diff options
| author |   Gao Feng <gfree.wind@vip.163.com> | 2018-04-16 10:16:45 +0800 |
|---|---|---|
| committer |   David S. Miller <davem@davemloft.net> | 2018-04-16 12:57:06 -0400 |
| commit | 9783ccd0f2507cbe3c5ff1cb84bf6ae3a512d17d (patch) | |
| tree | f84e130010e48668777e5dc15b114bf3fecc1707 /net | |
| parent | net: af_packet: fix race in PACKET_{R|T}X_RING (diff) | |
| download | linux-dev-9783ccd0f2507cbe3c5ff1cb84bf6ae3a512d17d.tar.xz linux-dev-9783ccd0f2507cbe3c5ff1cb84bf6ae3a512d17d.zip | |
net: Fix one possible memleak in ip_setup_cork
It would allocate memory in this function when the cork->opt is NULL. But
the memory isn't freed if failed in the latter rt check, and return error
directly. It causes the memleak if its caller is ip_make_skb which also
doesn't free the cork->opt when meet a error.
Now move the rt check ahead to avoid the memleak.
Signed-off-by: Gao Feng <gfree.wind@vip.163.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net')
| -rw-r--r-- | net/ipv4/ip_output.c | 8 |
1 files changed, 5 insertions, 3 deletions
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c index 4c11b810a447..83c73bab2c3d 100644 --- a/net/ipv4/ip_output.c +++ b/net/ipv4/ip_output.c @@ -1109,6 +1109,10 @@ static int ip_setup_cork(struct sock *sk, struct inet_cork *cork, struct ip_options_rcu *opt; struct rtable *rt; + rt = *rtp; + if (unlikely(!rt)) + return -EFAULT; + /* * setup for corking. */ @@ -1124,9 +1128,7 @@ static int ip_setup_cork(struct sock *sk, struct inet_cork *cork, cork->flags |= IPCORK_OPT; cork->addr = ipc->addr; } - rt = *rtp; - if (unlikely(!rt)) - return -EFAULT; + /* * We steal reference to this route, caller should not release it */ |