From mboxrd@z Thu Jan  1 00:00:00 1970
From: David Miller <davem@davemloft.net>
Subject: Re: [PATCH net] tcp: gso: avoid refcount_t warning from
 tcp_gso_segment()
Date: Fri, 10 Nov 2017 18:08:42 +0900 (KST)
Message-ID: <20171110.180842.1962719632798610107.davem@davemloft.net>
References: <1510096504.2849.100.camel@edumazet-glaptop3.roam.corp.google.com>
Mime-Version: 1.0
Content-Type: Text/Plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Cc: netdev@vger.kernel.org, elena.reshetova@intel.com,
        edumazet@google.com
To: eric.dumazet@gmail.com
Return-path: <netdev-owner@vger.kernel.org>
Received: from shards.monkeyblade.net ([184.105.139.130]:54310 "EHLO
        shards.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
        with ESMTP id S1752143AbdKJJIq (ORCPT
        <rfc822;netdev@vger.kernel.org>); Fri, 10 Nov 2017 04:08:46 -0500
In-Reply-To: <1510096504.2849.100.camel@edumazet-glaptop3.roam.corp.google.com>
Sender: netdev-owner@vger.kernel.org
List-ID: <netdev.vger.kernel.org>

From: Eric Dumazet <eric.dumazet@gmail.com>
Date: Tue, 07 Nov 2017 15:15:04 -0800

> From: Eric Dumazet <edumazet@google.com>
> 
> When a GSO skb of truesize O is segmented into 2 new skbs of truesize N1
> and N2, we want to transfer socket ownership to the new fresh skbs.
> 
> In order to avoid expensive atomic operations on a cache line subject to
> cache bouncing, we replace the sequence :
> 
> refcount_add(N1, &sk->sk_wmem_alloc);
> refcount_add(N2, &sk->sk_wmem_alloc); // repeated by number of segments
> 
> refcount_sub(O, &sk->sk_wmem_alloc);
> 
> by a single
> 
> refcount_add(sum_of(N) - O, &sk->sk_wmem_alloc);
> 
> Problem is :
> 
> In some pathological cases, sum(N) - O might be a negative number, and
> syzkaller bot was apparently able to trigger this trace [1]
> 
> 
> atomic_t was ok with this construct, but we need to take care of the
> negative delta with refcount_t
 ...
> Fixes: 14afee4b6092 ("net: convert sock.sk_wmem_alloc from atomic_t to refcount_t")
> Signed-off-by: Eric Dumazet <edumazet@google.com>
> Reported-by: syzbot <syzkaller@googlegroups.com>

Applied and queued up for -stable, thanks Eric.