ipv6: fix possible crashes in ip6_cork_release()

commit 0178b69 ("ipv6: Copy cork options in ip6_append_data") added some code duplication and bad error recovery, leading to potential crash in ip6_cork_release() as kfree() could be called with garbage. use kzalloc() to make sure this wont happen. Signed-off-by: Eric Dumazet <[email protected]> Signed-off-by: David S. Miller <[email protected]> Cc: Herbert Xu <[email protected]> Cc: Hideaki YOSHIFUJI <[email protected]> Cc: Neal Cardwell <[email protected]>
kishon · May 18, 2013 · 284041e · 284041e
1 parent 014be2c
commit 284041e
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
@@ -1147,7 +1147,7 @@ int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
 			if (WARN_ON(np->cork.opt))
 				return -EINVAL;
 
-			np->cork.opt = kmalloc(opt->tot_len, sk->sk_allocation);
+			np->cork.opt = kzalloc(opt->tot_len, sk->sk_allocation);
 			if (unlikely(np->cork.opt == NULL))
 				return -ENOBUFS;