Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

Merge branch 'minor-cleanups-to-skb-frag-ref-unref'

Mina Almasry says:

====================
Minor cleanups to skb frag ref/unref (part)

This series is largely motivated by a recent discussion where there was
some confusion on how to properly ref/unref pp pages vs non pp pages:

https://lore.kernel.org/netdev/CAHS8izOoO-EovwMwAm9tLYetwikNPxC0FKyVGu1TPJWSz4bGoA@mail.gmail.com/T/#t

There is some subtely there because pp uses page->pp_ref_count for
refcounting, while non-pp uses get_page()/put_page() for ref counting.
Getting the refcounting pairs wrong can lead to kernel crash.
[...]

https://lore.kernel.org/lkml/CAHS8izN436pn3SndrzsCyhmqvJHLyxgCeDpWXA4r1ANt3RCDLQ@mail.gmail.com/T/
====================

Link: https://lore.kernel.org/r/20240408153000.2152844-1-almasrymina@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

+5 -17
+2 -14
include/linux/skbuff.h
··· 3522 3522 bool napi_pp_put_page(struct page *page); 3523 3523 3524 3524 static inline void 3525 - skb_page_unref(const struct sk_buff *skb, struct page *page) 3525 + skb_page_unref(struct page *page, bool recycle) 3526 3526 { 3527 - #ifdef CONFIG_PAGE_POOL 3528 - if (skb->pp_recycle && napi_pp_put_page(page)) 3529 - return; 3530 - #endif 3531 - put_page(page); 3532 - } 3533 - 3534 - static inline void 3535 - napi_frag_unref(skb_frag_t *frag, bool recycle) 3536 - { 3537 - struct page *page = skb_frag_page(frag); 3538 - 3539 3527 #ifdef CONFIG_PAGE_POOL 3540 3528 if (recycle && napi_pp_put_page(page)) 3541 3529 return; ··· 3541 3553 */ 3542 3554 static inline void __skb_frag_unref(skb_frag_t *frag, bool recycle) 3543 3555 { 3544 - napi_frag_unref(frag, recycle); 3556 + skb_page_unref(skb_frag_page(frag), recycle); 3545 3557 } 3546 3558 3547 3559 /**
+1 -1
net/core/skbuff.c
··· 1101 1101 } 1102 1102 1103 1103 for (i = 0; i < shinfo->nr_frags; i++) 1104 - napi_frag_unref(&shinfo->frags[i], skb->pp_recycle); 1104 + __skb_frag_unref(&shinfo->frags[i], skb->pp_recycle); 1105 1105 1106 1106 free_head: 1107 1107 if (shinfo->frag_list)
+1 -1
net/ipv4/esp4.c
··· 114 114 */ 115 115 if (req->src != req->dst) 116 116 for (sg = sg_next(req->src); sg; sg = sg_next(sg)) 117 - skb_page_unref(skb, sg_page(sg)); 117 + skb_page_unref(sg_page(sg), skb->pp_recycle); 118 118 } 119 119 120 120 #ifdef CONFIG_INET_ESPINTCP
+1 -1
net/ipv6/esp6.c
··· 131 131 */ 132 132 if (req->src != req->dst) 133 133 for (sg = sg_next(req->src); sg; sg = sg_next(sg)) 134 - skb_page_unref(skb, sg_page(sg)); 134 + skb_page_unref(sg_page(sg), skb->pp_recycle); 135 135 } 136 136 137 137 #ifdef CONFIG_INET6_ESPINTCP