Re: [RFC PATCH v2 20/25] net/libeth: Use GFP_KERNEL when pre-filling RX rings

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [High] net/libeth: GFP_KERNEL allocation in NAPI softirq in
  libeth_rx_alloc()
--

commit 8b7f90733116470d28d79365ee87cd75951698b1
Author: Luigi Rizzo <lrizzo@google.com>

net/libeth: Use GFP_KERNEL when pre-filling RX rings

This commit switches libeth_rx_alloc() to use GFP_KERNEL when allocating
RX buffers for uninitialized ring slots (where buf->truesize is 0 and
i != fq->count - 1) and GFP_ATOMIC afterwards.

> diff --git a/include/net/libeth/rx.h b/include/net/libeth/rx.h
> index 0e736846c5e8a..de1e5fe44aa40 100644
> --- a/include/net/libeth/rx.h
> +++ b/include/net/libeth/rx.h
> @@ -106,10 +106,17 @@ void libeth_rx_fq_destroy(struct libeth_fq *fq);
>  static inline dma_addr_t libeth_rx_alloc(const struct libeth_fq_fp *fq, u32 i)
>  {
>  	struct libeth_fqe *buf = &fq->fqes[i];
> +	/* fq->fqes is zero-allocated and pre-filled in process context for
> +	 * indices [0 .. fq->count - 2]; slot fq->count - 1 is first allocated
> +	 * in NAPI. Use GFP_KERNEL for initial pre-fill and GFP_ATOMIC after.
> +	 */
> +	gfp_t gfp = (buf->truesize || i == fq->count - 1) ?
> +		    GFP_ATOMIC : GFP_KERNEL;
>  
>  	buf->truesize = fq->truesize;
> -	buf->netmem = page_pool_dev_alloc_netmem(fq->pp, &buf->offset,
> -						 &buf->truesize);
> +	buf->netmem = page_pool_alloc_netmem(fq->pp, &buf->offset,
> +					     &buf->truesize,
> +					     gfp | __GFP_NOWARN);
>  	if (unlikely(!buf->netmem))
>  		return DMA_MAPPING_ERROR;

[Severity: High]
Can this allocate with GFP_KERNEL from NAPI softirq context if the initial
process-context ring pre-fill fails partway through?

During interface bring-up or reset, iavf_configure() calls
iavf_alloc_rx_buffers() to pre-fill indices [0 .. count - 2] and ignores
its return value before iavf_up_complete() enables NAPI:

drivers/net/ethernet/intel/iavf/iavf_txrx.c:iavf_alloc_rx_buffers() {
	...
	do {
		addr = libeth_rx_alloc(&fq, ntu);
		if (addr == DMA_MAPPING_ERROR)
			goto no_buffers;
	...
}

If libeth_rx_alloc() fails at index k < fq->count - 2, the loop aborts and
leaves fq->fqes[k + 1 .. fq->count - 2].truesize set to 0.  When
iavf_clean_rx_irq() later calls iavf_alloc_rx_buffers() from NAPI softirq,
reaching those remaining unvisited indices will select GFP_KERNEL and sleep
in atomic context.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261109182533.3594984-1-lrizzo@google.com?part=20