)]}'
{
  "commit": "031c403d13e5046750e2abebd4e770631e7c4627",
  "tree": "63dd41265b4d4a743cf60c58b686121e4c2cf7d2",
  "parents": [
    "23fec4bd76904e9df7a8cc0a81ceb14c36971da4"
  ],
  "author": {
    "name": "Eric Dumazet",
    "email": "edumazet@kernel.org",
    "time": "Wed Oct 28 19:08:20 2026 +0000"
  },
  "committer": {
    "name": "Dave Miller",
    "email": "davem@davem-thinkpadp1gen8.ibmlond.csb",
    "time": "Mon Nov 02 10:21:23 2026 +0000"
  },
  "message": "tcp: do not let tcp_collapse() drive sk_forward_alloc negative\n\ntcp_collapse() charges each newly allocated skb with skb_set_owner_r()\nbefore the skbs it replaces are freed, without scheduling memory first.\n\nSince sk_mem_uncharge() reclaims eagerly, sk-\u003esk_forward_alloc has no\ncushion and can become negative. This can be durable when the collapsed\nskbs had a high payload/truesize ratio or were partially read, because\nthe new skbs can have a bigger total truesize than the old ones.\n\nA negative sk_forward_alloc then confuses tcp_wmem_schedule(), which\ncan return a negative length to tcp_sendmsg_locked(), triggering\na WARN_ON_ONCE(bytes \u003e INT_MAX) in check_copy_size().\n\nCall sk_forced_mem_schedule() before charging nskb.\n\nFixes: 4890b686f408 (\"net: keep sk-\u003esk_forward_alloc as small as possible\")\nSigned-off-by: Eric Dumazet \u003cedumazet@kernel.org\u003e\nReviewed-by: Kuniyuki Iwashima \u003ckuniyu@google.com\u003e\nSigned-off-by: Octavian Purdila \u003ctavip@google.com\u003e\nSigned-off-by: Dave Miller \u003cdavem@davem-thinkpadp1gen8.ibmlond.csb\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "e1f2d9765f8101c379ce0fc7cdb4aa19b34df3df",
      "old_mode": 33188,
      "old_path": "net/ipv4/tcp_input.c",
      "new_id": "ebd2c12e42d5e6c57b66408de0d8a2dceacc5a5e",
      "new_mode": 33188,
      "new_path": "net/ipv4/tcp_input.c"
    }
  ]
}