| Message ID | 20240129091017.2938835-1-alexious@zju.edu.cn (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | 5dee6d6923458e26966717f2a3eae7d09fc10bf6 |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | [v2] net: ipv4: fix a memleak in ip_setup_cork | expand |
On Mon, Jan 29, 2024 at 10:23 AM Zhipeng Lu <alexious@zju.edu.cn> wrote: > > When inetdev_valid_mtu fails, cork->opt should be freed if it is > allocated in ip_setup_cork. Otherwise there could be a memleak. > > Fixes: 501a90c94510 ("inet: protect against too small mtu values.") > Signed-off-by: Zhipeng Lu <alexious@zju.edu.cn> > --- Okay, although the changelog is a bit confusing, since we do not free cork->opt anymore in V2... Reviewed-by: Eric Dumazet <edumazet@google.com>
Hello: This patch was applied to netdev/net.git (main) by Jakub Kicinski <kuba@kernel.org>: On Mon, 29 Jan 2024 17:10:17 +0800 you wrote: > When inetdev_valid_mtu fails, cork->opt should be freed if it is > allocated in ip_setup_cork. Otherwise there could be a memleak. > > Fixes: 501a90c94510 ("inet: protect against too small mtu values.") > Signed-off-by: Zhipeng Lu <alexious@zju.edu.cn> > --- > Changelog: > > [...] Here is the summary with links: - [v2] net: ipv4: fix a memleak in ip_setup_cork https://git.kernel.org/netdev/net/c/5dee6d692345 You are awesome, thank you!
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c index b06f678b03a1..41537d18eecf 100644 --- a/net/ipv4/ip_output.c +++ b/net/ipv4/ip_output.c @@ -1287,6 +1287,12 @@ static int ip_setup_cork(struct sock *sk, struct inet_cork *cork, if (unlikely(!rt)) return -EFAULT; + cork->fragsize = ip_sk_use_pmtu(sk) ? + dst_mtu(&rt->dst) : READ_ONCE(rt->dst.dev->mtu); + + if (!inetdev_valid_mtu(cork->fragsize)) + return -ENETUNREACH; + /* * setup for corking. */ @@ -1303,12 +1309,6 @@ static int ip_setup_cork(struct sock *sk, struct inet_cork *cork, cork->addr = ipc->addr; } - cork->fragsize = ip_sk_use_pmtu(sk) ? - dst_mtu(&rt->dst) : READ_ONCE(rt->dst.dev->mtu); - - if (!inetdev_valid_mtu(cork->fragsize)) - return -ENETUNREACH; - cork->gso_size = ipc->gso_size; cork->dst = &rt->dst;
When inetdev_valid_mtu fails, cork->opt should be freed if it is allocated in ip_setup_cork. Otherwise there could be a memleak. Fixes: 501a90c94510 ("inet: protect against too small mtu values.") Signed-off-by: Zhipeng Lu <alexious@zju.edu.cn> --- Changelog: v2: fix memleak by placing the malloc as the last error-handling. --- net/ipv4/ip_output.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)