Files
linux/include/linux
Dragos Tatulea 8291b4eac4 net: esp: fix bad handling of pages from page_pool
[ Upstream commit c3198822c6cb9fb588e446540485669cc81c5d34 ]

When the skb is reorganized during esp_output (!esp->inline), the pages
coming from the original skb fragments are supposed to be released back
to the system through put_page. But if the skb fragment pages are
originating from a page_pool, calling put_page on them will trigger a
page_pool leak which will eventually result in a crash.

This leak can be easily observed when using CONFIG_DEBUG_VM and doing
ipsec + gre (non offloaded) forwarding:

  BUG: Bad page state in process ksoftirqd/16  pfn:1451b6
  page:00000000de2b8d32 refcount:0 mapcount:0 mapping:0000000000000000 index:0x1451b6000 pfn:0x1451b6
  flags: 0x200000000000000(node=0|zone=2)
  page_type: 0xffffffff()
  raw: 0200000000000000 dead000000000040 ffff88810d23c000 0000000000000000
  raw: 00000001451b6000 0000000000000001 00000000ffffffff 0000000000000000
  page dumped because: page_pool leak
  Modules linked in: ip_gre gre mlx5_ib mlx5_core xt_conntrack xt_MASQUERADE nf_conntrack_netlink nfnetlink iptable_nat nf_nat xt_addrtype br_netfilter rpcrdma rdma_ucm ib_iser libiscsi scsi_transport_iscsi ib_umad rdma_cm ib_ipoib iw_cm ib_cm ib_uverbs ib_core overlay zram zsmalloc fuse [last unloaded: mlx5_core]
  CPU: 16 PID: 96 Comm: ksoftirqd/16 Not tainted 6.8.0-rc4+ #22
  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014
  Call Trace:
   <TASK>
   dump_stack_lvl+0x36/0x50
   bad_page+0x70/0xf0
   free_unref_page_prepare+0x27a/0x460
   free_unref_page+0x38/0x120
   esp_ssg_unref.isra.0+0x15f/0x200
   esp_output_tail+0x66d/0x780
   esp_xmit+0x2c5/0x360
   validate_xmit_xfrm+0x313/0x370
   ? validate_xmit_skb+0x1d/0x330
   validate_xmit_skb_list+0x4c/0x70
   sch_direct_xmit+0x23e/0x350
   __dev_queue_xmit+0x337/0xba0
   ? nf_hook_slow+0x3f/0xd0
   ip_finish_output2+0x25e/0x580
   iptunnel_xmit+0x19b/0x240
   ip_tunnel_xmit+0x5fb/0xb60
   ipgre_xmit+0x14d/0x280 [ip_gre]
   dev_hard_start_xmit+0xc3/0x1c0
   __dev_queue_xmit+0x208/0xba0
   ? nf_hook_slow+0x3f/0xd0
   ip_finish_output2+0x1ca/0x580
   ip_sublist_rcv_finish+0x32/0x40
   ip_sublist_rcv+0x1b2/0x1f0
   ? ip_rcv_finish_core.constprop.0+0x460/0x460
   ip_list_rcv+0x103/0x130
   __netif_receive_skb_list_core+0x181/0x1e0
   netif_receive_skb_list_internal+0x1b3/0x2c0
   napi_gro_receive+0xc8/0x200
   gro_cell_poll+0x52/0x90
   __napi_poll+0x25/0x1a0
   net_rx_action+0x28e/0x300
   __do_softirq+0xc3/0x276
   ? sort_range+0x20/0x20
   run_ksoftirqd+0x1e/0x30
   smpboot_thread_fn+0xa6/0x130
   kthread+0xcd/0x100
   ? kthread_complete_and_exit+0x20/0x20
   ret_from_fork+0x31/0x50
   ? kthread_complete_and_exit+0x20/0x20
   ret_from_fork_asm+0x11/0x20
   </TASK>

The suggested fix is to introduce a new wrapper (skb_page_unref) that
covers page refcounting for page_pool pages as well.

Cc: stable@vger.kernel.org
Fixes: 6a5bcd84e8 ("page_pool: Allow drivers to hint on SKB recycling")
Reported-and-tested-by: Anatoli N.Chechelnickiy <Anatoli.Chechelnickiy@m.interpipe.biz>
Reported-by: Ian Kumlien <ian.kumlien@gmail.com>
Link: https://lore.kernel.org/netdev/CAA85sZvvHtrpTQRqdaOx6gd55zPAVsqMYk_Lwh4Md5knTq7AyA@mail.gmail.com
Signed-off-by: Dragos Tatulea <dtatulea@nvidia.com>
Reviewed-by: Mina Almasry <almasrymina@google.com>
Reviewed-by: Jakub Kicinski <kuba@kernel.org>
Acked-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2024-04-03 15:28:35 +02:00
..
2022-11-04 12:59:25 +02:00
2023-06-16 12:27:04 -06:00
2024-01-25 15:35:39 -08:00
2023-05-20 19:20:30 +02:00
2023-08-23 08:21:37 +01:00
2023-11-28 17:19:55 +00:00
2023-09-11 15:24:16 -07:00
2023-01-19 14:46:25 +01:00
2024-03-26 18:19:40 -04:00
2023-05-31 13:06:57 +02:00
2023-01-13 11:48:15 +01:00
2023-05-25 09:26:19 +02:00
2024-04-03 15:28:18 +02:00
2023-04-17 18:01:23 +02:00
2023-01-19 16:07:40 +01:00
2023-03-06 15:49:07 -06:00
2024-03-26 18:20:13 -04:00
2023-01-29 15:18:33 -07:00
2023-01-29 15:18:33 -07:00
2023-02-06 19:06:58 +01:00
2023-09-01 00:29:34 +02:00
2023-03-19 10:02:04 -07:00
2023-06-13 16:49:23 +02:00
2023-09-13 10:48:48 +02:00
2023-05-01 17:50:18 -07:00
2023-08-04 11:02:46 +01:00
2023-07-14 13:47:07 -06:00
2023-08-18 10:12:10 -07:00
2023-08-15 14:57:25 -07:00
2023-08-18 10:18:59 -07:00
2023-07-11 14:12:19 -07:00
2023-01-19 09:24:30 +01:00
2023-06-20 20:17:10 -07:00
2024-04-03 15:28:29 +02:00
2023-11-20 11:58:53 +01:00
2023-08-18 10:12:25 -07:00
2023-08-21 14:28:45 -07:00
2023-06-23 16:59:30 -07:00
2024-02-05 20:14:27 +00:00
2023-06-05 09:36:39 +02:00
2023-07-18 10:07:47 +02:00
2023-11-28 17:19:54 +00:00
2023-09-29 17:20:46 -07:00
2023-03-06 09:57:07 +01:00
2022-12-20 03:13:45 +01:00
2023-08-12 09:18:47 -07:00
2023-11-28 17:19:48 +00:00
2023-10-06 11:01:23 +02:00
2023-10-06 11:01:23 +02:00
2023-05-23 12:55:12 -07:00
2023-07-15 11:34:49 -07:00
2023-06-23 16:59:28 -07:00
2023-01-19 15:01:19 +01:00
2023-05-18 19:52:31 -07:00
2023-06-11 18:22:47 +02:00
2024-01-31 16:19:01 -08:00
2023-07-18 10:07:47 +02:00
2023-06-05 09:36:39 +02:00
2023-11-28 17:19:38 +00:00
2024-01-31 16:18:47 -08:00
2023-08-21 13:37:26 -07:00
2023-08-06 08:24:55 +01:00
2023-08-07 17:55:54 +00:00
2023-08-11 21:12:47 +02:00
2023-03-16 13:08:39 -07:00
2023-11-20 11:58:56 +01:00
2023-03-23 17:25:46 +01:00
2023-08-24 13:27:47 -05:00
2023-04-05 20:03:01 -07:00
2023-04-21 03:02:34 -04:00
2023-08-21 14:52:16 +02:00
2022-10-24 12:12:32 -07:00
2023-08-21 13:37:27 -07:00