Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
MIME-Version: 1.0
References: <20221021040622.815143-1-luwei32@huawei.com>
In-Reply-To: <20221021040622.815143-1-luwei32@huawei.com>
From:   Eric Dumazet <edumazet@google.com>
Date:   Fri, 21 Oct 2022 09:01:28 -0700
Message-ID: <CANn89iK2N5Vo3XoTcxHJWu3XtDD=B1Axnr1axx-NbKvnAEHXxw@mail.gmail.com>
Subject: Re: [PATCH net,v3] tcp: fix a signed-integer-overflow bug in tcp_add_backlog()
To:     Lu Wei <luwei32@huawei.com>
Cc:     davem@davemloft.net, kuba@kernel.org, pabeni@redhat.com,
        yoshfuji@linux-ipv6.org, dsahern@kernel.org, ast@kernel.org,
        martin.lau@kernel.org, kuniyu@amazon.com, asml.silence@gmail.com,
        imagedong@tencent.com, ncardwell@google.com,
        netdev@vger.kernel.org, linux-kernel@vger.kernel.org
Content-Type: text/plain; charset="UTF-8"
Precedence: bulk

On Thu, Oct 20, 2022 at 8:03 PM Lu Wei <luwei32@huawei.com> wrote:
>
> The type of sk_rcvbuf and sk_sndbuf in struct sock is int, and
> in tcp_add_backlog(), the variable limit is caculated by adding
> sk_rcvbuf, sk_sndbuf and 64 * 1024, it may exceed the max value
> of int and overflow. This patch reduces the limit budget by
> halving the sndbuf to solve this issue since ACK packets are much
> smaller than the payload.
>
> Fixes: c9c3321257e1 ("tcp: add tcp_add_backlog()")
> Signed-off-by: Lu Wei <luwei32@huawei.com>

Reviewed-by: Eric Dumazet <edumazet@google.com>