public inbox for netdev@vger.kernel.org
 help / color / mirror / Atom feed
From: Eric Dumazet <eric.dumazet@gmail.com>
To: David Miller <davem@davemloft.net>,
	Herbert Xu <herbert@gondor.apana.org.au>
Cc: netdev <netdev@vger.kernel.org>,
	Hideaki YOSHIFUJI <yoshfuji@linux-ipv6.org>,
	Neal Cardwell <ncardwell@google.com>
Subject: [RFC/BUG] ipv6: bug in "ipv6: Copy cork options in ip6_append_data"
Date: Thu, 16 May 2013 15:23:10 -0700	[thread overview]
Message-ID: <1368742990.3301.67.camel@edumazet-glaptop> (raw)

Hi Herbert

Looking at the code added in commit 0178b695fd6b40a62a215cb
("ipv6: Copy cork options in ip6_append_data") it looks like we can have
either a memleak or corruption (later in ip6_cork_release()) in case one
of the sub-allocation (ip6_opt_dup()/ip6_rthdr_dup()) fails.

I would at least use a kzalloc() instead of kmalloc() in 

np->cork.opt = kmalloc(opt->tot_len, sk->sk_allocation);

Or maybe better, reuse the code in  ipv6_dup_options() so that we
perform a single memory allocation ?

Am I missing something obvious ?

Thanks !

             reply	other threads:[~2013-05-16 22:23 UTC|newest]

Thread overview: 11+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2013-05-16 22:23 Eric Dumazet [this message]
2013-05-17  0:27 ` [PATCH net-next] ipv6: use ipv6_dup_options() from ip6_append_data() Eric Dumazet
2013-05-17 13:58   ` Herbert Xu
2013-05-17 14:53     ` Eric Dumazet
2013-05-17 23:36       ` Herbert Xu
2013-05-18 19:57       ` David Miller
2013-06-15 18:51 ` [RFC/BUG] ipv6: bug in "ipv6: Copy cork options in ip6_append_data" Sebastian Andrzej Siewior
2013-06-16  9:12   ` Eric Dumazet
2013-06-16 19:07     ` Sebastian Andrzej Siewior
2013-06-16 20:10       ` Sebastian Andrzej Siewior
2013-06-16 20:37         ` Eric Dumazet

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=1368742990.3301.67.camel@edumazet-glaptop \
    --to=eric.dumazet@gmail.com \
    --cc=davem@davemloft.net \
    --cc=herbert@gondor.apana.org.au \
    --cc=ncardwell@google.com \
    --cc=netdev@vger.kernel.org \
    --cc=yoshfuji@linux-ipv6.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox