[PATCH net] net: free the policies if a socket's clone fails late

[PATCH net] net: free the policies if a socket's clone fails late

[Alexei Starovoitov]

From: Josef Bacik <josef@toxicpanda.com>

sk_clone() clones the IPsec policies of the parent and then its BPF socket
storage. If the latter fails, the new socket is freed with sk_destruct
cleared, as it is still a raw copy of the parent. No code which knows about
the policies of a socket gets to see it, and the two policies which have
just been cloned are lost. They also stay on the list of all policies of
the network namespace and in its count of socket policies.

bpf_sk_storage_clone() fails if memory is short, or if the storage doesn't
fit into net.core.optmem_max.

Free the policies before leaving. This can't be done for all users of the
label: if the socket filter could not be charged, sk_policy[] still holds
the pointers of the parent.

Fixes: 8f51dfc73bf1 ("bpf: support cloning sk storage on accept()")
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
---
 net/core/sock.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/net/core/sock.c b/net/core/sock.c
index e8551df8330f..d311f56803ed 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -2577,8 +2577,10 @@ struct sock *sk_clone(const struct sock *sk, const gfp_t priority,
 		goto free;
 	}
 
-	if (bpf_sk_storage_clone(sk, newsk))
+	if (bpf_sk_storage_clone(sk, newsk)) {
+		xfrm_sk_free_policy(newsk);
 		goto free;
+	}
 
 	/* Clear sk_user_data if parent had the pointer tagged
 	 * as not suitable for copying when cloning.
-- 
2.55.0

Re: [PATCH net] net: free the policies if a socket's clone fails late

[netdev-bot+sinfo]

Hi!

This is an automated message. This series looks like a fix, but its
commit messages seem to be missing some information:

 - How the issue was discovered, e.g. hit in production, hit during
   development, syzbot report, manual code inspection, LLM or static
   analysis tool scan.

 - Whether the issue was actually triggered, or is only theoretical
   (e.g. found by code inspection). If it was triggered please include
   the symptoms, like the stack trace or error messages.

Please do not repost the series just to address the above. Instead,
reply to this email with the missing information, so that reviewers
can take it into account. If the series needs another revision for
other reasons, please include the information in the commit messages
then.

The evaluation is done by an LLM so it may be wrong, if you think
that is the case please reply and explain.

Re: [PATCH net] net: free the policies if a socket's clone fails late

[kuniyu]

On Sat, 17 Oct 2026 01:39:12 +0000, Alexei Starovoitov wrote:
> From: Josef Bacik <josef@toxicpanda.com>
> 
> sk_clone() clones the IPsec policies of the parent and then its BPF socket
> storage. If the latter fails, the new socket is freed with sk_destruct
> cleared, as it is still a raw copy of the parent. No code which knows about
> the policies of a socket gets to see it, and the two policies which have
> just been cloned are lost. They also stay on the list of all policies of
> the network namespace and in its count of socket policies.
> 
> bpf_sk_storage_clone() fails if memory is short, or if the storage doesn't
> fit into net.core.optmem_max.
> 
> Free the policies before leaving. This can't be done for all users of the
> label: if the socket filter could not be charged, sk_policy[] still holds
> the pointers of the parent.
> 
> Fixes: 8f51dfc73bf1 ("bpf: support cloning sk storage on accept()")
> Signed-off-by: Josef Bacik <josef@toxicpanda.com>
> Signed-off-by: Alexei Starovoitov <ast@kernel.org>

Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>