Re: [PATCH stable-6.18.y] io_uring/net: Avoid msghdr on op_connect/op_bind async data

[Gabriel Krisman Bertazi <krisman@suse.de>]

Greg KH <gregkh@linuxfoundation.org> writes:

> On Wed, Jun 17, 2026 at 01:51:02PM -0400, Gabriel Krisman Bertazi wrote:
>> [ Upstream commit 3979840cd858f30f43ea9f4e7f7f1f56de82d698 ]
>> This fixes a memory leak due to the lack of the cleanup hook for the
>> iovec.  The stable backport differs from upstream by dropping the
>> io_connect_bpf_populate hunk, which didn't exist at the time and by
>> fixing the merge conflict due to the introduction of
>> io_bind_file_create.
>> 
>> Both IORING_OP_CONNECT and IORING_OP_BIND reuse the msghdr object just
>> to store the sockaddr. Beyond allocating a much larger object than
>> needed, msghdr can also wrap an iovec, which will be recycled
>> unnecessarily. This uses the sockaddr directly.
>> 
>> Cc: stable@vger.kernel.org
>> Signed-off-by: Gabriel Krisman Bertazi <krisman@suse.de>
>> Link: https://patch.msgid.link/20260602215327.1885109-2-krisman@suse.de
>> Signed-off-by: Jens Axboe <axboe@kernel.dk>
>> Signed-off-by: Gabriel Krisman Bertazi <krisman@suse.de>
>> ---
>>  io_uring/net.c   | 36 ++++++++++++++++++------------------
>>  io_uring/opdef.c |  4 ++--
>>  2 files changed, 20 insertions(+), 20 deletions(-)
>
> This isn't in any release yet?

It is queued in Linus tree during the current merge window for 7.2

>  why just 6.18?

The backports are slightly different, so they were sent separately. The bug
exists since 6.12.

> And why wan't it
> originally tagged for stable?

Because it was originally a clean up that we later realized fixes a bug
and should go to stable.

> thanks,
>
> greg k-h

-- 
Gabriel Krisman Bertazi