Re: [PATCH 6.18.y 0/5] Backport fixes for handshake

Hi,

> On Wed, Aug 05, 2026 at 05:13:44PM +0800, Wentao Guan wrote:
> > Christian Brauner (2):
> >   file: add FD_{ADD,PREPARE}()
> >   net/handshake: convert handshake_nl_accept_doit() to FD_PREPARE()
> >
> > Chuck Lever (3):
> >   net/handshake: Take a long-lived file reference at submit
> >   net/handshake: hand off the pinned file reference to accept_doit
> >   net/handshake: Close the submit-side sock_hold race
> 
> The series is missing two follow-ups, and without them 6.18 ends up worse
> off than it is today:
> 
> - dabac51b8102 ("net/handshake: Fix null-ptr-deref in handshake_complete()")
>   fixes fe67b063f687 ("net/handshake: convert handshake_nl_accept_doit() to
>   FD_PREPARE()"), your 2/5. After that conversion the ordinary "no pending
>   request" ACCEPT path falls through to handshake_complete(NULL, -EIO, NULL)
>   and dereferences req->hr_sk.
> 
> - d2ea4d254d04 ("file: ensure cleanup") fixes 011703a9acd7 ("file: add
>   FD_{ADD,PREPARE}()"), your 1/5. Without it the imported cleanup guard is
>  err-gated and no-ops on the accept-failure path, leaking an fd and a
>  struct file.

> Either way, please get an ack from the handshake maintainers.
Thanks for your review, forgeting double check the backport fixes,
I will fix them and send v2.

BRs
Wentao Guan