• David Woodhouse's avatar
    atm: Preserve value of skb->truesize when accounting to vcc · 9bbe60a6
    David Woodhouse authored
    ATM accounts for in-flight TX packets in sk_wmem_alloc of the VCC on
    which they are to be sent. But it doesn't take ownership of those
    packets from the sock (if any) which originally owned them. They should
    remain owned by their actual sender until they've left the box.
    There's a hack in pskb_expand_head() to avoid adjusting skb->truesize
    for certain skbs, precisely to avoid messing up sk_wmem_alloc
    accounting. Ideally that hack would cover the ATM use case too, but it
    doesn't — skbs which aren't owned by any sock, for example PPP control
    frames, still get their truesize adjusted when the low-level ATM driver
    adds headroom.
    This has always been an issue, it seems. The truesize of a packet
    increases, and sk_wmem_alloc on the VCC goes negative. But this wasn't
    for normal traffic, only for control frames. So I think we just got away
    with it, and we probably needed to send 2GiB of LCP echo frames before
    the misaccounting would ever have caused a problem and caused
    atm_may_send() to start refusing packets.
    Commit 14afee4b ("net: convert sock.sk_wmem_alloc from atomic_t to
    refcount_t") did exactly what it was intended to do, and turned this
    mostly-theoretical problem into a real one, causing PPPoATM to fail
    immediately as sk_wmem_alloc underflows and atm_may_send() *immediately*
    starts refusing to allow new packets.
    The least intrusive solution to this problem is to stash the value of
    skb->truesize that was accounted to the VCC, in a new member of the
    ATM_SKB(skb) structure. Then in atm_pop_raw() subtract precisely that
    value instead of the then-current value of skb->truesize.
    Fixes: 158f323b ("net: adjust skb->truesize in pskb_expand_head()")
    Signed-off-by: David Woodhouse's avatarDavid Woodhouse <dwmw2@infradead.org>
    Tested-by: default avatarKevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
atmdev.h 10.2 KB