projects / thirdparty / kernel / stable-queue.git / blame
| Commit | Line | Data |
|---|---|---|
| d55578af GKH |
1 | From foo@baz Wed May 16 16:57:32 CEST 2018 |
| 2 | From: Andrey Ignatov <rdna@fb.com> | |
| 3 | Date: Thu, 10 May 2018 10:59:34 -0700 | |
| 4 | Subject: ipv4: fix memory leaks in udp_sendmsg, ping_v4_sendmsg | |
| 5 | ||
| 6 | From: Andrey Ignatov <rdna@fb.com> | |
| 7 | ||
| 8 | [ Upstream commit 1b97013bfb11d66f041de691de6f0fec748ce016 ] | |
| 9 | ||
| 10 | Fix more memory leaks in ip_cmsg_send() callers. Part of them were fixed | |
| 11 | earlier in 919483096bfe. | |
| 12 | ||
| 13 | * udp_sendmsg one was there since the beginning when linux sources were | |
| 14 | first added to git; | |
| 15 | * ping_v4_sendmsg one was copy/pasted in c319b4d76b9e. | |
| 16 | ||
| 17 | Whenever return happens in udp_sendmsg() or ping_v4_sendmsg() IP options | |
| 18 | have to be freed if they were allocated previously. | |
| 19 | ||
| 20 | Add label so that future callers (if any) can use it instead of kfree() | |
| 21 | before return that is easy to forget. | |
| 22 | ||
| 23 | Fixes: c319b4d76b9e (net: ipv4: add IPPROTO_ICMP socket kind) | |
| 24 | Signed-off-by: Andrey Ignatov <rdna@fb.com> | |
| 25 | Signed-off-by: David S. Miller <davem@davemloft.net> | |
| 26 | Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | |
| 27 | --- | |
| 28 | net/ipv4/ping.c | 7 +++++-- | |
| 29 | net/ipv4/udp.c | 7 +++++-- | |
| 30 | 2 files changed, 10 insertions(+), 4 deletions(-) | |
| 31 | ||
| 32 | --- a/net/ipv4/ping.c | |
| 33 | +++ b/net/ipv4/ping.c | |
| 34 | @@ -777,8 +777,10 @@ static int ping_v4_sendmsg(struct sock * | |
| 35 | ipc.addr = faddr = daddr; | |
| 36 | ||
| 37 | if (ipc.opt && ipc.opt->opt.srr) { | |
| 38 | - if (!daddr) | |
| 39 | - return -EINVAL; | |
| 40 | + if (!daddr) { | |
| 41 | + err = -EINVAL; | |
| 42 | + goto out_free; | |
| 43 | + } | |
| 44 | faddr = ipc.opt->opt.faddr; | |
| 45 | } | |
| 46 | tos = get_rttos(&ipc, inet); | |
| 47 | @@ -843,6 +845,7 @@ back_from_confirm: | |
| 48 | ||
| 49 | out: | |
| 50 | ip_rt_put(rt); | |
| 51 | +out_free: | |
| 52 | if (free) | |
| 53 | kfree(ipc.opt); | |
| 54 | if (!err) { | |
| 55 | --- a/net/ipv4/udp.c | |
| 56 | +++ b/net/ipv4/udp.c | |
| 57 | @@ -991,8 +991,10 @@ int udp_sendmsg(struct sock *sk, struct | |
| 58 | ipc.addr = faddr = daddr; | |
| 59 | ||
| 60 | if (ipc.opt && ipc.opt->opt.srr) { | |
| 61 | - if (!daddr) | |
| 62 | - return -EINVAL; | |
| 63 | + if (!daddr) { | |
| 64 | + err = -EINVAL; | |
| 65 | + goto out_free; | |
| 66 | + } | |
| 67 | faddr = ipc.opt->opt.faddr; | |
| 68 | connected = 0; | |
| 69 | } | |
| 70 | @@ -1105,6 +1107,7 @@ do_append_data: | |
| 71 | ||
| 72 | out: | |
| 73 | ip_rt_put(rt); | |
| 74 | +out_free: | |
| 75 | if (free) | |
| 76 | kfree(ipc.opt); | |
| 77 | if (!err) |