Skip to content

Commit 14afee4

Browse files
ereshetovadavem330
ereshetova
authored and
davem330
committed
net: convert sock.sk_wmem_alloc from atomic_t to refcount_t
refcount_t type and corresponding API should be used instead of atomic_t when the variable is used as a reference counter. This allows to avoid accidental refcounter overflows that might lead to use-after-free situations. Signed-off-by: Elena Reshetova <[email protected]> Signed-off-by: Hans Liljestrand <[email protected]> Signed-off-by: Kees Cook <[email protected]> Signed-off-by: David Windsor <[email protected]> Signed-off-by: David S. Miller <[email protected]>
1 parent 2638595 commit 14afee4

37 files changed

+74
-85
lines changed

‎drivers/atm/fore200e.c

Lines changed: 1 addition & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -924,12 +924,7 @@ fore200e_tx_irq(struct fore200e* fore200e)
924924
else {
925925
dev_kfree_skb_any(entry->skb);
926926
}
927-
#if 1
928-
/* race fixed by the above incarnation mechanism, but... */
929-
if (atomic_read(&sk_atm(vcc)->sk_wmem_alloc) < 0) {
930-
atomic_set(&sk_atm(vcc)->sk_wmem_alloc, 0);
931-
}
932-
#endif
927+
933928
/* check error condition */
934929
if (*entry->status & STATUS_ERROR)
935930
atomic_inc(&vcc->stats->tx_err);
@@ -1130,13 +1125,9 @@ fore200e_push_rpd(struct fore200e* fore200e, struct atm_vcc* vcc, struct rpd* rp
11301125
return -ENOMEM;
11311126
}
11321127

1133-
ASSERT(atomic_read(&sk_atm(vcc)->sk_wmem_alloc) >= 0);
1134-
11351128
vcc->push(vcc, skb);
11361129
atomic_inc(&vcc->stats->rx);
11371130

1138-
ASSERT(atomic_read(&sk_atm(vcc)->sk_wmem_alloc) >= 0);
1139-
11401131
return 0;
11411132
}
11421133

@@ -1572,7 +1563,6 @@ fore200e_send(struct atm_vcc *vcc, struct sk_buff *skb)
15721563
unsigned long flags;
15731564

15741565
ASSERT(vcc);
1575-
ASSERT(atomic_read(&sk_atm(vcc)->sk_wmem_alloc) >= 0);
15761566
ASSERT(fore200e);
15771567
ASSERT(fore200e_vcc);
15781568

‎drivers/atm/he.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2395,7 +2395,7 @@ he_close(struct atm_vcc *vcc)
23952395
* TBRQ, the host issues the close command to the adapter.
23962396
*/
23972397

2398-
while (((tx_inuse = atomic_read(&sk_atm(vcc)->sk_wmem_alloc)) > 1) &&
2398+
while (((tx_inuse = refcount_read(&sk_atm(vcc)->sk_wmem_alloc)) > 1) &&
23992399
(retry < MAX_RETRY)) {
24002400
msleep(sleep);
24012401
if (sleep < 250)

‎drivers/atm/idt77252.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -724,7 +724,7 @@ push_on_scq(struct idt77252_dev *card, struct vc_map *vc, struct sk_buff *skb)
724724
struct sock *sk = sk_atm(vcc);
725725

726726
vc->estimator->cells += (skb->len + 47) / 48;
727-
if (atomic_read(&sk->sk_wmem_alloc) >
727+
if (refcount_read(&sk->sk_wmem_alloc) >
728728
(sk->sk_sndbuf >> 1)) {
729729
u32 cps = vc->estimator->maxcps;
730730

@@ -2009,7 +2009,7 @@ idt77252_send_oam(struct atm_vcc *vcc, void *cell, int flags)
20092009
atomic_inc(&vcc->stats->tx_err);
20102010
return -ENOMEM;
20112011
}
2012-
atomic_add(skb->truesize, &sk_atm(vcc)->sk_wmem_alloc);
2012+
refcount_add(skb->truesize, &sk_atm(vcc)->sk_wmem_alloc);
20132013

