From: Kuniyuki Iwashima <kuniyu@google.com>
To: Eric Dumazet <edumazet@kernel.org>,
Neal Cardwell <ncardwell@google.com>,
"David S . Miller" <davem@davemloft.net>,
Jakub Kicinski <kuba@kernel.org>, Paolo Abeni <pabeni@redhat.com>
Cc: Simon Horman <horms@kernel.org>,
Kuniyuki Iwashima <kuniyu@google.com>,
Kuniyuki Iwashima <kuni1840@gmail.com>,
netdev@vger.kernel.org
Subject: [PATCH v1 net-next 5/8] tcp: Skip collapsing if collapsed skb is less-dense.
Date: Sat, 14 Nov 2026 04:00:48 +0000 [thread overview]
Message-ID: <20261114040101.1043546-6-kuniyu@google.com> (raw)
In-Reply-To: <20261114040101.1043546-1-kuniyu@google.com>
Once tcp_collapse() finds a collapsible skb, it collapses
consecutive bloated skbs.
However, the end result could be the same or larger than
as is in some cases:
1. skb is already minimum
If SKB_HEAD_ALIGN(len) <= SKB_SMALL_HEAD_CACHE_SIZE,
skb is allocated from skbuff_small_head, and skb->truesize
never changes.
2. SKB_HEAD_ALIGN() and kmalloc_size_roundup() in alloc_skb()
Assume two bloated skbs with len = 1448 B (truesize =
2304 B, scaling_ratio = 160) and len = 300 B (truesize =
896 B, scaling_ratio = 85), whose total truesize is
3200 B.
Collapsing them calls alloc_skb(1748), which rounds up
SKB_HEAD_ALIGN(1748) = 2112 B to 4096 B and allocates a
new skb with truesize = 4352 B (+1152 B!).
Even worse, in case 1, such a skb is reallocated repeatedly
by every tcp_collapse() in vain.
Let's calculate the final collapsed truesize before collapsing
skbs and skip the range if it does not shrink.
We could allocate skbs first and calculate the new truesize,
but given tcp_collapse() is called under memory pressure,
we want to avoid unnecessary allocation.
Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
---
include/linux/skbuff.h | 7 +++++++
net/ipv4/tcp_input.c | 24 +++++++++++++++++++++++-
2 files changed, 30 insertions(+), 1 deletion(-)
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index d36fbb88b3f6..618e629df15a 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -292,6 +292,13 @@
SKB_DATA_ALIGN(sizeof(struct sk_buff)) + \
SKB_DATA_ALIGN(sizeof(struct skb_shared_info)))
+/* return estimated truesize allocated by alloc_skb(X) via kmalloc_reserve() */
+#define SKB_ALLOCSIZE(X) \
+ ((SKB_HEAD_ALIGN(X) <= SKB_SMALL_HEAD_CACHE_SIZE ? \
+ SKB_SMALL_HEAD_CACHE_SIZE : \
+ kmalloc_size_roundup(SKB_HEAD_ALIGN(X))) + \
+ SKB_DATA_ALIGN(sizeof(struct sk_buff)))
+
struct net_device;
struct scatterlist;
struct pipe_inode_info;
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 5bd42a74c6f5..fe71305f6e67 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -5850,8 +5850,10 @@ static void
tcp_collapse(struct sock *sk, struct sk_buff_head *list, struct rb_root *root,
struct sk_buff *head, struct sk_buff *tail, u32 start)
{
+ int old_truesize, new_truesize;
struct sk_buff *skb = head, *n;
struct sk_buff_head tmp;
+ int remainder, nskbs;
u8 scaling_ratio;
u32 sub_end;
@@ -5891,6 +5893,7 @@ tcp_collapse(struct sock *sk, struct sk_buff_head *list, struct rb_root *root,
/* Second, find consecutive collapsible skb. */
sub_end = TCP_SKB_CB(skb)->end_seq;
+ old_truesize = skb->truesize;
for (n = tcp_skb_next(skb, list); n && n != tail; n = tcp_skb_next(n, list)) {
if (!skb_frags_readable(n) ||
@@ -5898,8 +5901,10 @@ tcp_collapse(struct sock *sk, struct sk_buff_head *list, struct rb_root *root,
!tcp_skb_can_collapse_rx(skb, n))
break;
- if (!after(TCP_SKB_CB(n)->end_seq, sub_end))
+ if (!after(TCP_SKB_CB(n)->end_seq, sub_end)) {
+ old_truesize += n->truesize;
continue;
+ }
/* seq and end_seq must increase monotonically for rbtree. */
if ((list || !before(TCP_SKB_CB(n)->seq, sub_end)) &&
@@ -5908,6 +5913,23 @@ tcp_collapse(struct sock *sk, struct sk_buff_head *list, struct rb_root *root,
break;
sub_end = TCP_SKB_CB(n)->end_seq;
+ old_truesize += n->truesize;
+ }
+
+ /* Third, check if the new skbs have high density. */
+ nskbs = (sub_end - start) / TCP_COLLAPSE_MAX_SIZE;
+ new_truesize = nskbs * SKB_TRUESIZE(TCP_COLLAPSE_MAX_SIZE);
+
+ remainder = (sub_end - start) % TCP_COLLAPSE_MAX_SIZE;
+ if (remainder) {
+ nskbs++;
+ new_truesize += SKB_ALLOCSIZE(remainder);
+ }
+
+ if (old_truesize <= new_truesize) {
+ start = sub_end;
+ skb = n;
+ goto restart;
}
while (before(start, sub_end)) {
--
2.56.0.611.g1030f0b940-goog
next prev parent reply other threads:[~2026-11-14 4:01 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-11-14 4:00 [PATCH v1 net-next 0/8] tcp: Prevent tcp_collapse() from bloating queue Kuniyuki Iwashima
2026-11-14 4:00 ` [PATCH v1 net-next 1/8] tcp: Clean up the first loop in tcp_collapse() Kuniyuki Iwashima
2026-11-14 4:00 ` [PATCH v1 net-next 2/8] tcp: Don't collapse high density skb Kuniyuki Iwashima
2026-11-14 4:00 ` [PATCH v1 net-next 3/8] tcp: Stop collapsing if not bloated Kuniyuki Iwashima
2026-11-14 4:00 ` [PATCH v1 net-next 4/8] net: Move SKB_SMALL_HEAD_CACHE_SIZE to skbuff.h Kuniyuki Iwashima
2026-11-14 4:00 ` Kuniyuki Iwashima [this message]
2026-11-14 4:00 ` [PATCH v1 net-next 6/8] tcp: Allocate all new skb before collapsing Kuniyuki Iwashima
2026-11-14 4:00 ` [PATCH v1 net-next 7/8] tcp: Batch memory accounting in tcp_collapse() Kuniyuki Iwashima
2026-11-14 4:00 ` [PATCH v1 net-next 8/8] selftest: packetdrill: Add test for tcp_collapse() Kuniyuki Iwashima
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20261114040101.1043546-6-kuniyu@google.com \
--to=kuniyu@google.com \
--cc=davem@davemloft.net \
--cc=edumazet@kernel.org \
--cc=horms@kernel.org \
--cc=kuba@kernel.org \
--cc=kuni1840@gmail.com \
--cc=ncardwell@google.com \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox