[bug report] net/sctp: convert sctp_getsockopt_peeloff_common() to FD_PREPARE()

[bug report] net/sctp: convert sctp_getsockopt_peeloff_common() to FD_PREPARE()

[Dan Carpenter]

Hello Christian Brauner,

Commit 859ceac73090 ("net/sctp: convert
sctp_getsockopt_peeloff_common() to FD_PREPARE()") from Nov 23, 2025
(linux-next), leads to the following Smatch static checker warning:

	net/sctp/socket.c:5733 sctp_getsockopt_peeloff_common()
	warn: 'newsock' was already freed. (line 5731)

net/sctp/socket.c
    5719 static int sctp_getsockopt_peeloff_common(struct sock *sk,
    5720                                           sctp_peeloff_arg_t *peeloff, int len,
    5721                                           char __user *optval,
    5722                                           int __user *optlen, unsigned flags)
    5723 {
    5724         struct socket *newsock;
    5725         int retval;
    5726 
    5727         retval = sctp_do_peeloff(sk, peeloff->associd, &newsock);
    5728         if (retval < 0)
    5729                 return retval;
    5730 
    5731         FD_PREPARE(fdf, flags & SOCK_CLOEXEC, sock_alloc_file(newsock, 0, NULL));
                                                                       ^^^^^^^
sock_alloc_file() calls sock_release() on error.

    5732         if (fdf.err) {
--> 5733                 sock_release(newsock);
                         ^^^^^^^^^^^^^^^^^^^^^
double free.

    5734                 return fdf.err;
    5735         }
    5736 
    5737         pr_debug("%s: sk:%p, newsk:%p, sd:%d\n", __func__, sk, newsock->sk,
    5738                  fd_prepare_fd(fdf));
    5739 
    5740         if (flags & SOCK_NONBLOCK)
    5741                 fd_prepare_file(fdf)->f_flags |= O_NONBLOCK;
    5742 
    5743         /* Return the fd mapped to the new socket.  */
    5744         if (put_user(len, optlen))
    5745                 return -EFAULT;
    5746 
    5747         peeloff->sd = fd_prepare_fd(fdf);
    5748         if (copy_to_user(optval, peeloff, len))
    5749                 return -EFAULT;
    5750 
    5751         return fd_publish(fdf);
    5752 }

regards,
dan carpenter

Re: [bug report] net/sctp: convert sctp_getsockopt_peeloff_common() to FD_PREPARE()

[Dan Carpenter]

Similar warning in sock_map_fd()

net/socket.c:510 sock_map_fd() warn: passing freed memory 'sock' (line 508)

net/socket.c
   504  static int sock_map_fd(struct socket *sock, int flags)
   505  {
   506          int fd;
   507  
   508          fd = FD_ADD(flags, sock_alloc_file(sock, flags, NULL));
                                                   ^^^^
Freed on error.

   509          if (fd < 0)
   510                  sock_release(sock);
                        ^^^^^^^^^^^^^^^^^^
double freed.

   511          return fd;
   512  }

regards,
dan carpenter