From: Eric Dumazet <eric.duma...@gmail.com> Date: Tue, 07 Nov 2017 15:15:04 -0800
> From: Eric Dumazet <eduma...@google.com> > > When a GSO skb of truesize O is segmented into 2 new skbs of truesize N1 > and N2, we want to transfer socket ownership to the new fresh skbs. > > In order to avoid expensive atomic operations on a cache line subject to > cache bouncing, we replace the sequence : > > refcount_add(N1, &sk->sk_wmem_alloc); > refcount_add(N2, &sk->sk_wmem_alloc); // repeated by number of segments > > refcount_sub(O, &sk->sk_wmem_alloc); > > by a single > > refcount_add(sum_of(N) - O, &sk->sk_wmem_alloc); > > Problem is : > > In some pathological cases, sum(N) - O might be a negative number, and > syzkaller bot was apparently able to trigger this trace [1] > > > atomic_t was ok with this construct, but we need to take care of the > negative delta with refcount_t ... > Fixes: 14afee4b6092 ("net: convert sock.sk_wmem_alloc from atomic_t to > refcount_t") > Signed-off-by: Eric Dumazet <eduma...@google.com> > Reported-by: syzbot <syzkal...@googlegroups.com> Applied and queued up for -stable, thanks Eric.