diff options
| author | Jakub Kicinski <kuba@kernel.org> | 2025-06-17 18:42:48 -0700 |
|---|---|---|
| committer | Jakub Kicinski <kuba@kernel.org> | 2025-06-17 18:42:49 -0700 |
| commit | 0aff00432cc755ad7713f8a2f305395d443cdd4c (patch) | |
| tree | 28aa7e7d9790d9bcd53373974d42591089c89de8 /net | |
| parent | mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu(). (diff) | |
| parent | atm: Revert atm_account_tx() if copy_from_iter_full() fails. (diff) | |
| download | linux-0aff00432cc755ad7713f8a2f305395d443cdd4c.tar.gz linux-0aff00432cc755ad7713f8a2f305395d443cdd4c.zip | |
Merge branch 'atm-fix-uninit-and-mem-accounting-leak-in-vcc_sendmsg'
Kuniyuki Iwashima says:
====================
atm: Fix uninit and mem accounting leak in vcc_sendmsg().
Patch 1 fixes uninit issue reported by KMSAN, and patch 2 fixes
another issue found by Simon Horman during review for v1 patch.
v1: https://lore.kernel.org/20250613055700.415596-1-kuni1840@gmail.com
====================
Link: https://patch.msgid.link/20250616182147.963333-1-kuni1840@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Diffstat (limited to 'net')
| -rw-r--r-- | net/atm/common.c | 1 | ||||
| -rw-r--r-- | net/atm/raw.c | 2 |
2 files changed, 2 insertions, 1 deletions
diff --git a/net/atm/common.c b/net/atm/common.c index 9b75699992ff..d7f7976ea13a 100644 --- a/net/atm/common.c +++ b/net/atm/common.c @@ -635,6 +635,7 @@ int vcc_sendmsg(struct socket *sock, struct msghdr *m, size_t size) skb->dev = NULL; /* for paths shared with net_device interfaces */ if (!copy_from_iter_full(skb_put(skb, size), size, &m->msg_iter)) { + atm_return_tx(vcc, skb); kfree_skb(skb); error = -EFAULT; goto out; diff --git a/net/atm/raw.c b/net/atm/raw.c index 2b5f78a7ec3e..1e6511ec842c 100644 --- a/net/atm/raw.c +++ b/net/atm/raw.c @@ -36,7 +36,7 @@ static void atm_pop_raw(struct atm_vcc *vcc, struct sk_buff *skb) pr_debug("(%d) %d -= %d\n", vcc->vci, sk_wmem_alloc_get(sk), ATM_SKB(skb)->acct_truesize); - WARN_ON(refcount_sub_and_test(ATM_SKB(skb)->acct_truesize, &sk->sk_wmem_alloc)); + atm_return_tx(vcc, skb); dev_kfree_skb_any(skb); sk->sk_write_space(sk); } |