proto,
|
|
gfp_t flags);
|
|
struct nlmsghdr *handshake_genl_put(struct sk_buff *msg,
|
|
struct genl_info *info);
|
|
struct handshake_net *handshake_pernet(struct net *net);
|
|
|
|
/* request.c */
|
|
struct handshake_req *handshake_req_alloc(const struct handshake_proto *proto,
|
|
gfp_t flags);
|
|
int handshake_req_hash_init(void);
|
|
void handshake_req_hash_destroy(void);
|
|
void *handshake_req_private(struct handshake_req *req);
|
|
struct handshake_req *handshake_req_hash_lookup(struct sock *sk);
|
|
struct handshake_req *handshake_req_next(struct handshake_net *hn, int class);
|
|
int handshake_req_submit(struct socket *sock, struct handshake_req *req,
|
|
gfp_t flags);
|
|
void handshake_complete(struct handshake_req *req, int status,
|
|
struct genl_info *info);
|
|
bool handshake_req_cancel(struct sock *sk);
|
|
|
|
#endif /* _INTERNAL_HANDSHAKE_H */
|