Commit fb104812 authored May 10, 2018 by Andrey Ignatov Committed by Greg Kroah-Hartman May 25, 2018

ipv4: fix memory leaks in udp_sendmsg, ping_v4_sendmsg



[ Upstream commit 1b97013bfb11d66f041de691de6f0fec748ce016 ]

Fix more memory leaks in ip_cmsg_send() callers. Part of them were fixed
earlier in 919483096bfe.

* udp_sendmsg one was there since the beginning when linux sources were
  first added to git;
* ping_v4_sendmsg one was copy/pasted in c319b4d7.

Whenever return happens in udp_sendmsg() or ping_v4_sendmsg() IP options
have to be freed if they were allocated previously.

Add label so that future callers (if any) can use it instead of kfree()
before return that is easy to forget.

Fixes: c319b4d7 (net: ipv4: add IPPROTO_ICMP socket kind)
Signed-off-by: Andrey Ignatov <rdna@fb.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

parent 7eaa9499

net/ipv4/ping.c

+5 −2

Original line number	Diff line number	Diff line
		@@ -771,8 +771,10 @@ static int ping_v4_sendmsg(struct kiocb iocb, struct sock sk, struct msghdr *m
		ipc.addr = faddr = daddr;

		if (ipc.opt && ipc.opt->opt.srr) {
		if (!daddr)
		return -EINVAL;
		if (!daddr) {
		err = -EINVAL;
		goto out_free;
		}
		faddr = ipc.opt->opt.faddr;
		}
		tos = get_rttos(&ipc, inet);
		@@ -837,6 +839,7 @@ back_from_confirm:

		out:
		ip_rt_put(rt);
		out_free:
		if (free)
		kfree(ipc.opt);
		if (!err) {

net/ipv4/udp.c

+5 −2

Original line number	Diff line number	Diff line
		@@ -975,8 +975,10 @@ int udp_sendmsg(struct kiocb iocb, struct sock sk, struct msghdr *msg,
		ipc.addr = faddr = daddr;

		if (ipc.opt && ipc.opt->opt.srr) {
		if (!daddr)
		return -EINVAL;
		if (!daddr) {
		err = -EINVAL;
		goto out_free;
		}
		faddr = ipc.opt->opt.faddr;
		connected = 0;
		}
		@@ -1081,6 +1083,7 @@ do_append_data:

		out:
		ip_rt_put(rt);
		out_free:
		if (free)
		kfree(ipc.opt);
		if (!err)