20142014
skb_put_data(skb, cell, 52);
20152015

‎include/linux/atmdev.h

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -254,7 +254,7 @@ static inline void atm_return(struct atm_vcc *vcc,int truesize)
254254

255255
static inline int atm_may_send(struct atm_vcc *vcc,unsigned int size)
256256
{
257-
return (size + atomic_read(&sk_atm(vcc)->sk_wmem_alloc)) <
257+
return (size + refcount_read(&sk_atm(vcc)->sk_wmem_alloc)) <
258258
sk_atm(vcc)->sk_sndbuf;
259259
}
260260

‎include/net/sock.h

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -390,7 +390,7 @@ struct sock {
390390

391391
/* ===== cache line for TX ===== */
392392
int sk_wmem_queued;
393-
atomic_t sk_wmem_alloc;
393+
refcount_t sk_wmem_alloc;
394394
unsigned long sk_tsq_flags;
395395
struct sk_buff *sk_send_head;
396396
struct sk_buff_head sk_write_queue;
@@ -1911,7 +1911,7 @@ static inline int skb_copy_to_page_nocache(struct sock *sk, struct iov_iter *fro
19111911
*/
19121912
static inline int sk_wmem_alloc_get(const struct sock *sk)
19131913
{
1914-
return atomic_read(&sk->sk_wmem_alloc) - 1;
1914+
return refcount_read(&sk->sk_wmem_alloc) - 1;
19151915
}
19161916

19171917
/**
@@ -2055,7 +2055,7 @@ static inline unsigned long sock_wspace(struct sock *sk)
20552055
int amt = 0;
20562056

20572057
if (!(sk->sk_shutdown & SEND_SHUTDOWN)) {
2058-
amt = sk->sk_sndbuf - atomic_read(&sk->sk_wmem_alloc);
2058+
amt = sk->sk_sndbuf - refcount_read(&sk->sk_wmem_alloc);
20592059
if (amt < 0)
20602060
amt = 0;
20612061
}
@@ -2136,7 +2136,7 @@ bool sk_page_frag_refill(struct sock *sk, struct page_frag *pfrag);
21362136
*/
21372137
static inline bool sock_writeable(const struct sock *sk)
21382138
{
2139-
return atomic_read(&sk->sk_wmem_alloc) < (sk->sk_sndbuf >> 1);
2139+
return refcount_read(&sk->sk_wmem_alloc) < (sk->sk_sndbuf >> 1);
21402140
}
21412141

21422142
static inline gfp_t gfp_any(void)

‎net/atm/br2684.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -252,7 +252,7 @@ static int br2684_xmit_vcc(struct sk_buff *skb, struct net_device *dev,
252252

253253
ATM_SKB(skb)->vcc = atmvcc = brvcc->atmvcc;
254254
pr_debug("atm_skb(%p)->vcc(%p)->dev(%p)\n", skb, atmvcc, atmvcc->dev);
255-
atomic_add(skb->truesize, &sk_atm(atmvcc)->sk_wmem_alloc);
255+
refcount_add(skb->truesize, &sk_atm(atmvcc)->sk_wmem_alloc);
256256
ATM_SKB(skb)->atm_options = atmvcc->atm_options;
257257
dev->stats.tx_packets++;
258258
dev->stats.tx_bytes += skb->len;

‎net/atm/clip.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -381,7 +381,7 @@ static netdev_tx_t clip_start_xmit(struct sk_buff *skb,
381381
memcpy(here, llc_oui, sizeof(llc_oui));
382382
((__be16 *) here)[3] = skb->protocol;
383383
}
384-
atomic_add(skb->truesize, &sk_atm(vcc)->sk_wmem_alloc);
384+
refcount_add(skb->truesize, &sk_atm(vcc)->sk_wmem_alloc);
385385
ATM_SKB(skb)->atm_options = vcc->atm_options;
386386
entry->vccs->last_use = jiffies;
387387
pr_debug("atm_skb(%p)->vcc(%p)->dev(%p)\n", skb, vcc, vcc->dev);

