Re: [PATCH mptcp-net] selftests: mptcp: fix an UAF in mptcp_connect.c

August 14, 2026 at 6:50 PM, "Paolo Abeni" <[email protected] mailto:[email protected]?to=%22Paolo%20Abeni%22%20%3Cpabeni%40redhat.com%3E > wrote:


> 
> Hi,
> 
> On 8/14/26 8:42 AM, [email protected] wrote:
> 
> > 
> > Sorry for this, after reviewing sashiko's comment, I think this modification
> >  below should be better:
> >  
> >  diff --git a/tools/testing/selftests/net/mptcp/mptcp_connect.c b/tools/testing/selftests/net/mptcp/mptcp_connect.c
> >  index ea4cb6c1bd5e..c81ec4400bef 100644
> >  --- a/tools/testing/selftests/net/mptcp/mptcp_connect.c
> >  +++ b/tools/testing/selftests/net/mptcp/mptcp_connect.c
> >  @@ -421,7 +421,8 @@ static int sock_connect_mptcp(const char * const remoteaddr,
> >  sock = -1;
> >  }
> >  
> >  - freeaddrinfo(addr);
> >  + if (sock == -1)
> >  + freeaddrinfo(addr);
> >  if (sock != -1)
> >  SOCK_TEST_TCPULP(sock, proto);
> >  return sock;
> >  @@ -1424,6 +1425,7 @@ int main_loop(void)
> >  }
> >  
> >  out:
> >  + freeaddrinfo(peer);
> >  if (cfg_input)
> >  close(fd_in);
> >  
> >  If you think it's OK, I can send v2 immediately.
> > 
> I'm sorry for being in late.
> 

Hi Paolo,

So nice to get your reply.

> This is in a better direction but still will be not fully correct:
> freeaddrinfo() must be called on the argument returned by getaddrinfo()
> - in this case: `addr`.
> 
> Otherwise some addresses will not be freed.
> 
> Since sock_connect_mptcp() is invoked only once per program execution,
> and not-freed memory will _not_ be leaked at process exit time, I think
> the easier solution is to remove the:
> 
>  freeaddrinfo(addr);

Sounds great!

> 
> statement, adding a comment alike:
> 
>  /* All the allocated memory is released at exit() time, this
>  * is executed only once and ownership of a single address has
>  * to be transferred to the caller. Keep it simple and avoid
>  * later freeaddrinfo() entirely.
>  */

I've just send the v2 and using AI to simplify the comment —— hope you
don’t mind.

Thanks
Gang

>  xgetaddrinfo(listenaddr, port, &hints, &addr);
> 
> /P
>