rxrpc: Fix leak of connection from OOB challenge

Fix leak of connection object from OOB challenge queue when response is
provided by userspace.

Fixes: 5800b1cf3fd8 ("rxrpc: Allow CHALLENGEs to the passed to the app for a RESPONSE")
Link: https://sashiko.dev/#/patchset/20260609140911.838677-1-dhowells%40redhat.com
Signed-off-by: David Howells <dhowells@redhat.com>
cc: Marc Dionne <marc.dionne@auristor.com>
cc: Simon Horman <horms@kernel.org>
cc: linux-afs@lists.infradead.org
cc: stable@kernel.org
Link: https://patch.msgid.link/20260624163819.3017002-3-dhowells@redhat.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

diff --git a/net/rxrpc/oob.c b/net/rxrpc/oob.c
index 05ca9c1..3318c8b 100644 (file)
--- a/net/rxrpc/oob.c
+++ b/net/rxrpc/oob.c
@@ -210,6 +210,11 @@ static int rxrpc_respond_to_oob(struct rxrpc_sock *rx,
                break;
        }
 
+       switch (skb->mark) {
+       case RXRPC_OOB_CHALLENGE:
+               rxrpc_put_connection(sp->chall.conn, rxrpc_conn_put_oob);
+               break;
+       }
        rxrpc_free_skb(skb, rxrpc_skb_put_oob);
        return ret;
 }