‎net/atm/common.c

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -80,9 +80,9 @@ static void vcc_sock_destruct(struct sock *sk)
8080
printk(KERN_DEBUG "%s: rmem leakage (%d bytes) detected.\n",
8181
__func__, atomic_read(&sk->sk_rmem_alloc));
8282

83-
if (atomic_read(&sk->sk_wmem_alloc))
83+
if (refcount_read(&sk->sk_wmem_alloc))
8484
printk(KERN_DEBUG "%s: wmem leakage (%d bytes) detected.\n",
85-
__func__, atomic_read(&sk->sk_wmem_alloc));
85+
__func__, refcount_read(&sk->sk_wmem_alloc));
8686
}
8787

8888
static void vcc_def_wakeup(struct sock *sk)
@@ -101,7 +101,7 @@ static inline int vcc_writable(struct sock *sk)
101101
struct atm_vcc *vcc = atm_sk(sk);
102102

103103
return (vcc->qos.txtp.max_sdu +
104-
atomic_read(&sk->sk_wmem_alloc)) <= sk->sk_sndbuf;
104+
refcount_read(&sk->sk_wmem_alloc)) <= sk->sk_sndbuf;
105105
}
106106

107107
static void vcc_write_space(struct sock *sk)
@@ -156,7 +156,7 @@ int vcc_create(struct net *net, struct socket *sock, int protocol, int family, i
156156
memset(&vcc->local, 0, sizeof(struct sockaddr_atmsvc));
157157
memset(&vcc->remote, 0, sizeof(struct sockaddr_atmsvc));
158158
vcc->qos.txtp.max_sdu = 1 << 16; /* for meta VCs */
159-
atomic_set(&sk->sk_wmem_alloc, 1);
159+
refcount_set(&sk->sk_wmem_alloc, 1);
160160
atomic_set(&sk->sk_rmem_alloc, 0);
161161
vcc->push = NULL;
162162
vcc->pop = NULL;
@@ -630,7 +630,7 @@ int vcc_sendmsg(struct socket *sock, struct msghdr *m, size_t size)
630630
goto out;
631631
}
632632
pr_debug("%d += %d\n", sk_wmem_alloc_get(sk), skb->truesize);
633-
atomic_add(skb->truesize, &sk->sk_wmem_alloc);
633+
refcount_add(skb->truesize, &sk->sk_wmem_alloc);
634634

635635
skb->dev = NULL; /* for paths shared with net_device interfaces */
636636
ATM_SKB(skb)->atm_options = vcc->atm_options;

‎net/atm/lec.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -181,7 +181,7 @@ lec_send(struct atm_vcc *vcc, struct sk_buff *skb)
181181
ATM_SKB(skb)->vcc = vcc;
182182
ATM_SKB(skb)->atm_options = vcc->atm_options;
183183

184-
atomic_add(skb->truesize, &sk_atm(vcc)->sk_wmem_alloc);
184+
refcount_add(skb->truesize, &sk_atm(vcc)->sk_wmem_alloc);
185185
if (vcc->send(vcc, skb) < 0) {
186186
dev->stats.tx_dropped++;
187187
return;
@@ -345,7 +345,7 @@ static int lec_atm_send(struct atm_vcc *vcc, struct sk_buff *skb)
345345
int i;
346346
char *tmp; /* FIXME */
347347

348-
atomic_sub(skb->truesize, &sk_atm(vcc)->sk_wmem_alloc);
348+
WARN_ON(refcount_sub_and_test(skb->truesize, &sk_atm(vcc)->sk_wmem_alloc));
349349
mesg = (struct atmlec_msg *)skb->data;
350350
tmp = skb->data;
351351
tmp += sizeof(struct atmlec_msg);

‎net/atm/mpc.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -555,7 +555,7 @@ static int send_via_shortcut(struct sk_buff *skb, struct mpoa_client *mpc)
555555
sizeof(struct llc_snap_hdr));
556556
}
557557

558-
atomic_add(skb->truesize, &sk_atm(entry->shortcut)->sk_wmem_alloc);
558+
refcount_add(skb->truesize, &sk_atm(entry->shortcut)->sk_wmem_alloc);
559559
ATM_SKB(skb)->atm_options = entry->shortcut->atm_options;
560560
entry->shortcut->send(entry->shortcut, skb);
561561
entry->packets_fwded++;
@@ -911,7 +911,7 @@ static int msg_from_mpoad(struct atm_vcc *vcc, struct sk_buff *skb)
911911

