mptcp: missing memory schedule on FIN

See also commit 'mptcp: fix tcp-mem accounting' for an explanation on
the design of the sk_mem_charge memory accounting.

Note that the mptcp stack seems to have a different approach to
sk_mem_charge for the receive and the send direction.

In receive, the TCP stack will charge the skb to the subflow, but when
the packet is transferred to the meta, it will be uncharged from the
subflow and charged to the meta (cfr. mptcp_queue_skb calling skb_orphan
and then relying on tcp_queue_rcv to do the sk_mem_charge (in either
tcp_try_coalesce or skb_set_owner_r)).

In send, the MPTCP scheduler does *not* charge the skb to the subflow,
instead it leaves the skb charged to the meta. skb that do not go though
the scheduler however are usually charged on the subflow (because the
mptcp patch in the end calls normal TCP functions that will charge on
the subflow). It is not very important if an skb is charged on the meta
or the subflow, but it is important that it is charged and that the
socket has sufficient budget in sk_forward_alloc.

When a FIN is sent we need to make sure sk_forward_alloc is available,
by doing a mem_schedule on the socket that the skb will be charged
to.

Fixes: Zero-day bug
Signed-off-by: Nathan Atta <[email protected]>
Signed-off-by: Tim Froidcoeur <[email protected]>
Acked-by: Christoph Paasch <[email protected]>
Signed-off-by: Matthieu Baerts <[email protected]>
(cherry picked from commit fbc2cde)
Signed-off-by: Matthieu Baerts <[email protected]>
(cherry picked from commit 60b2646)
Signed-off-by: Matthieu Baerts <[email protected]>
(cherry picked from commit 2d72c14)
Signed-off-by: Matthieu Baerts <[email protected]>

net/mptcp/mptcp_ctrl.c

@@ -1595,6 +1595,7 @@ static int mptcp_sub_send_fin(struct sock *sk)
 		/* FIN eats a sequence byte, write_seq advanced by tcp_queue_skb(). */
 		tcp_init_nondata_skb(skb, tp->write_seq,
 				     TCPHDR_ACK | TCPHDR_FIN);
+		sk_forced_mem_schedule(sk, skb->truesize);
 		tcp_queue_skb(sk, skb);
 	}
 	__tcp_push_pending_frames(sk, mss_now, TCP_NAGLE_OFF);

net/mptcp/mptcp_output.c

@@ -1286,6 +1286,7 @@ void mptcp_send_fin(struct sock *meta_sk)
 		tcp_init_nondata_skb(skb, meta_tp->write_seq, TCPHDR_ACK);
 		TCP_SKB_CB(skb)->end_seq++;
 		TCP_SKB_CB(skb)->mptcp_flags |= MPTCPHDR_FIN;
+		sk_forced_mem_schedule(meta_sk, skb->truesize);
 		tcp_queue_skb(meta_sk, skb);
 	}
 	__tcp_push_pending_frames(meta_sk, mss_now, TCP_NAGLE_OFF);