Re: [RFC] net: esp: fix bad handling of pages from page_pool

[Dragos Tatulea]

On Tue, 2024-03-05 at 19:04 -0800, Jakub Kicinski wrote:
> On Mon, 4 Mar 2024 11:48:52 +0200 Dragos Tatulea wrote:
> > When the skb is reorganized during esp_output (!esp->inline), the pages
> > coming from the original skb fragments are supposed to be released back
> > to the system through put_page. But if the skb fragment pages are
> > originating from a page_pool, calling put_page on them will trigger a
> > page_pool leak which will eventually result in a crash.
> 
> So it just does: skb_shinfo(skb)->nr_frags = 1;
> and assumes that's equivalent to owning a page ref on all the frags?
> 
My understanding is different: it sets nr_frags to 1 because it's swapping out
the old page frag in fragment 0 with the new xfrag page frag and will use this
"new" skb from here. It does take a page reference for the xfrag page frag.

> Fix looks more or less good, we would need a new wrapper to avoid
> build issues without PAGE_POOL, 
> 
Ack. Which component would be best location for this wrapper: page_pool?

> but I wonder if we wouldn't be better
> off changing the other side. Instead of "cutting off" the frags -
> walking them and dealing with various page types. Because Mina and co.
> will step onto this landmine as well.
The page frags are still stored and used in the sg scatterlist. If we release
them at the moment when the skb is "cut off", the pages in the sg will be
invalid. At least that's my understanding.

Thanks,
Dragos