kernel/git/stable/linux.git/net/atm/common.c, branch linux-7.2.y

net/atm: fix slab-out-of-bounds read in vcc_setsockopt()

2026-08-06T16:29:14+00:00

vcc_setsockopt() contained an ineffective optlen check: if (__SO_LEVEL_MATCH(optname, level) && optlen != __SO_SIZE(optname)) return -EINVAL; If __SO_LEVEL_MATCH(optname, level) evaluated to false (e.g. if the caller passed a mismatched level), the length check optlen != __SO_SIZE(optname) was short-circuited and bypassed. Execution then fell through to switch(optname), calling copy_from_sockptr() assuming optval contained sufficient space. Furthermore, even if level matched, a cgroup BPF setsockopt filter could shrink optlen after entry. Because copy_from_sockptr() on kernel pointers uses memcpy(), this leads to a KASAN slab-out-of-bounds read when optlen is smaller than the expected structure size. Fix this by using copy_safe_from_sockptr(), which unconditionally validates that optlen is at least the expected size before copying. Also change the local 'value' variable type from 'unsigned long' to 'int' so that SO_SETCLP matches its sizeof(int) ABI encoding on 64-bit systems. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: syzbot+53ecc09fb81df10ef4de@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=53ecc09fb81df10ef4de Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20260805131508.3227331-1-edumazet@google.com Signed-off-by: Jakub Kicinski

Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

2026-06-16T21:59:58+00:00

Merge in late fixes in preparation for the net-next PR. Conflicts: net/tls/tls_sw.c 406e8a651a7b ("net: skmsg: preserve sg.copy across SG transforms") 79511603a65b ("tls: remove dead sockmap (psock) handling from the SW path") drivers/net/ethernet/microsoft/mana/mana_en.c f8fd56977eeea ("net: mana: guard TX wq object destroy with INVALID_MANA_HANDLE check") d07efe5a6e641 ("net: mana: Use per-queue allocation for tx_qp to reduce allocation size") https://lore.kernel.org/ajAPXu-C_PuTgV-a@sirena.org.uk No adjacent changes. Signed-off-by: Jakub Kicinski

atm: remove the unused pre_send and send_bh device operations

2026-06-16T15:53:52+00:00

atmdev_ops::pre_send (a TX pre-processing hook) and ::send_bh (a bottom-half capable send variant) have no implementation behind them: no remaining ATM driver sets either, so vcc_sendmsg() always skipped pre_send and the raw AAL0/AAL5 paths always fell back to ->send(). The drivers that used these hooks were removed with the legacy ATM adapters. Drop both operations and the dead branches that tested for them. Link: https://patch.msgid.link/20260615194416.752559-8-kuba@kernel.org Signed-off-by: Jakub Kicinski

atm: remove the unused change_qos device operation

2026-06-16T15:53:52+00:00

atmdev_ops::change_qos() was the hook for renegotiating the traffic parameters of an already-connected VCC, driven from SO_ATMQOS on a connected socket (and previously from the SVC as_modify path, now gone). None of the ATM drivers left in tree implement it - solos-pci only listed change_qos = NULL - so atm_change_qos() always returned -EOPNOTSUPP. Drop the operation and return -EOPNOTSUPP directly. Link: https://patch.msgid.link/20260615194416.752559-7-kuba@kernel.org Signed-off-by: Jakub Kicinski

atm: remove SVC socket support and the signaling daemon interface

2026-06-16T15:53:52+00:00

ATM switched virtual circuits (SVCs) are set up and torn down by a user-space signaling daemon (atmsigd) which the kernel talks to over a dedicated "sigd" socket: the kernel marshals Q.2931-style requests (as_connect, as_listen, as_accept, as_close, ...) to the daemon and applies the results to PF_ATMSVC sockets. This is the machinery behind classical SVC use and was the foundation for LANE / MPOA, all of which have been removed. DSL deployments do not use any of this. PPPoATM and BR2684 run over permanent virtual circuits (PF_ATMPVC) with a statically configured VPI/VCI; no atmsigd, no Q.2931. Neither remaining ATM driver (solos-pci, the USB DSL modems) is reachable through the SVC path. Remove the SVC socket family and the signaling interface: - delete net/atm/svc.c, net/atm/signaling.c and signaling.h - drop atmsvc_init()/atmsvc_exit() and the PF_ATMSVC registration and module alias - drop the ATMSIGD_CTRL ioctl (sigd_attach) and the /proc/net/atm/svc file - fold the SVC branch out of atm_change_qos(); all sockets are PVCs now The obsolete ATM_SETSC ioctl stub is left in place (it already just warns and returns 0), as is the struct atm_vcc SVC bookkeeping shared with the queueing layer. Link: https://patch.msgid.link/20260615194416.752559-6-kuba@kernel.org Signed-off-by: Jakub Kicinski