912912
struct mpoa_client *mpc = find_mpc_by_vcc(vcc);
913913
struct k_message *mesg = (struct k_message *)skb->data;
914-
atomic_sub(skb->truesize, &sk_atm(vcc)->sk_wmem_alloc);
914+
WARN_ON(refcount_sub_and_test(skb->truesize, &sk_atm(vcc)->sk_wmem_alloc));
915915

916916
if (mpc == NULL) {
917917
pr_info("no mpc found\n");

‎net/atm/pppoatm.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -350,7 +350,7 @@ static int pppoatm_send(struct ppp_channel *chan, struct sk_buff *skb)
350350
return 1;
351351
}
352352

353-
atomic_add(skb->truesize, &sk_atm(ATM_SKB(skb)->vcc)->sk_wmem_alloc);
353+
refcount_add(skb->truesize, &sk_atm(ATM_SKB(skb)->vcc)->sk_wmem_alloc);
354354
ATM_SKB(skb)->atm_options = ATM_SKB(skb)->vcc->atm_options;
355355
pr_debug("atm_skb(%p)->vcc(%p)->dev(%p)\n",
356356
skb, ATM_SKB(skb)->vcc, ATM_SKB(skb)->vcc->dev);

‎net/atm/raw.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@ static void atm_pop_raw(struct atm_vcc *vcc, struct sk_buff *skb)
3535

3636
pr_debug("(%d) %d -= %d\n",
3737
vcc->vci, sk_wmem_alloc_get(sk), skb->truesize);
38-
atomic_sub(skb->truesize, &sk->sk_wmem_alloc);
38+
WARN_ON(refcount_sub_and_test(skb->truesize, &sk->sk_wmem_alloc));
3939
dev_kfree_skb_any(skb);
4040
sk->sk_write_space(sk);
4141
}

‎net/atm/signaling.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -67,7 +67,7 @@ static int sigd_send(struct atm_vcc *vcc, struct sk_buff *skb)
6767
struct sock *sk;
6868

6969
msg = (struct atmsvc_msg *) skb->data;
70-
atomic_sub(skb->truesize, &sk_atm(vcc)->sk_wmem_alloc);
70+
WARN_ON(refcount_sub_and_test(skb->truesize, &sk_atm(vcc)->sk_wmem_alloc));
7171
vcc = *(struct atm_vcc **) &msg->vcc;
7272
pr_debug("%d (0x%lx)\n", (int)msg->type, (unsigned long)vcc);
7373
sk = sk_atm(vcc);

‎net/caif/caif_socket.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1013,7 +1013,7 @@ static const struct proto_ops caif_stream_ops = {
10131013
static void caif_sock_destructor(struct sock *sk)
10141014
{
10151015
struct caifsock *cf_sk = container_of(sk, struct caifsock, sk);
1016-
caif_assert(!atomic_read(&sk->sk_wmem_alloc));
1016+
caif_assert(!refcount_read(&sk->sk_wmem_alloc));
10171017
caif_assert(sk_unhashed(sk));
10181018
caif_assert(!sk->sk_socket);
10191019
if (!sock_flag(sk, SOCK_DEAD)) {

‎net/core/datagram.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -614,7 +614,7 @@ int zerocopy_sg_from_iter(struct sk_buff *skb, struct iov_iter *from)
614614
skb->data_len += copied;
615615
skb->len += copied;
616616
skb->truesize += truesize;
617-
atomic_add(truesize, &skb->sk->sk_wmem_alloc);
617+
refcount_add(truesize, &skb->sk->sk_wmem_alloc);
618618
while (copied) {
619619
int size = min_t(int, copied, PAGE_SIZE - start);
620620
skb_fill_page_desc(skb, frag++, pages[n], start, size);

‎net/core/skbuff.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3024,7 +3024,7 @@ int skb_append_datato_frags(struct sock *sk, struct sk_buff *skb,
30243024
get_page(pfrag->page);
30253025

