summaryrefslogtreecommitdiff
path: root/net/atm/lec.c
diff options
context:
space:
mode:
authorPhil Sutter <phil.sutter@viprinet.com>2013-02-01 07:21:41 +0000
committerDavid S. Miller <davem@davemloft.net>2013-02-03 16:15:23 -0500
commit9665d5d62487e8e7b1f546c00e11107155384b9a (patch)
tree940f4891ea7cff0760ec26ab9a3e03817abcf4f1 /net/atm/lec.c
parent92df9b217ee2392024483ba5b85a88d92d60f3c1 (diff)
packet: fix leakage of tx_ring memory
When releasing a packet socket, the routine packet_set_ring() is reused to free rings instead of allocating them. But when calling it for the first time, it fills req->tp_block_nr with the value of rb->pg_vec_len which in the second invocation makes it bail out since req->tp_block_nr is greater zero but req->tp_block_size is zero. This patch solves the problem by passing a zeroed auto-variable to packet_set_ring() upon each invocation from packet_release(). As far as I can tell, this issue exists even since 69e3c75 (net: TX_RING and packet mmap), i.e. the original inclusion of TX ring support into af_packet, but applies only to sockets with both RX and TX ring allocated, which is probably why this was unnoticed all the time. Signed-off-by: Phil Sutter <phil.sutter@viprinet.com> Cc: Johann Baudy <johann.baudy@gnu-log.net> Cc: Daniel Borkmann <dborkman@redhat.com> Acked-by: Daniel Borkmann <dborkman@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/atm/lec.c')
0 files changed, 0 insertions, 0 deletions