At 2018-04-17 05:18:25, "Eric Dumazet" <eric.duma...@gmail.com> wrote: > > >On 04/16/2018 09:58 AM, David Miller wrote: >> From: gfree.w...@vip.163.com >> Date: Mon, 16 Apr 2018 10:16:45 +0800 >> >>> From: Gao Feng <gfree.w...@vip.163.com> >>> >>> It would allocate memory in this function when the cork->opt is NULL. But >>> the memory isn't freed if failed in the latter rt check, and return error >>> directly. It causes the memleak if its caller is ip_make_skb which also >>> doesn't free the cork->opt when meet a error. >>> >>> Now move the rt check ahead to avoid the memleak. >>> >>> Signed-off-by: Gao Feng <gfree.w...@vip.163.com> >> >> Looks good, applied and queued up for -stable. >> >> I guess in the other code paths, ip_flush_pending_frames() or similar >> would clean up the in-sock cork information. >> > >I am not sure ip_make_skb() can be called with a NULL rt. > >Patch makes no harm, but does not seem to fix a bug. >
Thanks Eric. I just look up current all callers of ip_make_skb and ip_append_data, they check if the rt is valid ahead. So current codes won't pass one NULL rt to ip_setup_cork indeed. Then this patch is just as an enhancement, not a fix. As the programming rule, the function should free the mem which is allocated by itself when it failed. Best Regards Feng
