Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
MIME-Version: 1.0
Date:   Tue, 14 Sep 2021 02:21:19 +0000
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable
From:   yajun.deng@linux.dev
Message-ID: <2a95994f251db7d1c5d3318f4468b324@linux.dev>
Subject: Re: [PATCH] Revert "ipv4: fix memory leaks in ip_cmsg_send()
 callers"
To:     "Eric Dumazet" <edumazet@google.com>
Cc:     "David Miller" <davem@davemloft.net>,
        "Hideaki YOSHIFUJI" <yoshfuji@linux-ipv6.org>,
        "David Ahern" <dsahern@kernel.org>,
        "Jakub Kicinski" <kuba@kernel.org>,
        "netdev" <netdev@vger.kernel.org>,
        "LKML" <linux-kernel@vger.kernel.org>
In-Reply-To: <CANn89iKsbdMV1JmjzzGNu-2janfudb-t-Le-JempLrroJcNH-Q@mail.gmail.com>
References: <CANn89iKsbdMV1JmjzzGNu-2janfudb-t-Le-JempLrroJcNH-Q@mail.gmail.com>
 <20210913040442.2627-1-yajun.deng@linux.dev>
Precedence: bulk

September 14, 2021 12:15 AM, "Eric Dumazet" <edumazet@google.com> wrote:=
=0A=0A> On Sun, Sep 12, 2021 at 9:04 PM Yajun Deng <yajun.deng@linux.dev>=
 wrote:=0A> =0A>> This reverts commit 919483096bfe75dda338e98d56da91a2637=
46a0a.=0A>> =0A>> There is only when ip_options_get() return zero need to=
 free.=0A>> It already called kfree() when return error.=0A>> =0A>> Fixes=
: 919483096bfe ("ipv4: fix memory leaks in ip_cmsg_send() callers")=0A>> =
Signed-off-by: Yajun Deng <yajun.deng@linux.dev>=0A>> ---=0A> =0A> I do n=
ot think this is a valid patch, not sure why David has merged so=0A> soon=
 before us reviewing it ?=0A> =0A> You are bringing back the memory leaks=
.=0A> =0A> ip_cmsg_send() can loop over multiple cmsghdr()=0A> =0A=0AYes,=
 I forgot the loop, it was my mistake.=0A=0A> If IP_RETOPTS has been succ=
essful, but following cmsghdr generates an error,=0A> we do not free ipc.=
ok=0A> =0A> If IP_RETOPTS is not successful, we have freed the allocated =
temporary space,=0A> not the one currently in ipc.opt.=0A> =0A> Can you s=
hare what your exact finding was, perhaps a syzbot repro ???=0A> =0A> Tha=
nks.