diff options
| author | Xuanqiang Luo <luoxuanqiang@kylinos.cn> | 2026-07-12 21:03:43 +0800 |
|---|---|---|
| committer | Paolo Abeni <pabeni@redhat.com> | 2026-07-17 13:17:46 +0200 |
| commit | 2c72eb6286347d05a885412fb076993bd5286b53 (patch) | |
| tree | fb703bb95a7b88c76f7758507af41d9afad5e90b | |
| parent | 04aeddf2dadd0eb7ad016a766dcbe9c983311f09 (diff) | |
llc: fix SAP refcount leak when creating incoming sockets
llc_sap_add_socket() takes a SAP reference for each socket added to a SAP,
and llc_sap_remove_socket() releases it. llc_create_incoming_sock() takes
an additional SAP reference after adding the child socket.
This extra reference was balanced by an explicit llc_sap_put() in
llc_ui_release() until commit 3100aa9d74db ("llc: fix SAP reference
counting w.r.t. socket handling") removed that put. The corresponding hold
in the accept path was left behind.
When such a child socket is removed, only the reference taken by
llc_sap_add_socket() is released. The extra reference keeps the SAP alive
after its last socket is removed. Remove the obsolete hold.
Fixes: 3100aa9d74db ("llc: fix SAP reference counting w.r.t. socket handling")
Cc: stable@vger.kernel.org
Signed-off-by: Xuanqiang Luo <luoxuanqiang@kylinos.cn>
Link: https://patch.msgid.link/20260712130343.518797-1-xuanqiang.luo@linux.dev
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
| -rw-r--r-- | net/llc/llc_conn.c | 1 |
1 files changed, 0 insertions, 1 deletions
diff --git a/net/llc/llc_conn.c b/net/llc/llc_conn.c index e8f427375c68..260460d50f54 100644 --- a/net/llc/llc_conn.c +++ b/net/llc/llc_conn.c @@ -767,7 +767,6 @@ static struct sock *llc_create_incoming_sock(struct sock *sk, newllc->dev = dev; dev_hold(dev); llc_sap_add_socket(llc->sap, newsk); - llc_sap_hold(llc->sap); out: return newsk; } |