Commit 1d2fbaad authored by Eric Dumazet's avatar Eric Dumazet Committed by Jakub Kicinski
Browse files

tcp: stronger sk_rcvbuf checks 



Currently, TCP stack accepts incoming packet if sizes of receive queues
are below sk->sk_rcvbuf limit.

This can cause memory overshoot if the packet is big, like an 1/2 MB
BIG TCP one.

Refine the check to take into account the incoming skb truesize.

Note that we still accept the packet if the receive queue is empty,
to not completely freeze TCP flows in pathological conditions.

Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
Reviewed-by: default avatarKuniyuki Iwashima <kuniyu@google.com>
Link: https://patch.msgid.link/20250711114006.480026-8-edumazet@google.com


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parent 75dff058

net/ipv4/tcp_input.c

+16 −6
Original line number Diff line number Diff line
@@ -4888,10 +4888,20 @@ static void tcp_ofo_queue(struct sock *sk) 
static bool tcp_prune_ofo_queue(struct sock *sk, const struct sk_buff *in_skb);

static int tcp_prune_queue(struct sock *sk, const struct sk_buff *in_skb);



/* Check if this incoming skb can be added to socket receive queues

 * while satisfying sk->sk_rcvbuf limit.

 */

static bool tcp_can_ingest(const struct sock *sk, const struct sk_buff *skb)

{

	unsigned int new_mem = atomic_read(&sk->sk_rmem_alloc) + skb->truesize;



	return new_mem <= sk->sk_rcvbuf;

}



static int tcp_try_rmem_schedule(struct sock *sk, const struct sk_buff *skb,

				 unsigned int size)

{

	if (atomic_read(&sk->sk_rmem_alloc) > sk->sk_rcvbuf ||

	if (!tcp_can_ingest(sk, skb) ||

	    !sk_rmem_schedule(sk, skb, size)) {



		if (tcp_prune_queue(sk, skb) < 0)
@@ -5507,7 +5517,7 @@ static bool tcp_prune_ofo_queue(struct sock *sk, const struct sk_buff *in_skb) 
		tcp_drop_reason(sk, skb, SKB_DROP_REASON_TCP_OFO_QUEUE_PRUNE);

		tp->ooo_last_skb = rb_to_skb(prev);

		if (!prev || goal <= 0) {

			if (atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf &&

			if (tcp_can_ingest(sk, skb) &&

			    !tcp_under_memory_pressure(sk))

				break;

			goal = sk->sk_rcvbuf >> 3;
@@ -5541,12 +5551,12 @@ static int tcp_prune_queue(struct sock *sk, const struct sk_buff *in_skb) 


	NET_INC_STATS(sock_net(sk), LINUX_MIB_PRUNECALLED);



	if (atomic_read(&sk->sk_rmem_alloc) >= sk->sk_rcvbuf)

	if (!tcp_can_ingest(sk, in_skb))

		tcp_clamp_window(sk);

	else if (tcp_under_memory_pressure(sk))

		tcp_adjust_rcv_ssthresh(sk);



	if (atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf)

	if (tcp_can_ingest(sk, in_skb))

		return 0;



	tcp_collapse_ofo_queue(sk);
@@ -5556,7 +5566,7 @@ static int tcp_prune_queue(struct sock *sk, const struct sk_buff *in_skb) 
			     NULL,

			     tp->copied_seq, tp->rcv_nxt);



	if (atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf)

	if (tcp_can_ingest(sk, in_skb))

		return 0;



	/* Collapsing did not help, destructive actions follow.
@@ -5564,7 +5574,7 @@ static int tcp_prune_queue(struct sock *sk, const struct sk_buff *in_skb) 


	tcp_prune_ofo_queue(sk, in_skb);



	if (atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf)

	if (tcp_can_ingest(sk, in_skb))

		return 0;



	/* If we are really being abused, tell the caller to silently