Re: [PATCH mptcp-net] selftests: mptcp: fix an UAF in mptcp_connect.c

Hi,

On 8/14/26 8:42 AM, [email protected] wrote:
> Sorry for this, after reviewing sashiko's comment, I think this modification
> below should be better:
> 
> diff --git a/tools/testing/selftests/net/mptcp/mptcp_connect.c b/tools/testing/selftests/net/mptcp/mptcp_connect.c
> index ea4cb6c1bd5e..c81ec4400bef 100644
> --- a/tools/testing/selftests/net/mptcp/mptcp_connect.c
> +++ b/tools/testing/selftests/net/mptcp/mptcp_connect.c
> @@ -421,7 +421,8 @@ static int sock_connect_mptcp(const char * const remoteaddr,
>                 sock = -1;
>         }
>  
> -       freeaddrinfo(addr);
> +       if (sock == -1)
> +               freeaddrinfo(addr);
>         if (sock != -1)
>                 SOCK_TEST_TCPULP(sock, proto);
>         return sock;
> @@ -1424,6 +1425,7 @@ int main_loop(void)
>         }
>  
>  out:
> +       freeaddrinfo(peer);
>         if (cfg_input)
>                 close(fd_in);
> 
> If you think it's OK, I can send v2 immediately.
I'm sorry for being in late.

This is in a better direction but still will be not fully correct:
freeaddrinfo() must be called on the argument returned by getaddrinfo()
- in this case: `addr`.

Otherwise some addresses will not be freed.

Since sock_connect_mptcp() is invoked only once per program execution,
and not-freed memory will _not_ be leaked at process exit time, I think
the easier solution is to remove the:

	freeaddrinfo(addr);

statement, adding a comment alike:

	/* All the allocated memory is released at exit() time, this
	 * is executed only once and ownership of a single address has
	 * to be transferred to the caller. Keep it simple and avoid
	 * later freeaddrinfo() entirely.
	 */
	xgetaddrinfo(listenaddr, port, &hints, &addr);

/P