From: Jakub Kicinski <kuba@kernel.org>
To: Mina Almasry <almasrymina@google.com>
Cc: Dragos Tatulea <dtatulea@nvidia.com>,
"davem@davemloft.net" <davem@davemloft.net>,
"ilias.apalodimas@linaro.org" <ilias.apalodimas@linaro.org>,
"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
"jacob.e.keller@intel.com" <jacob.e.keller@intel.com>,
"pabeni@redhat.com" <pabeni@redhat.com>,
Jianbo Liu <jianbol@nvidia.com>,
"netdev@vger.kernel.org" <netdev@vger.kernel.org>,
"edumazet@google.com" <edumazet@google.com>
Subject: Re: [RFC PATCH] net: Fix one page_pool page leak from skb_frag_unref
Date: Wed, 1 May 2024 07:28:35 -0700 [thread overview]
Message-ID: <20240501072835.631dcda0@kernel.org> (raw)
In-Reply-To: <20240501072434.5720fd42@kernel.org>
On Wed, 1 May 2024 07:24:34 -0700 Jakub Kicinski wrote:
> I vote #2, actually :( Or #3 make page pool ref safe to acquire
> concurrently, but that plus fixing all the places where we do crazy
> things may be tricky.
>
> Even taking the ref is not as simple as using atomic_long_inc_not_zero()
> sadly, partly because we try to keep the refcount at one, in an apparent
> attempt to avoid dirtying the cache line twice.
>
> So maybe partial revert to stop be bleeding and retry after more testing
> is the way to go?
>
> I had a quick look at the code and there is also a bunch of functions
> which "shift" frags from one skb to another, without checking whether
> the pp_recycle state matches.
BTW these two refs seem to look at the wrong skb:
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 0c8b82750000..afd3336928d0 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -2148,7 +2148,7 @@ struct sk_buff *__pskb_copy_fclone(struct sk_buff *skb, int headroom,
}
for (i = 0; i < skb_shinfo(skb)->nr_frags; i++) {
skb_shinfo(n)->frags[i] = skb_shinfo(skb)->frags[i];
- skb_frag_ref(skb, i);
+ skb_frag_ref(n, i);
}
skb_shinfo(n)->nr_frags = i;
}
@@ -5934,7 +5934,7 @@ bool skb_try_coalesce(struct sk_buff *to, struct sk_buff *from,
* since we set nr_frags to 0.
*/
for (i = 0; i < from_shinfo->nr_frags; i++)
- __skb_frag_ref(&from_shinfo->frags[i], from->pp_recycle);
+ __skb_frag_ref(&from_shinfo->frags[i], to->pp_recycle);
to->truesize += delta;
to->len += len;
next prev parent reply other threads:[~2024-05-01 14:28 UTC|newest]
Thread overview: 23+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-04-24 16:56 [RFC PATCH] net: Fix one page_pool page leak from skb_frag_unref Dragos Tatulea
2024-04-24 17:25 ` Dragos Tatulea
2024-04-24 22:08 ` Mina Almasry
2024-04-25 8:17 ` Dragos Tatulea
2024-04-25 19:20 ` Mina Almasry
2024-04-25 19:47 ` Dragos Tatulea
2024-04-25 20:42 ` Mina Almasry
2024-04-26 14:59 ` Dragos Tatulea
2024-04-26 19:03 ` Mina Almasry
2024-04-26 23:08 ` Jakub Kicinski
2024-04-27 4:24 ` Mina Almasry
2024-04-29 15:00 ` Jakub Kicinski
2024-05-02 20:08 ` Mina Almasry
2024-05-03 0:46 ` Jakub Kicinski
2024-04-26 23:05 ` Jakub Kicinski
2024-04-29 7:39 ` Dragos Tatulea
2024-05-01 6:20 ` Dragos Tatulea
2024-05-01 7:48 ` Mina Almasry
2024-05-01 7:58 ` Dragos Tatulea
2024-05-01 14:24 ` Jakub Kicinski
2024-05-01 14:28 ` Jakub Kicinski [this message]
2024-05-01 16:23 ` Mina Almasry
2024-04-26 23:07 ` Jakub Kicinski
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20240501072835.631dcda0@kernel.org \
--to=kuba@kernel.org \
--cc=almasrymina@google.com \
--cc=davem@davemloft.net \
--cc=dtatulea@nvidia.com \
--cc=edumazet@google.com \
--cc=ilias.apalodimas@linaro.org \
--cc=jacob.e.keller@intel.com \
--cc=jianbol@nvidia.com \
--cc=linux-kernel@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).