atm: remove the local ATM (NSAP) address registry

2026-06-16T15:53:52+00:00

net/atm/addr.c maintained the per-device lists of local NSAP addresses (dev->local) and ILMI-learned LECS addresses (dev->lecs). These exist solely to serve SVC signaling: the lists are populated through the ATM_{ADD,DEL,RST}ADDR / ATM_{ADD,DEL,GET}LECSADDR ioctls used by the atmsigd / ILMI daemons, and consumed when registering addresses with the signaling daemon. The LECS list belonged to LAN Emulation, which has been removed. With no SVC users in a DSL-only configuration these lists are always empty, so drop the registry entirely: - remove the ADDR/LECSADDR/RSTADDR ioctls - drop the now-always-empty "atmaddress" sysfs attribute - remove the dev->local / dev->lecs lists, structs and enums - delete net/atm/addr.c and net/atm/addr.h The device ESI ("MAC" address) and its ATM_{G,S}ETESI ioctls and "address" sysfs attribute are retained - the USB DSL modems populate the ESI. Link: https://patch.msgid.link/20260615194416.752559-5-kuba@kernel.org Signed-off-by: Jakub Kicinski

atm: remove the unused send_oam / push_oam callbacks

2026-06-16T15:53:52+00:00

The atmdev_ops::send_oam device operation and the atm_vcc::push_oam callback were the kernel's interface for raw F4/F5 OAM cell exchange. Nothing assigns them a non-NULL value and nothing ever invokes them: the core only ever initialises push_oam to NULL (in vcc_create() and the AAL init helpers) and the Solos driver only lists send_oam = NULL for documentation. The drivers that actually drove OAM through these hooks were removed along with the legacy ATM adapters. Drop both callbacks and the NULL initialisers. Link: https://patch.msgid.link/20260615194416.752559-3-kuba@kernel.org Signed-off-by: Jakub Kicinski

atm: remove AAL3/4 transport support

2026-06-16T15:53:51+00:00

AAL3/4 is an obsolete connection-oriented ATM adaptation layer that has seen no real use since the SMDS-era hardware it was designed for (90s?). We are only maintaining ATM support in-tree to keep PPPoATM running, and PPPoATM runs over AAL5. Drop the "raw" AAL3/4 transport (atm_init_aal34()) and the ATM_AAL34 cases in the connect and traffic-parameter paths. A vcc_connect() with qos.aal == ATM_AAL34 now fails with -EPROTOTYPE. uAPI cleanup is performed later, separately. Link: https://patch.msgid.link/20260615194416.752559-2-kuba@kernel.org Signed-off-by: Jakub Kicinski

net: atm: reject out-of-range traffic classes in QoS validation

2026-06-12T23:33:36+00:00

Reject ATM traffic classes above ATM_ANYCLASS in check_tp(). SO_ATMQOS stores the supplied QoS after check_qos() succeeds, so accepting larger values leaves invalid traffic_class values in vcc->qos. That bad state later reaches pvc_info(), which indexes class_name[] with vcc->qos.{rx,tp}.traffic_class. Values above ATM_ANYCLASS cause an out-of-bounds read when /proc/net/atm/pvc is read. Tighten the existing QoS validation so invalid traffic_class values are rejected at the point where user supplied QoS is accepted. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable@vger.kernel.org Reported-by: Yuan Tan Reported-by: Xin Liu Signed-off-by: Zhengchuan Liang Signed-off-by: Ren Wei Reviewed-by: Simon Horman Link: https://patch.msgid.link/58f02c6f73d9818fd5d2022e1116759fdde6116b.1780965530.git.zcliangcn@gmail.com Signed-off-by: Jakub Kicinski

atm: convert to getsockopt_iter

2026-05-22T18:11:09+00:00

Convert the ATM SVC and PVC sockets, along with the shared vcc_getsockopt() helper, to use the new getsockopt_iter callback with sockopt_t. Key changes: - Replace (char __user *optval, int __user *optlen) with sockopt_t *opt - Use opt->optlen for buffer length (input) - Use copy_to_iter() instead of put_user()/copy_to_user() Acked-by: Stanislav Fomichev Signed-off-by: Breno Leitao Link: https://patch.msgid.link/20260520-getsock_four-v3-2-b8c0b16b7780@debian.org Signed-off-by: Jakub Kicinski