Commit 9783ccd0 authored Apr 16, 2018 by Gao Feng Committed by David S. Miller Apr 16, 2018

net: Fix one possible memleak in ip_setup_cork



It would allocate memory in this function when the cork->opt is NULL. But
the memory isn't freed if failed in the latter rt check, and return error
directly. It causes the memleak if its caller is ip_make_skb which also
doesn't free the cork->opt when meet a error.

Now move the rt check ahead to avoid the memleak.

Signed-off-by: Gao Feng <gfree.wind@vip.163.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent 5171b37d

net/ipv4/ip_output.c

+5 −3

Original line number	Diff line number	Diff line
		@@ -1109,6 +1109,10 @@ static int ip_setup_cork(struct sock sk, struct inet_cork cork,
		struct ip_options_rcu *opt;
		struct rtable *rt;

		rt = *rtp;
		if (unlikely(!rt))
		return -EFAULT;

		/*
		* setup for corking.
		*/
		@@ -1124,9 +1128,7 @@ static int ip_setup_cork(struct sock sk, struct inet_cork cork,
		cork->flags \|= IPCORK_OPT;
		cork->addr = ipc->addr;
		}
		rt = *rtp;
		if (unlikely(!rt))
		return -EFAULT;

		/*
		* We steal reference to this route, caller should not release it
		*/