Patch "mptcp: fix memory accounting on allocation error" has been added to the 5.11-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    mptcp: fix memory accounting on allocation error

to the 5.11-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     mptcp-fix-memory-accounting-on-allocation-error.patch
and it can be found in the queue-5.11 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 620f3a130336df6784b1f6c184cbf7e4b84582aa
Author: Paolo Abeni <pabeni@xxxxxxxxxx>
Date:   Thu Mar 4 13:32:10 2021 -0800

    mptcp: fix memory accounting on allocation error
    
    [ Upstream commit eaeef1ce55ec9161e0c44ff27017777b1644b421 ]
    
    In case of memory pressure the MPTCP xmit path keeps
    at most a single skb in the tx cache, eventually freeing
    additional ones.
    
    The associated counter for forward memory is not update
    accordingly, and that causes the following splat:
    
    WARNING: CPU: 0 PID: 12 at net/core/stream.c:208 sk_stream_kill_queues+0x3ca/0x530 net/core/stream.c:208
    Modules linked in:
    CPU: 0 PID: 12 Comm: kworker/0:1 Not tainted 5.11.0-rc2 #59
    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014
    Workqueue: events mptcp_worker
    RIP: 0010:sk_stream_kill_queues+0x3ca/0x530 net/core/stream.c:208
    Code: 03 0f b6 04 02 84 c0 74 08 3c 03 0f 8e 63 01 00 00 8b ab 00 01 00 00 e9 60 ff ff ff e8 2f 24 d3 fe 0f 0b eb 97 e8 26 24 d3 fe <0f> 0b eb a0 e8 1d 24 d3 fe 0f 0b e9 a5 fe ff ff 4c 89 e7 e8 0e d0
    RSP: 0018:ffffc900000c7bc8 EFLAGS: 00010293
    RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
    RDX: ffff88810030ac40 RSI: ffffffff8262ca4a RDI: 0000000000000003
    RBP: 0000000000000d00 R08: 0000000000000000 R09: ffffffff85095aa7
    R10: ffffffff8262c9ea R11: 0000000000000001 R12: ffff888108908100
    R13: ffffffff85095aa0 R14: ffffc900000c7c48 R15: 1ffff92000018f85
    FS:  0000000000000000(0000) GS:ffff88811b200000(0000) knlGS:0000000000000000
    CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    CR2: 00007fa7444baef8 CR3: 0000000035ee9005 CR4: 0000000000170ef0
    Call Trace:
     __mptcp_destroy_sock+0x4a7/0x6c0 net/mptcp/protocol.c:2547
     mptcp_worker+0x7dd/0x1610 net/mptcp/protocol.c:2272
     process_one_work+0x896/0x1170 kernel/workqueue.c:2275
     worker_thread+0x605/0x1350 kernel/workqueue.c:2421
     kthread+0x344/0x410 kernel/kthread.c:292
     ret_from_fork+0x22/0x30 arch/x86/entry/entry_64.S:296
    
    At close time, as reported by syzkaller/Christoph.
    
    This change address the issue properly updating the fwd
    allocated memory counter in the error path.
    
    Reported-by: Christoph Paasch <cpaasch@xxxxxxxxx>
    Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/136
    Fixes: 724cfd2ee8aa ("mptcp: allocate TX skbs in msk context")
    Signed-off-by: Paolo Abeni <pabeni@xxxxxxxxxx>
    Signed-off-by: Mat Martineau <mathew.j.martineau@xxxxxxxxxxxxxxx>
    Signed-off-by: David S. Miller <davem@xxxxxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c
index de89824a2a36..056846eb2e5b 100644
--- a/net/mptcp/protocol.c
+++ b/net/mptcp/protocol.c
@@ -1176,6 +1176,7 @@ static bool mptcp_tx_cache_refill(struct sock *sk, int size,
 			 */
 			while (skbs->qlen > 1) {
 				skb = __skb_dequeue_tail(skbs);
+				*total_ts -= skb->truesize;
 				__kfree_skb(skb);
 			}
 			return skbs->qlen > 0;