Re: [PATCH 6.18.y 0/5] Backport fixes for handshake

On Wed, Aug 05, 2026 at 05:13:44PM +0800, Wentao Guan wrote:
> Christian Brauner (2):
>   file: add FD_{ADD,PREPARE}()
>   net/handshake: convert handshake_nl_accept_doit() to FD_PREPARE()
>
> Chuck Lever (3):
>   net/handshake: Take a long-lived file reference at submit
>   net/handshake: hand off the pinned file reference to accept_doit
>   net/handshake: Close the submit-side sock_hold race

The series is missing two follow-ups, and without them 6.18 ends up worse
off than it is today:

- dabac51b8102 ("net/handshake: Fix null-ptr-deref in handshake_complete()")
  fixes fe67b063f687 ("net/handshake: convert handshake_nl_accept_doit() to
  FD_PREPARE()"), your 2/5. After that conversion the ordinary "no pending
  request" ACCEPT path falls through to handshake_complete(NULL, -EIO, NULL)
  and dereferences req->hr_sk.

- d2ea4d254d04 ("file: ensure cleanup") fixes 011703a9acd7 ("file: add
  FD_{ADD,PREPARE}()"), your 1/5. Without it the imported cleanup guard is
  err-gated and no-ops on the accept-failure path, leaking an fd and a
  struct file.

Either way, please get an ack from the handshake maintainers.

-- 
Thanks,
Sasha