[PATCH net] net: free the policies if a socket's clone fails late

[Alexei Starovoitov <alexei.starovoitov@gmail.com>]

From: Josef Bacik <josef@toxicpanda.com>

sk_clone() clones the IPsec policies of the parent and then its BPF socket
storage. If the latter fails, the new socket is freed with sk_destruct
cleared, as it is still a raw copy of the parent. No code which knows about
the policies of a socket gets to see it, and the two policies which have
just been cloned are lost. They also stay on the list of all policies of
the network namespace and in its count of socket policies.

bpf_sk_storage_clone() fails if memory is short, or if the storage doesn't
fit into net.core.optmem_max.

Free the policies before leaving. This can't be done for all users of the
label: if the socket filter could not be charged, sk_policy[] still holds
the pointers of the parent.

Fixes: 8f51dfc73bf1 ("bpf: support cloning sk storage on accept()")
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
---
 net/core/sock.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/net/core/sock.c b/net/core/sock.c
index e8551df8330f..d311f56803ed 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -2577,8 +2577,10 @@ struct sock *sk_clone(const struct sock *sk, const gfp_t priority,
 		goto free;
 	}
 
-	if (bpf_sk_storage_clone(sk, newsk))
+	if (bpf_sk_storage_clone(sk, newsk)) {
+		xfrm_sk_free_policy(newsk);
 		goto free;
+	}
 
 	/* Clear sk_user_data if parent had the pointer tagged
 	 * as not suitable for copying when cloning.
-- 
2.55.0