30263026
skb->truesize += copy;
3027-
atomic_add(copy, &sk->sk_wmem_alloc);
3027+
refcount_add(copy, &sk->sk_wmem_alloc);
30283028
skb->len += copy;
30293029
skb->data_len += copy;
30303030
offset += copy;

‎net/core/sock.c

Lines changed: 13 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1528,7 +1528,7 @@ struct sock *sk_alloc(struct net *net, int family, gfp_t priority,
15281528
if (likely(sk->sk_net_refcnt))
15291529
get_net(net);
15301530
sock_net_set(sk, net);
1531-
atomic_set(&sk->sk_wmem_alloc, 1);
1531+
refcount_set(&sk->sk_wmem_alloc, 1);
15321532

15331533
mem_cgroup_sk_alloc(sk);
15341534
cgroup_sk_alloc(&sk->sk_cgrp_data);
@@ -1552,7 +1552,7 @@ static void __sk_destruct(struct rcu_head *head)
15521552
sk->sk_destruct(sk);
15531553

15541554
filter = rcu_dereference_check(sk->sk_filter,
1555-
atomic_read(&sk->sk_wmem_alloc) == 0);
1555+
refcount_read(&sk->sk_wmem_alloc) == 0);
15561556
if (filter) {
15571557
sk_filter_uncharge(sk, filter);
15581558
RCU_INIT_POINTER(sk->sk_filter, NULL);
@@ -1602,7 +1602,7 @@ void sk_free(struct sock *sk)
16021602
* some packets are still in some tx queue.
16031603
* If not null, sock_wfree() will call __sk_free(sk) later
16041604
*/
1605-
if (atomic_dec_and_test(&sk->sk_wmem_alloc))
1605+
if (refcount_dec_and_test(&sk->sk_wmem_alloc))
16061606
__sk_free(sk);
16071607
}
16081608
EXPORT_SYMBOL(sk_free);
@@ -1659,7 +1659,7 @@ struct sock *sk_clone_lock(const struct sock *sk, const gfp_t priority)
16591659
/*
16601660
* sk_wmem_alloc set to one (see sk_free() and sock_wfree())
16611661
*/
1662-
atomic_set(&newsk->sk_wmem_alloc, 1);
1662+
refcount_set(&newsk->sk_wmem_alloc, 1);
16631663
atomic_set(&newsk->sk_omem_alloc, 0);
16641664
sk_init_common(newsk);
16651665

@@ -1787,15 +1787,15 @@ void sock_wfree(struct sk_buff *skb)
17871787
* Keep a reference on sk_wmem_alloc, this will be released
17881788
* after sk_write_space() call
17891789
*/
1790-
atomic_sub(len - 1, &sk->sk_wmem_alloc);
1790+
WARN_ON(refcount_sub_and_test(len - 1, &sk->sk_wmem_alloc));
17911791
sk->sk_write_space(sk);
17921792
len = 1;
17931793
}
17941794
/*
17951795
* if sk_wmem_alloc reaches 0, we must finish what sk_free()
17961796
* could not do because of in-flight packets
17971797
*/
1798-
if (atomic_sub_and_test(len, &sk->sk_wmem_alloc))
1798+
if (refcount_sub_and_test(len, &sk->sk_wmem_alloc))
17991799
__sk_free(sk);
18001800
}
18011801
EXPORT_SYMBOL(sock_wfree);
@@ -1807,7 +1807,7 @@ void __sock_wfree(struct sk_buff *skb)
18071807
{
18081808
struct sock *sk = skb->sk;
18091809

1810-
if (atomic_sub_and_test(skb->truesize, &sk->sk_wmem_alloc))
1810+
if (refcount_sub_and_test(skb->truesize, &sk->sk_wmem_alloc))
18111811
__sk_free(sk);
18121812
}
18131813

@@ -1829,7 +1829,7 @@ void skb_set_owner_w(struct sk_buff *skb, struct sock *sk)
18291829
* is enough to guarantee sk_free() wont free this sock until
18301830
* all in-flight packets are completed
18311831
*/
1832-
atomic_add(skb->truesize, &sk->sk_wmem_alloc);
1832+
refcount_add(skb->truesize, &sk->sk_wmem_alloc);
18331833
}
18341834
EXPORT_SYMBOL(skb_set_owner_w);
18351835

