]> www.infradead.org Git - users/jedix/linux-maple.git/commit
atm: Revert atm_account_tx() if copy_from_iter_full() fails.
authorKuniyuki Iwashima <kuniyu@google.com>
Mon, 16 Jun 2025 18:21:15 +0000 (11:21 -0700)
committerJakub Kicinski <kuba@kernel.org>
Wed, 18 Jun 2025 01:42:44 +0000 (18:42 -0700)
commit7851263998d4269125fd6cb3fdbfc7c6db853859
tree28aa7e7d9790d9bcd53373974d42591089c89de8
parent2f370ae1fb6317985f3497b1bb80d457508ca2f7
atm: Revert atm_account_tx() if copy_from_iter_full() fails.

In vcc_sendmsg(), we account skb->truesize to sk->sk_wmem_alloc by
atm_account_tx().

It is expected to be reverted by atm_pop_raw() later called by
vcc->dev->ops->send(vcc, skb).

However, vcc_sendmsg() misses the same revert when copy_from_iter_full()
fails, and then we will leak a socket.

Let's factorise the revert part as atm_return_tx() and call it in
the failure path.

Note that the corresponding sk_wmem_alloc operation can be found in
alloc_tx() as of the blamed commit.

  $ git blame -L:alloc_tx net/atm/common.c c55fa3cccbc2c~

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-by: Simon Horman <horms@kernel.org>
Closes: https://lore.kernel.org/netdev/20250614161959.GR414686@horms.kernel.org/
Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
Link: https://patch.msgid.link/20250616182147.963333-3-kuni1840@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
include/linux/atmdev.h
net/atm/common.c
net/atm/raw.c