Re: Brainy: User-Triggerable Kernel Memory Leak

[Todd C. Miller]

I think the simplest fix is to just move the m_free to the bad:
label.

 - todd

Index: sys/compat/linux/linux_socket.c
===================================================================
RCS file: /cvs/src/sys/compat/linux/linux_socket.c,v
retrieving revision 1.59
diff -u -r1.59 linux_socket.c
--- sys/compat/linux/linux_socket.c     21 Jan 2015 13:47:45 -0000      1.59
+++ sys/compat/linux/linux_socket.c     30 Jan 2015 21:33:38 -0000
@@ -969,10 +969,8 @@
        if (lsa.optval != NULL) {
                m = m_get(M_WAIT, MT_SOOPTS);
                error = copyin(lsa.optval, mtod(m, caddr_t), lsa.optlen);
-               if (error) {
-                       (void) m_free(m);
+               if (error)
                        goto bad;
-               }
                m->m_len = lsa.optlen;
        }
        so = (struct socket *)fp->f_data;
@@ -985,6 +983,8 @@
        }
        error = sosetopt(so, level, name, m);
 bad:
+       if (m)
+               (void) m_free(m);
        FRELE(fp, p);
        return (error);
 }