mirror of
https://github.com/torvalds/linux.git
synced 2025-08-15 14:11:42 +02:00
7851263998
In vcc_sendmsg(), we account skb->truesize to sk->sk_wmem_alloc by atm_account_tx(). It is expected to be reverted by atm_pop_raw() later called by vcc->dev->ops->send(vcc, skb). However, vcc_sendmsg() misses the same revert when copy_from_iter_full() fails, and then we will leak a socket. Let's factorise the revert part as atm_return_tx() and call it in the failure path. Note that the corresponding sk_wmem_alloc operation can be found in alloc_tx() as of the blamed commit. $ git blame -L:alloc_tx net/atm/common.cc55fa3cccb~ Fixes:1da177e4c3("Linux-2.6.12-rc2") Reported-by: Simon Horman <horms@kernel.org> Closes: https://lore.kernel.org/netdev/20250614161959.GR414686@horms.kernel.org/ Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com> Link: https://patch.msgid.link/20250616182147.963333-3-kuni1840@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
94 lines
2.1 KiB
C
94 lines
2.1 KiB
C
// SPDX-License-Identifier: GPL-2.0
|
|
/* net/atm/raw.c - Raw AAL0 and AAL5 transports */
|
|
|
|
/* Written 1995-2000 by Werner Almesberger, EPFL LRC/ICA */
|
|
|
|
#define pr_fmt(fmt) KBUILD_MODNAME ":%s: " fmt, __func__
|
|
|
|
#include <linux/module.h>
|
|
#include <linux/atmdev.h>
|
|
#include <linux/capability.h>
|
|
#include <linux/kernel.h>
|
|
#include <linux/skbuff.h>
|
|
#include <linux/mm.h>
|
|
#include <linux/slab.h>
|
|
|
|
#include "common.h"
|
|
#include "protocols.h"
|
|
|
|
/*
|
|
* SKB == NULL indicates that the link is being closed
|
|
*/
|
|
|
|
static void atm_push_raw(struct atm_vcc *vcc, struct sk_buff *skb)
|
|
{
|
|
if (skb) {
|
|
struct sock *sk = sk_atm(vcc);
|
|
|
|
skb_queue_tail(&sk->sk_receive_queue, skb);
|
|
sk->sk_data_ready(sk);
|
|
}
|
|
}
|
|
|
|
static void atm_pop_raw(struct atm_vcc *vcc, struct sk_buff *skb)
|
|
{
|
|
struct sock *sk = sk_atm(vcc);
|
|
|
|
pr_debug("(%d) %d -= %d\n",
|
|
vcc->vci, sk_wmem_alloc_get(sk), ATM_SKB(skb)->acct_truesize);
|
|
atm_return_tx(vcc, skb);
|
|
dev_kfree_skb_any(skb);
|
|
sk->sk_write_space(sk);
|
|
}
|
|
|
|
static int atm_send_aal0(struct atm_vcc *vcc, struct sk_buff *skb)
|
|
{
|
|
/*
|
|
* Note that if vpi/vci are _ANY or _UNSPEC the below will
|
|
* still work
|
|
*/
|
|
if (!capable(CAP_NET_ADMIN) &&
|
|
(((u32 *)skb->data)[0] & (ATM_HDR_VPI_MASK | ATM_HDR_VCI_MASK)) !=
|
|
((vcc->vpi << ATM_HDR_VPI_SHIFT) |
|
|
(vcc->vci << ATM_HDR_VCI_SHIFT))) {
|
|
kfree_skb(skb);
|
|
return -EADDRNOTAVAIL;
|
|
}
|
|
if (vcc->dev->ops->send_bh)
|
|
return vcc->dev->ops->send_bh(vcc, skb);
|
|
return vcc->dev->ops->send(vcc, skb);
|
|
}
|
|
|
|
int atm_init_aal0(struct atm_vcc *vcc)
|
|
{
|
|
vcc->push = atm_push_raw;
|
|
vcc->pop = atm_pop_raw;
|
|
vcc->push_oam = NULL;
|
|
vcc->send = atm_send_aal0;
|
|
return 0;
|
|
}
|
|
|
|
int atm_init_aal34(struct atm_vcc *vcc)
|
|
{
|
|
vcc->push = atm_push_raw;
|
|
vcc->pop = atm_pop_raw;
|
|
vcc->push_oam = NULL;
|
|
if (vcc->dev->ops->send_bh)
|
|
vcc->send = vcc->dev->ops->send_bh;
|
|
else
|
|
vcc->send = vcc->dev->ops->send;
|
|
return 0;
|
|
}
|
|
|
|
int atm_init_aal5(struct atm_vcc *vcc)
|
|
{
|
|
vcc->push = atm_push_raw;
|
|
vcc->pop = atm_pop_raw;
|
|
vcc->push_oam = NULL;
|
|
if (vcc->dev->ops->send_bh)
|
|
vcc->send = vcc->dev->ops->send_bh;
|
|
else
|
|
vcc->send = vcc->dev->ops->send;
|
|
return 0;
|
|
}
|
|
EXPORT_SYMBOL(atm_init_aal5);
|