Re: [PATCH v2 net] inet: frags: bound the wmem charge of the socket completing a reassembly

[patchwork-bot+netdevbpf@kernel.org]

Hello:

This patch was applied to netdev/net.git (main)
by Paolo Abeni <pabeni@redhat.com>:

On Wed,  4 Nov 2026 13:29:27 +0100 you wrote:
> When a socket owned fragment completes a reassembly queue,
> inet_frag_reasm_prepare() and inet_frag_reasm_finish() charge the
> truesize of all other fragments to its sk_wmem_alloc. These fragments
> were orphaned when queued, and might have been sent by someone else,
> for instance padded TUN packets.
> 
> Commit 3ae20e4697eb ("inet: frags: limit the truesize of a reassembly
> queue") bounds this charge to INT_MAX / 2 per queue, but a socket can
> complete several queues while the reassembled skbs are still alive,
> for instance held in a qdisc. sk_wmem_alloc can then go past INT_MAX,
> refcount_add() saturates it with a WARN, and the socket is leaked.
> 
> [...]

Here is the summary with links:
  - [v2,net] inet: frags: bound the wmem charge of the socket completing a reassembly
    https://git.kernel.org/netdev/net/c/b71c101bbb98

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html