Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b3dace37 authored by Zhipeng Lu's avatar Zhipeng Lu Committed by Greg Kroah-Hartman
Browse files

net: ipv4: fix a memleak in ip_setup_cork 



[ Upstream commit 5dee6d6923458e26966717f2a3eae7d09fc10bf6 ]

When inetdev_valid_mtu fails, cork->opt should be freed if it is
allocated in ip_setup_cork. Otherwise there could be a memleak.

Fixes: 501a90c94510 ("inet: protect against too small mtu values.")
Signed-off-by: default avatarZhipeng Lu <alexious@zju.edu.cn>
Reviewed-by: default avatarEric Dumazet <edumazet@google.com>
Link: https://lore.kernel.org/r/20240129091017.2938835-1-alexious@zju.edu.cn


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent f549f340

net/ipv4/ip_output.c

+6 −6
Original line number Diff line number Diff line
@@ -1255,6 +1255,12 @@ static int ip_setup_cork(struct sock *sk, struct inet_cork *cork, 
	if (unlikely(!rt))

		return -EFAULT;



	cork->fragsize = ip_sk_use_pmtu(sk) ?

			 dst_mtu(&rt->dst) : READ_ONCE(rt->dst.dev->mtu);



	if (!inetdev_valid_mtu(cork->fragsize))

		return -ENETUNREACH;



	/*

	 * setup for corking.

	 */
@@ -1271,12 +1277,6 @@ static int ip_setup_cork(struct sock *sk, struct inet_cork *cork, 
		cork->addr = ipc->addr;

	}



	cork->fragsize = ip_sk_use_pmtu(sk) ?

			 dst_mtu(&rt->dst) : READ_ONCE(rt->dst.dev->mtu);



	if (!inetdev_valid_mtu(cork->fragsize))

		return -ENETUNREACH;



	cork->gso_size = ipc->gso_size;



	cork->dst = &rt->dst;