• Michal Kubeček's avatar
    net: handle NAPI_GRO_FREE_STOLEN_HEAD case also in napi_frags_finish() · 38ae32c9
    Michal Kubeček authored
    commit e44699d2 upstream.
    
    Recently I started seeing warnings about pages with refcount -1. The
    problem was traced to packets being reused after their head was merged into
    a GRO packet by skb_gro_receive(). While bisecting the issue pointed to
    commit c21b48cc ("net: adjust skb->truesize in ___pskb_trim()") and
    I have never seen it on a kernel with it reverted, I believe the real
    problem appeared earlier when the option to merge head frag in GRO was
    implemented.
    
    Handling NAPI_GRO_FREE_STOLEN_HEAD state was only added to GRO_MERGED_FREE
    branch of napi_skb_finish() so that if the driver uses napi_gro_frags()
    and head is merged (which in my case happens after the skb_condense()
    call added by the commit mentioned above), the skb is reused including the
    head that has been merged. As a result, we release the page reference
    twice and eventually end up with negative page refcount.
    
    To fix the problem, handle NAPI_GRO_FREE_STOLEN_HEAD in napi_frags_finish()
    the same way it's done in napi_skb_finish().
    
    Fixes: d7e8883c ("net: make GRO aware of skb->head_frag")
    Signed-off-by: default avatarMichal Kubecek <mkubecek@suse.cz>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
    38ae32c9
dev.c 196 KB