@@ -1852,7 +1852,7 @@ void skb_orphan_partial(struct sk_buff *skb)
18521852
struct sock *sk = skb->sk;
18531853

18541854
if (atomic_inc_not_zero(&sk->sk_refcnt)) {
1855-
atomic_sub(skb->truesize, &sk->sk_wmem_alloc);
1855+
WARN_ON(refcount_sub_and_test(skb->truesize, &sk->sk_wmem_alloc));
18561856
skb->destructor = sock_efree;
18571857
}
18581858
} else {
@@ -1912,7 +1912,7 @@ EXPORT_SYMBOL(sock_i_ino);
19121912
struct sk_buff *sock_wmalloc(struct sock *sk, unsigned long size, int force,
19131913
gfp_t priority)
19141914
{
1915-
if (force || atomic_read(&sk->sk_wmem_alloc) < sk->sk_sndbuf) {
1915+
if (force || refcount_read(&sk->sk_wmem_alloc) < sk->sk_sndbuf) {
19161916
struct sk_buff *skb = alloc_skb(size, priority);
19171917
if (skb) {
19181918
skb_set_owner_w(skb, sk);
@@ -1987,7 +1987,7 @@ static long sock_wait_for_wmem(struct sock *sk, long timeo)
19871987
break;
19881988
set_bit(SOCK_NOSPACE, &sk->sk_socket->flags);
19891989
prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE);
1990-
if (atomic_read(&sk->sk_wmem_alloc) < sk->sk_sndbuf)
1990+
if (refcount_read(&sk->sk_wmem_alloc) < sk->sk_sndbuf)
19911991
break;
19921992
if (sk->sk_shutdown & SEND_SHUTDOWN)
19931993
break;
@@ -2310,7 +2310,7 @@ int __sk_mem_raise_allocated(struct sock *sk, int size, int amt, int kind)
23102310
if (sk->sk_type == SOCK_STREAM) {
23112311
if (sk->sk_wmem_queued < prot->sysctl_wmem[0])
23122312
return 1;
2313-
} else if (atomic_read(&sk->sk_wmem_alloc) <
2313+
} else if (refcount_read(&sk->sk_wmem_alloc) <
23142314
prot->sysctl_wmem[0])
23152315
return 1;
23162316
}
@@ -2577,7 +2577,7 @@ static void sock_def_write_space(struct sock *sk)
25772577
/* Do not wake up a writer until he can make "significant"
25782578
* progress. --DaveM
25792579
*/
2580-
if ((atomic_read(&sk->sk_wmem_alloc) << 1) <= sk->sk_sndbuf) {
2580+
if ((refcount_read(&sk->sk_wmem_alloc) << 1) <= sk->sk_sndbuf) {
25812581
wq = rcu_dereference(sk->sk_wq);
25822582
if (skwq_has_sleeper(wq))
25832583
wake_up_interruptible_sync_poll(&wq->wait, POLLOUT |

‎net/ipv4/af_inet.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -150,7 +150,7 @@ void inet_sock_destruct(struct sock *sk)
150150
}
151151

152152
WARN_ON(atomic_read(&sk->sk_rmem_alloc));
153-
WARN_ON(atomic_read(&sk->sk_wmem_alloc));
153+
WARN_ON(refcount_read(&sk->sk_wmem_alloc));
154154
WARN_ON(sk->sk_wmem_queued);
155155
WARN_ON(sk->sk_forward_alloc);
156156

‎net/ipv4/esp4.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -307,7 +307,7 @@ int esp_output_head(struct xfrm_state *x, struct sk_buff *skb, struct esp_info *
307307
skb->data_len += tailen;
308308
skb->truesize += tailen;
309309
if (sk)
310-
atomic_add(tailen, &sk->sk_wmem_alloc);
310+
refcount_add(tailen, &sk->sk_wmem_alloc);
311311

312312
goto out;
313313
}

0 commit comments

Comments
 (0)