Re: [PATCH net] net: mctp: free reassembly head skb when key_add fails on SOM

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Paolo Abeni <pabeni@xxxxxxxxxx>:

On Sat, 24 Oct 2026 19:04:28 -0300 you wrote:
> When a start-of-message fragment creates a new reassembly key on the
> broadcast/bind path, mctp_frag_queue() stores the skb as
> key->reasm_head before the key is made observable with mctp_key_add().
> 
> If mctp_key_add() fails (a race with another SOM packet for the same
> source/dest/tag, or the receiving socket going away), the error path
> only drops the key reference via mctp_key_unref().  The final key
> destructor frees the key itself but not key->reasm_head, and since the
> key was never added to any list, neither the expiry worker nor socket
> teardown can reach it to release the queued fragment.  The skb is
> leaked.
> 
> [...]

Here is the summary with links:
  - [net] net: mctp: free reassembly head skb when key_add fails on SOM
    https://git.kernel.org/netdev/net/c/d2bfe74a8fe2

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html