breeze/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-01-25 15:03:52 +08:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'atm-fix-uninit-and-mem-accounting-leak-in-vcc_sendmsg'

Browse Source 
Kuniyuki Iwashima says:

====================
atm: Fix uninit and mem accounting leak in vcc_sendmsg().

Patch 1 fixes uninit issue reported by KMSAN, and patch 2 fixes
another issue found by Simon Horman during review for v1 patch.

v1: https://lore.kernel.org/20250613055700.415596-1-kuni1840@gmail.com
====================

Link: https://patch.msgid.link/20250616182147.963333-1-kuni1840@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
This commit is contained in:
Jakub Kicinski
2025-06-17 18:42:48 -07:00
parent 6dbb0d97c5 7851263998
commit 0aff00432c
4 changed files with 11 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
drivers/atm/atmtcp.c
View File

@@ -288,7 +288,9 @@ static int atmtcp_c_send(struct atm_vcc *vcc,struct sk_buff *skb)
struct sk_buff *new_skb;
int result = 0;
if (!skb->len) return 0;
if (skb->len < sizeof(struct atmtcp_hdr))
goto done;
dev = vcc->dev_data;
hdr = (struct atmtcp_hdr *) skb->data;
if (hdr->length == ATMTCP_HDR_MAGIC) {

6
include/linux/atmdev.h
View File

@@ -249,6 +249,12 @@ static inline void atm_account_tx(struct atm_vcc *vcc, struct sk_buff *skb)
ATM_SKB(skb)->atm_options = vcc->atm_options;
}
static inline void atm_return_tx(struct atm_vcc *vcc, struct sk_buff *skb)
{
WARN_ON_ONCE(refcount_sub_and_test(ATM_SKB(skb)->acct_truesize,
&sk_atm(vcc)->sk_wmem_alloc));
}
static inline void atm_force_charge(struct atm_vcc *vcc,int truesize)
{
atomic_add(truesize, &sk_atm(vcc)->sk_rmem_alloc);

1
net/atm/common.c
View File

@@ -635,6 +635,7 @@ int vcc_sendmsg(struct socket *sock, struct msghdr *m, size_t size)
skb->dev = NULL; /* for paths shared with net_device interfaces */
if (!copy_from_iter_full(skb_put(skb, size), size, &m->msg_iter)) {
atm_return_tx(vcc, skb);
kfree_skb(skb);
error = -EFAULT;
goto out;

2
net/atm/raw.c
View File

@@ -36,7 +36,7 @@ static void atm_pop_raw(struct atm_vcc *vcc, struct sk_buff *skb)
pr_debug("(%d) %d -= %d\n",
vcc->vci, sk_wmem_alloc_get(sk), ATM_SKB(skb)->acct_truesize);
WARN_ON(refcount_sub_and_test(ATM_SKB(skb)->acct_truesize, &sk->sk_wmem_alloc));
atm_return_tx(vcc, skb);
dev_kfree_skb_any(skb);
sk->sk_write_space(sk);
}