From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=74.125.82.199 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1794117622; b=HuhKzm6MKNez1L9S4VbwK9Rb3l/lXvDTcvj0mOeVcijGJ/t/1FYGiminSZjLTn0zch4/ 6y746BnZAGeS6W70q5LwemCCbZ1qylia4CRR6OA5Kunn0mwF8knO7Mm5oQwMLwO1/6xUT kgmgWh2peqIPynmXjXvsextwMrWx8BHUfB8+XWKu0yeTTLxZCfetOj0JPGVllWXPAhYK9 DqBDeVj6JnFaFFDnc26xhBCRmkg6g5auRpWFRf33q2mv3BnKFl1D2KWNVPbEbKwbVl26x 2XyOeMGUQBDFJPmAHxLcovNsfR0cp43PfcIcTecU6qUW+OixbA2RLm8VqFCfg7oGYEw== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1794117622; h=DMARC-Filter:Received:DKIM-Signature:X-Google-DKIM-Signature: X-Forwarded-Encrypted:X-Gm-Message-State:X-Received:Date:In-Reply-To: Mime-Version:References:X-Mailer:Message-ID:Subject:From:To:Cc: Content-Type; bh=zMjClMAhSRqoCMrDS5bvxCNb79WE0UiAP81MU3z8MjY=; b=4SEoM/c1DES6UX2mRG4DbD75oRZ+ddvRGOMoNR4VW0T5flg/L9iWp5YJECkvRinjjLlP W3UCNEQdYB0wVe9YDsrcst9+G6GpqNtTlgZWItV+TL/rkv60NftZKA3CtBfqvd13FZ4S0 fKWtTvP6XX6bDN0Xlw1+E3mbW0gBWpmKl3vdJe1boyVBNpR36hZtMx1/HXCfYxGPGdEBF eybvsuYIqEzlEDYf0QVXu5G1xGIxRuTH3s3XANiGu9AdVYNQzm1WCS8qdetqwKPUMvUsn NecBjDazVXb/GBfl4tlkzgNV3lDy1Gr/IXmMoQfqYY99LokLkCwhjnAnoqFcm6Lf8RA== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass header.from=google.com; spf=pass smtp.mailfrom=flex--almasrymina.bounces.google.com; dkim=pass header.d=google.com header.i=@google.com header.a=rsa-sha256 header.s=20260707 header.b=jO2e07BW; arc=none smtp.remote-ip=74.125.82.199 Received: from mail-dy1-f199.google.com (mail-dy1-f199.google.com [74.125.82.199]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature ECDSA (prime256v1) server-digest SHA256) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9D3D3606A31F for ; Sun, 8 Nov 2026 06:00:21 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.2 smtp.subspace.kernel.org 9D3D3606A31F Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--almasrymina.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.a=rsa-sha256 header.s=20260707 header.b=jO2e07BW Received: by mail-dy1-f199.google.com with SMTP id 5a478bee46e88-36cec75d8caso336465eec.0 for ; Sat, 07 Nov 2026 22:00:21 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20260707; t=1794117621; x=1794722421; darn=vger.kernel.org; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:from:to:cc:subject:date:message-id:reply-to :content-type; bh=zMjClMAhSRqoCMrDS5bvxCNb79WE0UiAP81MU3z8MjY=; b=jO2e07BWGA8O52P77jRoNhsitYQurzQCx4xeziyuSp7NovBfzB4K1lsmO4mPKa8lAQ DmS2rTuC7bKwV4ZwUUn3ygRY7PZXoiO9kOADqFkDqBYPF0GEnyJvCe+wJ6KjBzfT2bNb iGo2a0fUxdX20q89wu8H/TnVrCM8d7MS8reZSX90WE9SMFzvVdWnnBoIZhyO914BAiKu DSRqTFvCv7UvZzqSTYQycAhtYPk/gBooYOB0RWkrj8wFyn1aceJ14pK1rFe7cgnMjB1y u+5DoU7W74nCcDseKrOJleCb+WfkuXdA0aEq/msTgpm9Ky/xK11C+pYABwZjNTAt96qS GcIA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1794117621; x=1794722421; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=zMjClMAhSRqoCMrDS5bvxCNb79WE0UiAP81MU3z8MjY=; b=FxeXi8TvIxzmOAnmB1+zpZ2yBMY0qMBp0gF7nZ6DLTEI/15/AmiaoregLke89dUh3T ujsDezeVVBfx5bkO7VUMSvTlcgGbIYjPhD1X0XwNz28ZBw7YvOHpvZN+5ct45ch12X+b AnDw4F88AG7LM0Lbxdoske5ZuNBHY84V/gvAcxCuudSvf++qQKtBWvbSDUb6MsTG+zyx qlCc8CzUH5gW3TFV5bf/tnTjDNFhAooAyzgww8m/KZ3CeCnWb02TKYjuw8L0HqpLGI+L 57okZ5syAqz9M7k32ZtYG3qkgzCHlSVkePUgW3d/ohU9DfaMAas2W6oQS+oKfoDl//4R 397w== X-Forwarded-Encrypted: i=1; AL+hErHqFT8VDNSbPl0qA49oxUM1DhQ69VhnVDuR944VMsNZd80ndc7swUjmw8ZOi+srdQyTDLycdXLs4JdIgP5eoA==@vger.kernel.org X-Gm-Message-State: APuU4Z9uFBAiU2izO+SAT85kYKuWPdOsMNPmzq5iqfZm0Tb4Lr5m0yDm DpCVWPbcDdyYCq+LQDSr1VJp87IDlRTEBUjK0l4Vr7NJa+6xd83Xjk0Nr9UefiQVv2hTsxOH/9s mVWBuQHEW4qjofScJwJhivAUMdw== X-Received: from dycc22.prod.google.com ([2002:a05:693c:60d6:b0:36c:9a9b:3677]) (user=almasrymina job=prod-delivery.src-stubby-dispatcher) by 2002:a05:693c:20c8:10b0:36a:2473:9b2f with SMTP id 5a478bee46e88-370f7f80e04mr5298946eec.23.1794117619069; Sat, 07 Nov 2026 22:00:19 -0800 (PST) Date: Sun, 8 Nov 2026 06:00:12 +0000 In-Reply-To: <20261108060016.2131509-1-almasrymina@google.com> X-Mailing-List: linux-wireless@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list Mime-Version: 1.0 References: <20261108060016.2131509-1-almasrymina@google.com> X-Mailer: git-send-email 2.56.0.455.g6c5a503b38-goog Message-ID: <20261108060016.2131509-2-almasrymina@google.com> Subject: [PATCH net-next v2 1/5] net: skbuff: skip managed zerocopy frags in skb_frag_ref() From: Mina Almasry To: netdev@vger.kernel.org Cc: Mina Almasry , Jesper Dangaard Brouer , Ilias Apalodimas , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , Neal Cardwell , Kuniyuki Iwashima , Pavel Begunkov , Bobby Eshleman , Stanislav Fomichev , linux-kernel@vger.kernel.org, Steffen Klassert , Herbert Xu , Willem de Bruijn , John Fastabend , Sabrina Dubroca , Andrew Lunn , "Michael S. Tsirkin" , Jason Wang , "=?UTF-8?q?Eugenio=20P=C3=A9rez?=" , Xuan Zhuo , Andrew Morton , David Hildenbrand , Lorenzo Stoakes , "Liam R. Howlett" , Vlastimil Babka , Mike Rapoport , Suren Baghdasaryan , Michal Hocko , Alexei Starovoitov , Daniel Borkmann , Johannes Berg , Byungchul Park , Zi Yan , virtualization@lists.linux.dev, linux-mm@kvack.org, bpf@vger.kernel.org, linux-wireless@vger.kernel.org, Jonathan Corbet , Shuah Khan , Randy Dunlap , Lorenzo Bianconi , Wen Gu , Philo Lu , Justin Chen , Florian Fainelli , Vikas Gupta , Michael Chan , Pavan Chebbi , Doug Berger , Nicolai Buchwitz , Broadcom internal kernel review list , Satish Kharat , Wei Fang , Frank Li , Shenwei Wang , Joshua Washington , Harshitha Ramamurthy , Jijie Shao , Jian Shen , Fan Gong , Tony Nguyen , Przemek Kitszel , Marcin Wojtas , Russell King , Sunil Goutham , Geetha sowjanya , Ratheesh Kannoth , Subbaraya Sundeep , Bharat Bhushan , Felix Fietkau , Matthias Brugger , AngeloGioacchino Del Regno , Tariq Toukan , Saeed Mahameed , Mark Bloch , Leon Romanovsky , Ido Schimmel , Petr Machata , Horatiu Vultur , UNGLinuxDriver@microchip.com, Daniel Machon , Steen Hegelund , Haiyang Zhang , Wei Liu , Dexuan Cui , Yibo Dong , Brett Creeley , Justin Lai , Larry Chiu , "=?UTF-8?q?Niklas=20S=C3=B6derlund?=" , Paul Barker , Masahisa Kojima , Maxime Chevallier , Maxime Coquelin , Alexandre Torgue , FUJITA Tomonori , Siddharth Vadapalli , Roger Quadros , MD Danish Anwar , Jiawen Wu , Mengyuan Lou , Ronak Doshi , Ryder Lee , Shayne Chen , Sean Wang , Juergen Gross , Stefano Stabellini , Oleksandr Tyshchenko , Jordan Rhee , Ankit Garg , Tim Hostetler , Eric Joyner , Prabu Thayalan , "Nikhil P. Rao" , Chintan Vankar , Nora Schiffer , Alexander Sverdlin , Kevin Hao , Karl Mehltretter , Aleksandr Loktionov , Meghana Malladi , Jacob Keller , StanleyYP