tcp: Fix truesize accounting in tcp_try_coalesce

This patch addresses several issues in the way we were tracking the
truesize in tcp_try_coalesce.

First it was using ksize which prevents us from having a 0 sized head frag
and getting a usable result.  To resolve that this patch uses the end
pointer which is set based off either ksize, or the frag_size supplied in
build_skb.  This allows us to compute the original truesize of the entire
buffer and remove that value leaving us with just what was added as pages.

The second issue was the use of skb->len if there is a mergeable head frag.
We should only need to remove the size of an data aligned sk_buff from our
current skb->truesize to compute the delta for a buffer with a reused head.
By using skb->len the value of truesize was being artificially reduced
which means that head frags could use more memory than buffers using
standard allocations.

Signed-off-by: Alexander Duyck <alexander.h.duyck@intel.com>
Cc: Eric Dumazet <edumazet@google.com>
Cc: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index c6f78e2b590fcbb476a27ec8867a1faecf619ee6..3cb273ac88213777f97468752de42071242e84f4 100644 (file)
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -4565,12 +4565,10 @@ merge:
        if (skb_headlen(from) == 0 &&
            (skb_shinfo(to)->nr_frags +
             skb_shinfo(from)->nr_frags <= MAX_SKB_FRAGS)) {
-               WARN_ON_ONCE(from->head_frag);
-               delta = from->truesize - ksize(from->head) -
-                       SKB_DATA_ALIGN(sizeof(struct sk_buff));
-
-               WARN_ON_ONCE(delta < len);
+               delta = from->truesize -
+                       SKB_TRUESIZE(skb_end_pointer(from) - from->head);
 copyfrags:
+               WARN_ON_ONCE(delta < len);
                memcpy(skb_shinfo(to)->frags + skb_shinfo(to)->nr_frags,
                       skb_shinfo(from)->frags,
                       skb_shinfo(from)->nr_frags * sizeof(skb_frag_t));
@@ -4600,7 +4598,7 @@ copyfrags:
                skb_fill_page_desc(to, skb_shinfo(to)->nr_frags,
                                   page, offset, skb_headlen(from));
                *fragstolen = true;
-               delta = len; /* we dont know real truesize... */
+               delta = from->truesize - SKB_DATA_ALIGN(sizeof(struct sk_buff));
                goto copyfrags;
        }
        return false;