Skip to content

Commit

Permalink
net: ipv4: fix a memleak in ip_setup_cork
Browse files Browse the repository at this point in the history
When inetdev_valid_mtu fails, cork->opt should be freed if it is
allocated in ip_setup_cork. Otherwise there could be a memleak.

Fixes: 501a90c ("inet: protect against too small mtu values.")
Signed-off-by: Zhipeng Lu <alexious@zju.edu.cn>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Link: https://lore.kernel.org/r/20240129091017.2938835-1-alexious@zju.edu.cn
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  • Loading branch information
AlexiousLu authored and kuba-moo committed Jan 31, 2024
1 parent e028243 commit 5dee6d6
Showing 1 changed file with 6 additions and 6 deletions.
12 changes: 6 additions & 6 deletions net/ipv4/ip_output.c
Original file line number Diff line number Diff line change
Expand Up @@ -1287,6 +1287,12 @@ static int ip_setup_cork(struct sock *sk, struct inet_cork *cork,
if (unlikely(!rt))
return -EFAULT;

cork->fragsize = ip_sk_use_pmtu(sk) ?
dst_mtu(&rt->dst) : READ_ONCE(rt->dst.dev->mtu);

if (!inetdev_valid_mtu(cork->fragsize))
return -ENETUNREACH;

/*
* setup for corking.
*/
Expand All @@ -1303,12 +1309,6 @@ static int ip_setup_cork(struct sock *sk, struct inet_cork *cork,
cork->addr = ipc->addr;
}

cork->fragsize = ip_sk_use_pmtu(sk) ?
dst_mtu(&rt->dst) : READ_ONCE(rt->dst.dev->mtu);

if (!inetdev_valid_mtu(cork->fragsize))
return -ENETUNREACH;

cork->gso_size = ipc->gso_size;

cork->dst = &rt->dst;
Expand Down

0 comments on commit 5dee6d6

Please sign in to comment.