Re: [PATCH net] net: free the policies if a socket's clone fails late

[kuniyu@google.com]

On Sat, 17 Oct 2026 01:39:12 +0000, Alexei Starovoitov wrote:
> From: Josef Bacik <josef@toxicpanda.com>
> 
> sk_clone() clones the IPsec policies of the parent and then its BPF socket
> storage. If the latter fails, the new socket is freed with sk_destruct
> cleared, as it is still a raw copy of the parent. No code which knows about
> the policies of a socket gets to see it, and the two policies which have
> just been cloned are lost. They also stay on the list of all policies of
> the network namespace and in its count of socket policies.
> 
> bpf_sk_storage_clone() fails if memory is short, or if the storage doesn't
> fit into net.core.optmem_max.
> 
> Free the policies before leaving. This can't be done for all users of the
> label: if the socket filter could not be charged, sk_policy[] still holds
> the pointers of the parent.
> 
> Fixes: 8f51dfc73bf1 ("bpf: support cloning sk storage on accept()")
> Signed-off-by: Josef Bacik <josef@toxicpanda.com>
> Signed-off-by: Alexei Starovoitov <ast@kernel.org>

Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>