Commit cd35ef91 authored by Dean Nelson's avatar Dean Nelson Committed by David S. Miller

thunderx: eliminate extra calls to put_page() for pages held for recycling

For the non-XDP case, commit 77322538 ("net: thunderx: Optimize
page recycling for XDP") added code to nicvf_free_rbdr() that, when releasing
the additional receive buffer page reference held for recycling, repeatedly
calls put_page() until the page's _refcount goes to zero. Which results in
the page being freed.

This is not okay if the page's _refcount was greater than 1 (in the non-XDP
case), because nicvf_free_rbdr() should not be subtracting more than what
nicvf_alloc_page() had previously added to the page's _refcount, which was
only 1 (in the non-XDP case).

This can arise if a received packet is still being processed and the receive
buffer (i.e., skb->head) has not yet been freed via skb_free_head() when
nicvf_free_rbdr() is spinning through the aforementioned put_page() loop.

If this should occur, when the received packet finishes processing and
skb_free_head() is called, various problems can ensue. Exactly what, depends on
whether the page has already been reallocated or not, anything from "BUG: Bad
page state ... ", to "Unable to handle kernel NULL pointer dereference ..." or
"Unable to handle kernel paging request...".

So this patch changes nicvf_free_rbdr() to only call put_page() once for pages
held for recycling (in the non-XDP case).

Fixes: 77322538 ("net: thunderx: Optimize page recycling for XDP")
Signed-off-by: default avatarDean Nelson <dnelson@redhat.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent b3e20806
...@@ -364,11 +364,10 @@ static void nicvf_free_rbdr(struct nicvf *nic, struct rbdr *rbdr) ...@@ -364,11 +364,10 @@ static void nicvf_free_rbdr(struct nicvf *nic, struct rbdr *rbdr)
while (head < rbdr->pgcnt) { while (head < rbdr->pgcnt) {
pgcache = &rbdr->pgcache[head]; pgcache = &rbdr->pgcache[head];
if (pgcache->page && page_ref_count(pgcache->page) != 0) { if (pgcache->page && page_ref_count(pgcache->page) != 0) {
if (!rbdr->is_xdp) { if (rbdr->is_xdp) {
put_page(pgcache->page); page_ref_sub(pgcache->page,
continue; pgcache->ref_count - 1);
} }
page_ref_sub(pgcache->page, pgcache->ref_count - 1);
put_page(pgcache->page); put_page(pgcache->page);
} }
head++; head++;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment