[RFC/BUG] ipv6: bug in "ipv6: Copy cork options in ip6_append_data"

Eric Dumazet
2013-05-16T22:23:13Z

Hi Herbert

Looking at the code added in commit 0178b695fd6b40a62a215cb
("ipv6: Copy cork options in ip6_append_data") it looks like we can have
either a memleak or corruption (later in ip6_cork_release()) in case one
of the sub-allocation (ip6_opt_dup()/ip6_rthdr_dup()) fails.

I would at least use a kzalloc() instead of kmalloc() in

np->cork.opt = kmalloc(opt->tot_len, sk->sk_allocation);

Or maybe better, reuse the code in ipv6_dup_options() so that we
perform a single memory allocation ?

Am I missing something obvious ?

Thanks !