lkml.org 
[lkml]   [2018]   [May]   [18]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.9 04/33] ipv4: fix memory leaks in udp_sendmsg, ping_v4_sendmsg
    Date
    4.9-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Andrey Ignatov <rdna@fb.com>

    [ Upstream commit 1b97013bfb11d66f041de691de6f0fec748ce016 ]

    Fix more memory leaks in ip_cmsg_send() callers. Part of them were fixed
    earlier in 919483096bfe.

    * udp_sendmsg one was there since the beginning when linux sources were
    first added to git;
    * ping_v4_sendmsg one was copy/pasted in c319b4d76b9e.

    Whenever return happens in udp_sendmsg() or ping_v4_sendmsg() IP options
    have to be freed if they were allocated previously.

    Add label so that future callers (if any) can use it instead of kfree()
    before return that is easy to forget.

    Fixes: c319b4d76b9e (net: ipv4: add IPPROTO_ICMP socket kind)
    Signed-off-by: Andrey Ignatov <rdna@fb.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    net/ipv4/ping.c | 7 +++++--
    net/ipv4/udp.c | 7 +++++--
    2 files changed, 10 insertions(+), 4 deletions(-)

    --- a/net/ipv4/ping.c
    +++ b/net/ipv4/ping.c
    @@ -775,8 +775,10 @@ static int ping_v4_sendmsg(struct sock *
    ipc.addr = faddr = daddr;

    if (ipc.opt && ipc.opt->opt.srr) {
    - if (!daddr)
    - return -EINVAL;
    + if (!daddr) {
    + err = -EINVAL;
    + goto out_free;
    + }
    faddr = ipc.opt->opt.faddr;
    }
    tos = get_rttos(&ipc, inet);
    @@ -841,6 +843,7 @@ back_from_confirm:

    out:
    ip_rt_put(rt);
    +out_free:
    if (free)
    kfree(ipc.opt);
    if (!err) {
    --- a/net/ipv4/udp.c
    +++ b/net/ipv4/udp.c
    @@ -982,8 +982,10 @@ int udp_sendmsg(struct sock *sk, struct
    sock_tx_timestamp(sk, ipc.sockc.tsflags, &ipc.tx_flags);

    if (ipc.opt && ipc.opt->opt.srr) {
    - if (!daddr)
    - return -EINVAL;
    + if (!daddr) {
    + err = -EINVAL;
    + goto out_free;
    + }
    faddr = ipc.opt->opt.faddr;
    connected = 0;
    }
    @@ -1090,6 +1092,7 @@ do_append_data:

    out:
    ip_rt_put(rt);
    +out_free:
    if (free)
    kfree(ipc.opt);
    if (!err)

    \
     
     \ /
      Last update: 2018-05-18 10:34    [W:4.126 / U:0.192 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site