From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pl1-f198.google.com (mail-pl1-f198.google.com [209.85.214.198]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 352E2381B0D for ; Sat, 17 Oct 2026 04:05:00 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.198 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1792209902; cv=none; b=g81LIHiIN/+mAZb1QWccc/c8Vjt1cKzLtbz7/XAMUd1eI8Nd7WtQRxuXsVbqO4fQQ3fR6Gv9kM5TjOS7YknWA99yZWQYwCYbE23Fgf3ByWfDl8D5YBTGQ207NM5TdhP5RmghF4+DP1x1EY6KGWBzBqtYj+VDuJyhrWfcT6LCd7U= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1792209902; c=relaxed/simple; bh=fO0mzPZiShDsFNIz7gwX6d4eDvPM2pb6gIMTwEOvhkc=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=TLJvFihbbbXUIH7MccJ6XXz+mhMXMxd2uNsT4VsE4n0eoTzJZ5gtb0DLIbJx2kKO9+uLLbYk5JfG29gnef40zjcRESccNeUneZBWuJzVBQviiEjQ0sOdTgvyZwd4dyj1cUhgvd1ZQLwEp9ayGjU/cpOwLN9NIejGFzb+us5b/cI= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--kuniyu.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=DMi9zl+E; arc=none smtp.client-ip=209.85.214.198 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--kuniyu.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="DMi9zl+E" Received: by mail-pl1-f198.google.com with SMTP id d9443c01a7336-2e832c03576so6286005ad.1 for ; Fri, 16 Oct 2026 21:05:00 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1792209900; x=1792814700; darn=vger.kernel.org; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:from:to:cc:subject:date:message-id:reply-to :content-type; bh=hu6qZrNNR8jshmCrO+tEIuOZOsw8C215drmXj26mpdo=; b=DMi9zl+EKs0ZMTd0ekAFLgSODNRuKmYAyXcD4WU9ELunkuB/diU6LgoB/ztYCB5KJm zUeUMifxZiAnj7mi/9qTLdaPqCIzin/Dr7yvSy2LxfppTrEWvVZXqTiEURvP0Uk9flBd ZQSJ+TrK/lNTSoMKHaamYwaRIQ83vOVC94vb9+Zta3v+UgR/hh8/XRKar06OjIHwsJzI GeSlpoeNHWfEH0ccigAbNssWZrCJuPC6Pw7BHnk0yasX8iJ2ZfiE0UbJhwGoEuC6NGJF FnCVEe2pvKalrRJHsTnd0oEiV9Nffu/JB1QT7r334YBhiAXxuP2PJ4vKScYh/Qm7/WNh ZPQg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792209900; x=1792814700; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=hu6qZrNNR8jshmCrO+tEIuOZOsw8C215drmXj26mpdo=; b=iOCYy/z6a0DHtx/N5s+Uqvd0ff/xffhXhCcDPRTLBJ2X2WGmCo5xjoLirOSnJCkQpM aLEbplfwp3E50g0cftgNWWrCg2Oci/wjf+j24EK2OaeElFgcBX2RYO4qyZ3W92e74BRT 19XAlhk9GbyUaBzDnMp/DjqTyUdami4cfKwimD9wQguafrJrBKI/6DprgG40yyaxOnw1 BI5NUKD9jNLOQqNfGx0m3TSp9IroCmRRFpN60HMlcY4ynQrJ/VrmvOjMx3Kcbq8QgTI7 9zNDRDde9Gcy9QJUQWSZ8y+m/UJ/1AJ12bifWc9c3SI6RjxmvDyXWn/dyZIBohM7Q12A nA0w== X-Gm-Message-State: AFq9FYJ2sPI9DYpi8vC1VvV1Nfezzi1TjfmK/Zx3D9RJF2AuW8ufAqsR CsryUXbU12b9lt2VzC+MYFMg4Kx63AWU5RuxNupiLdiL/DIbGm1G7K7SKjSNPL4jnC67so8aMH+ zVz90CQ== X-Received: from plbbi4.prod.google.com ([2002:a17:902:bf04:b0:2e2:dd23:fd42]) (user=kuniyu job=prod-delivery.src-stubby-dispatcher) by 2002:a17:902:e84a:b0:2e9:4b65:368e with SMTP id d9443c01a7336-2e9a6d1eaa1mr17669515ad.15.1792209900119; Fri, 16 Oct 2026 21:05:00 -0700 (PDT) Date: Sat, 17 Oct 2026 04:04:59 +0000 In-Reply-To: <20261017013912.396296-1-alexei.starovoitov@gmail.com> Precedence: bulk X-Mailing-List: netdev@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20261017013912.396296-1-alexei.starovoitov@gmail.com> Message-ID: Subject: Re: [PATCH net] net: free the policies if a socket's clone fails late From: kuniyu@google.com To: Alexei Starovoitov Cc: netdev@vger.kernel.org, bpf@vger.kernel.org, daniel@iogearbox.net, andrii@kernel.org, eddyz87@gmail.com, memxor@gmail.com, josef@toxicpanda.com, mason@kernel.org, steffen.klassert@secunet.com, herbert@gondor.apana.org.au Content-Type: text/plain; charset="us-ascii" On Sat, 17 Oct 2026 01:39:12 +0000, Alexei Starovoitov wrote: > From: Josef Bacik > > sk_clone() clones the IPsec policies of the parent and then its BPF socket > storage. If the latter fails, the new socket is freed with sk_destruct > cleared, as it is still a raw copy of the parent. No code which knows about > the policies of a socket gets to see it, and the two policies which have > just been cloned are lost. They also stay on the list of all policies of > the network namespace and in its count of socket policies. > > bpf_sk_storage_clone() fails if memory is short, or if the storage doesn't > fit into net.core.optmem_max. > > Free the policies before leaving. This can't be done for all users of the > label: if the socket filter could not be charged, sk_policy[] still holds > the pointers of the parent. > > Fixes: 8f51dfc73bf1 ("bpf: support cloning sk storage on accept()") > Signed-off-by: Josef Bacik > Signed-off-by: Alexei Starovoitov Reviewed-by: Kuniyuki Iwashima