Wang , linux-doc@vger.kernel.org, imx@lists.linux.dev, linux-rdma@vger.kernel.org, linux-hyperv@vger.kernel.org, linux-renesas-soc@vger.kernel.org, linux-omap@vger.kernel.org Content-Type: text/plain; charset="UTF-8" skb_frag_unref() and skb_release_data() skip releasing references on managed zerocopy fragments (SKBFL_MANAGED_FRAG_REFS), whereas skb_frag_ref() acquires a reference unconditionally. If skb_frag_ref() is called on a managed zerocopy SKB, the acquired reference is never released by skb_frag_unref() or skb_release_data(). Skip acquiring a reference in skb_frag_ref() when skb_zcopy_managed(skb) is true so skb_frag_ref() matches skb_frag_unref() and skb_release_data(), and disable share_ok in iptfs_output_queued() when skb_zcopy_managed(skb) is true so iptfs_consume_frags() does not append unreferenced fragments into a managed zerocopy outer SKB. Signed-off-by: Mina Almasry --- include/linux/skbuff_ref.h | 10 +++++++--- net/core/net_test.c | 10 ++++++++++ net/xfrm/xfrm_iptfs.c | 3 ++- 3 files changed, 19 insertions(+), 4 deletions(-) diff --git a/include/linux/skbuff_ref.h b/include/linux/skbuff_ref.h index b6f6da556ee90..e94c599ce83d2 100644 --- a/include/linux/skbuff_ref.h +++ b/include/linux/skbuff_ref.h @@ -36,12 +36,16 @@ static __always_inline void skb_netmem_ref(netmem_ref netmem, bool recycle) * * Acquires a reference on the @f'th fragment of @skb via skb_netmem_ref() * (pp_ref_count if skb->pp_recycle and page_pool-backed, else non-pp - * backing refcount). Counterpart to skb_frag_unref(). + * backing refcount), skipping managed zerocopy fragments. Counterpart to + * skb_frag_unref(). */ static __always_inline void skb_frag_ref(struct sk_buff *skb, int f) { - skb_netmem_ref(skb_frag_netmem(&skb_shinfo(skb)->frags[f]), - skb->pp_recycle); + struct skb_shared_info *shinfo = skb_shinfo(skb); + + if (!skb_zcopy_managed(skb)) + skb_netmem_ref(skb_frag_netmem(&shinfo->frags[f]), + skb->pp_recycle); } bool napi_pp_put_page(netmem_ref netmem); diff --git a/net/core/net_test.c b/net/core/net_test.c index 2b5080c226636..e20059a00003c 100644 --- a/net/core/net_test.c +++ b/net/core/net_test.c @@ -571,6 +571,16 @@ static void netmem_ref_test_page(struct kunit *test) skb_frag_unref(skb, 0); KUNIT_EXPECT_EQ(test, page_ref_count(page), base_ref); + /* SKBFL_MANAGED_FRAG_REFS skips both skb_frag_ref and skb_frag_unref */ + skb_shinfo(skb)->flags |= SKBFL_ZEROCOPY_ENABLE | + SKBFL_MANAGED_FRAG_REFS; + skb_frag_ref(skb, 0); + KUNIT_EXPECT_EQ(test, page_ref_count(page), base_ref); + skb_frag_unref(skb, 0); + KUNIT_EXPECT_EQ(test, page_ref_count(page), base_ref); + skb_shinfo(skb)->flags &= ~(SKBFL_ZEROCOPY_ENABLE | + SKBFL_MANAGED_FRAG_REFS); + skb_shinfo(skb)->nr_frags = 0; consume_skb(skb); __free_page(page); diff --git a/net/xfrm/xfrm_iptfs.c b/net/xfrm/xfrm_iptfs.c index 103cf7c5dbfb9..04ef833074fc8 100644 --- a/net/xfrm/xfrm_iptfs.c +++ b/net/xfrm/xfrm_iptfs.c @@ -2258,7 +2258,8 @@ static void iptfs_output_queued(struct xfrm_state *x, struct sk_buff_head *list) nextp = &(*nextp)->next; } - if (shi->frag_list || skb_cloned(skb) || skb_shared(skb)) + if (shi->frag_list || skb_cloned(skb) || skb_shared(skb) || + skb_zcopy_managed(skb)) share_ok = false; /* See if we have enough space to simply append. -- 2.56.0.455.g6c5a503b38-goog