[PATCH v1 net] net: Fix memory_allocated leak in __sk_mem_raise_allocated().

[Kuniyuki Iwashima <kuniyu@google.com>]

__sk_mem_raise_allocated() calls sk_memory_allocated_add() and
reuses the return value to check if it was called.

However, sk_memory_allocated_{add,sub}() cache a value in per-cpu
counter, sk->sk_prot->per_cpu_fw_alloc, up to sysctl_mem_pcpu_rsv
before reflecting it to sk->sk_prot->memory_allocated.

Thus, sk->sk_prot->memory_allocated could have a negative value,
and proto_memory_allocated() returns 0 in such a case.

Then, if mem_cgroup_sk_charge() succeeds, sk_prot_mem_limits()
checks are bypassed, and if mem_cgroup_sk_charge() fails,
sk_memory_allocated_sub() is not called, leaking counters.

Let's use sk->sk_bypass_prot_mem instead of allocated.

Fixes: 7c268eaeec63 ("net: Allow opt-out from global protocol memory accounting.")
Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
---
Found this while converting sk_memcg to obj_cgroup.
---
 net/core/sock.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/core/sock.c b/net/core/sock.c
index e2401d735c5a..ad414878dc5b 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -3427,7 +3427,7 @@ int __sk_mem_raise_allocated(struct sock *sk, int size, int amt, int kind)
 			goto suppress_allocation;
 	}
 
-	if (!allocated)
+	if (sk->sk_bypass_prot_mem)
 		return 1;
 
 	/* Under limit. */
@@ -3508,7 +3508,7 @@ int __sk_mem_raise_allocated(struct sock *sk, int size, int amt, int kind)
 
 	trace_sock_exceed_buf_limit(sk, prot, allocated, kind);
 
-	if (allocated)
+	if (!sk->sk_bypass_prot_mem)
 		sk_memory_allocated_sub(sk, amt);
 
 	if (charged)
-- 
2.56.0.455.g6c5a503b38-goog