From: Eric Dumazet <edumazet@google.com>
Date: Tue, 14 Jun 2022 17:17:33 +0000 (-0700)
Subject: tcp: fix over estimation in sk_forced_mem_schedule()
X-Git-Tag: baikal/mips/sdk5.9~18
X-Git-Url: https://git.baikalelectronics.ru/sdk/?a=commitdiff_plain;h=fe33948de1bc3639b59a82b876a3d50d636dc2da;p=kernel.git

tcp: fix over estimation in sk_forced_mem_schedule()

commit 922ec70e68e84a85d1e91653aa9354675f58379d upstream.

sk_forced_mem_schedule() has a bug similar to ones fixed
in commit 91efb764f795 ("net: fix sk_wmem_schedule() and
sk_rmem_schedule() errors")

While this bug has little chance to trigger in old kernels,
we need to fix it before the following patch.

Fixes: 5d35369de88a ("tcp: fix possible deadlock in tcp_send_fin()")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Acked-by: Soheil Hassas Yeganeh <soheil@google.com>
Reviewed-by: Shakeel Butt <shakeelb@google.com>
Reviewed-by: Wei Wang <weiwan@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---

diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 24cadcdb9890a..40c9da4bd03e4 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -3372,11 +3372,12 @@ void tcp_xmit_retransmit_queue(struct sock *sk)
  */
 void sk_forced_mem_schedule(struct sock *sk, int size)
 {
-	int amt;
+	int delta, amt;
 
-	if (size <= sk->sk_forward_alloc)
+	delta = size - sk->sk_forward_alloc;
+	if (delta <= 0)
 		return;
-	amt = sk_mem_pages(size);
+	amt = sk_mem_pages(delta);
 	sk->sk_forward_alloc += amt * SK_MEM_QUANTUM;
 	sk_memory_allocated_add(sk, amt);