Re: [PATCH mptcp-net] mptcp: fix double-free on socket dismantle

[Matthieu Baerts <matttbe@kernel.org>]

Hi Davide, Mat,

On 21/02/2024 5:30 pm, Davide Caratti wrote:
> when MPTCP server accepts an incoming connection, it clones its listener
> socket. However, the pointer to 'inet_opt' for the new socket has the same
> value as the original one: as a consequence, on program exit it's possible
> to observe the following splat:

(...)

> Something similar (a refcount underflow) happens with CALIPSO/IPv6. Fix
> this by duplicating IP / IPv6 options after clone, so that
> ip{,6}_sock_destruct() doesn't end up freeing the same memory area twice.

Thank you for the patch and the review!

Now in our tree (fix for -net), with Mat's RvB and Fixes tags:

New patches for t/upstream-net and t/upstream:
- 6d6a1d5ea72e: mptcp: fix double-free on socket dismantle
- Results: 74677c9f0a8c..b35846da7660 (export-net)
- Results: 55a829ff16aa..df010bcea0cb (export)

Cheers,
Matt
-- 
Sponsored by the NGI0 Core fund.