diff options
| author | Kuniyuki Iwashima <[email protected]> | 2025-06-16 18:21:15 +0000 |
|---|---|---|
| committer | Jakub Kicinski <[email protected]> | 2025-06-18 01:42:44 +0000 |
| commit | 7851263998d4269125fd6cb3fdbfc7c6db853859 (patch) | |
| tree | 28aa7e7d9790d9bcd53373974d42591089c89de8 /net/atm/raw.c | |
| parent | atm: atmtcp: Free invalid length skb in atmtcp_c_send(). (diff) | |
| download | kernel-7851263998d4269125fd6cb3fdbfc7c6db853859.tar.gz kernel-7851263998d4269125fd6cb3fdbfc7c6db853859.zip | |
atm: Revert atm_account_tx() if copy_from_iter_full() fails.
In vcc_sendmsg(), we account skb->truesize to sk->sk_wmem_alloc by
atm_account_tx().
It is expected to be reverted by atm_pop_raw() later called by
vcc->dev->ops->send(vcc, skb).
However, vcc_sendmsg() misses the same revert when copy_from_iter_full()
fails, and then we will leak a socket.
Let's factorise the revert part as atm_return_tx() and call it in
the failure path.
Note that the corresponding sk_wmem_alloc operation can be found in
alloc_tx() as of the blamed commit.
$ git blame -L:alloc_tx net/atm/common.c c55fa3cccbc2c~
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-by: Simon Horman <[email protected]>
Closes: https://lore.kernel.org/netdev/[email protected]/
Signed-off-by: Kuniyuki Iwashima <[email protected]>
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Jakub Kicinski <[email protected]>
Diffstat (limited to 'net/atm/raw.c')
| -rw-r--r-- | net/atm/raw.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/net/atm/raw.c b/net/atm/raw.c index 2b5f78a7ec3e..1e6511ec842c 100644 --- a/net/atm/raw.c +++ b/net/atm/raw.c @@ -36,7 +36,7 @@ static void atm_pop_raw(struct atm_vcc *vcc, struct sk_buff *skb) pr_debug("(%d) %d -= %d\n", vcc->vci, sk_wmem_alloc_get(sk), ATM_SKB(skb)->acct_truesize); - WARN_ON(refcount_sub_and_test(ATM_SKB(skb)->acct_truesize, &sk->sk_wmem_alloc)); + atm_return_tx(vcc, skb); dev_kfree_skb_any(skb); sk->sk_write_space(sk); } |