Re: [PATCH net-next v4] tcp: Correct signedness in skb remaining space calculation

[Jakub Kicinski]

On Mon,  7 Jul 2025 13:41:11 +0800 Jiayuan Chen wrote:
> Reported-by: syzbot+de6565462ab540f50e47@xxxxxxxxxxxxxxxxxxxxxxxxx
> Fixes: 270a1c3de47e ("tcp: Support MSG_SPLICE_PAGES")
> Signed-off-by: Jiayuan Chen <jiayuan.chen@xxxxxxxxx>

> diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
> index 8a3c99246d2e..803a419f4ea0 100644
> --- a/net/ipv4/tcp.c
> +++ b/net/ipv4/tcp.c
> @@ -1176,7 +1176,7 @@ int tcp_sendmsg_locked(struct sock *sk, struct msghdr *msg, size_t size)
>  		goto do_error;
>  
>  	while (msg_data_left(msg)) {
> -		ssize_t copy = 0;
> +		int copy = 0;

nice! FWIW I think we started hitting something like this in prod, 
not sure what the actual repro is but recently some workloads here
moved to 6.9 kernels and I see spikes in warnings in copy from iter
that the size is > INT_MAX:

WARNING: CPU: 26 PID: 3504902 at include/linux/thread_info.h:249 tcp_sendmsg+0xefd/0x1450
RIP: 0010:tcp_sendmsg (./include/linux/thread_info.h:249 ./include/linux/uio.h:203 ./include/linux/uio.h:221 ./include/net/sock.h:2176 ./include/net/sock.h:2202 net/ipv4/tcp.c:1219 net/ipv4/tcp.c:1355)

I'll take this fix via net.