Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Date:   Fri, 16 Mar 2018 12:36:29 -0400 (EDT)
Message-Id: <20180316.123629.52512148155674649.davem@davemloft.net>
To:     nicolas.dichtel@6wind.com
Cc:     ben.hutchings@codethink.co.uk, netdev@vger.kernel.org,
        stable@vger.kernel.org, johannes.berg@intel.com,
        gregkh@linuxfoundation.org, linux-kernel@vger.kernel.org
Subject: Re: [PATCH net] netlink: avoid a double skb free in genlmsg_mcast()
From:   David Miller <davem@davemloft.net>
In-Reply-To: <20180314201023.12407-1-nicolas.dichtel@6wind.com>
References: <1520899459.23626.87.camel@codethink.co.uk>
        <20180314201023.12407-1-nicolas.dichtel@6wind.com>
Mime-Version: 1.0
Content-Type: Text/Plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

From: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Date: Wed, 14 Mar 2018 21:10:23 +0100

> nlmsg_multicast() consumes always the skb, thus the original skb must be
> freed only when this function is called with a clone.
> 
> Fixes: cb9f7a9a5c96 ("netlink: ensure to loop over all netns in genlmsg_multicast_allns()")
> Reported-by: Ben Hutchings <ben.hutchings@codethink.co.uk>
> Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>

Yeah these "clone until final send" loops can be tricky to manage.

Good catch, applied and queued up for -stable, thanks.