[PATCH net 0/2] net: fix SO_RESERVE_MEM socket type restriction and value bounds

[Eric Dumazet <edumazet@google.com>]

This series fixes two issues with SO_RESERVE_MEM and adds a kselftest suite:

- Patch 1 restricts sock_reserve_memory() to TCP sockets (sk_is_tcp(sk))
  instead of sk_has_account(sk), and caps the requested reservation to
  INT_MAX >> 1 in sk_setsockopt(SO_RESERVE_MEM).

  Currently, sk_has_account(sk) allows SO_RESERVE_MEM on UDP sockets,
  where sk->sk_forward_alloc is protected by sk->sk_receive_queue.lock
  rather than the socket lock, and udp_rmem_release() does not account
  for sk_unused_reserved_mem(sk). Concurrent UDP packet processing and
  setsockopt(SO_RESERVE_MEM) corrupt sk_forward_alloc and memcg
  accounting. In addition, values near INT_MAX overflow 32-bit signed
  int in sk_mem_pages(delta) and (pages << PAGE_SHIFT).

- Patch 2 adds a kselftest (tools/testing/selftests/net/so_reserve_mem.c)
  covering non-TCP rejection (UDP, AF_UNIX, SOCK_RAW, MPTCP), bounds
  validation, reserve grow/shrink/rounding and SK_MEMINFO_FWD_ALLOC
  reporting, cgroup v2 memory.max enforcement, accept() child zero-reserve
  inheritance, and reserve retention across TCP traffic.

Eric Dumazet (2):
  net: restrict SO_RESERVE_MEM to TCP sockets and cap max value
  selftests/net: add SO_RESERVE_MEM test

 net/core/sock.c                              |   4 +-
 tools/testing/selftests/net/.gitignore       |   1 +
 tools/testing/selftests/net/Makefile         |   1 +
 tools/testing/selftests/net/so_reserve_mem.c | 333 +++++++++++++++++++
 4 files changed, 337 insertions(+), 2 deletions(-)
 create mode 100644 tools/testing/selftests/net/so_reserve_mem.c

-- 
2.56.0.rc1.310.g51773c2048-goog