Patch "tcp: fastopen: avoid negative sk_forward_alloc" has been added to the 4.7-stable tree

Patch "tcp: fastopen: avoid negative sk_forward_alloc" has been added to the 4.7-stable tree

[gregkh]

This is a note to let you know that I've just added the patch titled

    tcp: fastopen: avoid negative sk_forward_alloc

to the 4.7-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     tcp-fastopen-avoid-negative-sk_forward_alloc.patch
and it can be found in the queue-4.7 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@vger.kernel.org> know about it.


>From foo@baz Wed Sep 21 10:05:18 CEST 2016
From: Eric Dumazet <edumazet@google.com>
Date: Wed, 7 Sep 2016 08:34:11 -0700
Subject: tcp: fastopen: avoid negative sk_forward_alloc

From: Eric Dumazet <edumazet@google.com>


[ Upstream commit 76061f631c2ea4ab9c4d66f3a96ecc5737f5aaf7 ]

When DATA and/or FIN are carried in a SYN/ACK message or SYN message,
we append an skb in socket receive queue, but we forget to call
sk_forced_mem_schedule().

Effect is that the socket has a negative sk->sk_forward_alloc as long as
the message is not read by the application.

Josh Hunt fixed a similar issue in commit d22e15371811 ("tcp: fix tcp
fin memory accounting")

Fixes: 168a8f58059a ("tcp: TCP Fast Open Server - main code path")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Josh Hunt <johunt@akamai.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/ipv4/tcp_fastopen.c |    1 +
 1 file changed, 1 insertion(+)

--- a/net/ipv4/tcp_fastopen.c
+++ b/net/ipv4/tcp_fastopen.c
@@ -150,6 +150,7 @@ void tcp_fastopen_add_skb(struct sock *s
 	tp->segs_in = 0;
 	tcp_segs_in(tp, skb);
 	__skb_pull(skb, tcp_hdrlen(skb));
+	sk_forced_mem_schedule(sk, skb->truesize);
 	skb_set_owner_r(skb, sk);
 
 	TCP_SKB_CB(skb)->seq++;


Patches currently in stable-queue which might be from edumazet@google.com are

queue-4.7/bonding-fix-bonding-crash.patch
queue-4.7/tcp-properly-scale-window-in-tcp_v_reqsk_send_ack.patch
queue-4.7/tcp-fastopen-avoid-negative-sk_forward_alloc.patch
queue-4.7/udp-fix-poll-issue-with-zero-sized-packets.patch
queue-4.7/tcp-fix-use-after-free-in-tcp_xmit_retransmit_queue.patch
queue-4.7/tun-fix-transmit-timestamp-support.patch