Re: [RFC PATCH v2 17/25] net: Allocate small skb heads from PISA

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [Medium] net: raw_send_hdrinc() uses sk_dst_cache instead of packet
  dst for PISA
--

commit 37f3bd5cfa3158313d9a63615631730f2ababf39
Author: Luigi Rizzo <lrizzo@google.com>

net: Allocate small skb heads from PISA

This commit adds a skbuff_small_head_pisa slab cache backed by read-only
PISA folios and allocates small TX skb heads from it when per-device
pisa_tx_skb_heads is enabled.

> diff --git a/net/core/sock.c b/net/core/sock.c
> index 695fefe316925..0ddb5e57f4969 100644
> --- a/net/core/sock.c
> +++ b/net/core/sock.c
> @@ -3061,9 +3061,10 @@ static long sock_wait_for_wmem(struct sock *sk, long timeo)
>   *	Generic send/receive buffer handlers
>   */
>  
> -struct sk_buff *sock_alloc_send_pskb(struct sock *sk, unsigned long header_len,
> -				     unsigned long data_len, int noblock,
> -				     int *errcode, int max_page_order)
> +struct sk_buff *__sock_alloc_send_pskb(struct sock *sk, unsigned long header_len,
> +				       unsigned long data_len, int noblock,
> +				       int *errcode, int max_page_order,
> +				       gfp_t gfp)
>  {
>  	struct sk_buff *skb;
>  	long timeo;
> @@ -3092,7 +3093,8 @@ struct sk_buff *sock_alloc_send_pskb(struct sock *sk, unsigned long header_len,
>  		timeo = sock_wait_for_wmem(sk, timeo);
>  	}
>  	skb = alloc_skb_with_frags(header_len, data_len, max_page_order,
> -				   errcode, sk->sk_allocation);
> +				   errcode,
> +				   sk->sk_allocation | (!data_len ? gfp : 0));
>  	if (skb)
>  		skb_set_owner_w(skb, sk);
>  	return skb;
> @@ -3103,6 +3105,16 @@ struct sk_buff *sock_alloc_send_pskb(struct sock *sk, unsigned long header_len,
>  	*errcode = err;
>  	return NULL;
>  }
> +EXPORT_SYMBOL(__sock_alloc_send_pskb);
> +
> +struct sk_buff *sock_alloc_send_pskb(struct sock *sk, unsigned long header_len,
> +				     unsigned long data_len, int noblock,
> +				     int *errcode, int max_page_order)
> +{
> +	return __sock_alloc_send_pskb(sk, header_len, data_len, noblock,
> +				      errcode, max_page_order,
> +				      pisa_tx_gfp_sk(sk));
> +}
>  EXPORT_SYMBOL(sock_alloc_send_pskb);

[Severity: Medium]
Should raw_send_hdrinc() and rawv6_send_hdrinc() also call
sock_alloc_send_skb_dst() with &rt->dst like __ip_append_data() and
__ip6_append_data() do?

Both functions still call sock_alloc_send_skb(), which checks
sk->sk_dst_cache via pisa_tx_gfp_sk() instead of the per-packet route and
then copies the entire packet into skb->head.  If a connected raw socket
with IP_HDRINCL or IPV6_HDRINCL has a PISA-eligible route cached in
sk->sk_dst_cache, sending a packet whose per-packet route uses IPsec XFRM
(for example via msg_name) places the plaintext payload into a PISA page
before encryption, violating the !dst_xfrm(dst) requirement in
__dst_tx_pisa_ok().  Conversely, unconnected HDRINCL raw sockets have a
NULL sk->sk_dst_cache and never use PISA heads even when the packet route
qualifies.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261109182533.3594984-1-lrizzo@google.com?part=17