[PATCH net v2 0/2] net: do not run out of frags in alloc_skb_with_frags()

[Haishuang Yan]

alloc_skb_with_frags() can fail with -ENOBUFS for a data_len that passed
its own size check: it splits the tail into one frag per bit set in its
page count, and when a high-order allocation fails it lowers the order
without checking that the frags left can still hold the rest. With
vhost-net + tun, a guest that sends a GSO packet above 64K can then make
the vhost worker retry that packet forever (100% CPU, device dead).
Patch 1 fixes both cases; patch 2 adds a KUnit test for the tail case.

The issues were found with the help of an AI coding assistant.

Changes in v2:
- Patch 1: also fix the fallback after a failed high-order allocation:
  only lower the order while the frags left can hold the rest, else
  retry the same order once with direct reclaim (reported by the netdev
  AI review of v1). Changelog and test notes updated, including fault
  injection results.
- Patch 1: reword the comment as suggested by Narcisa, and compute the
  page count with DIV_ROUND_UP() to keep the line within 80 columns.
- Patch 1: say in the changelog that this only fixes the frag accounting;
  larger frames failing in tun_alloc_skb() are a separate problem.
- Patch 2: skip the test instead of failing it when no order-3 page can
  be had, and name the fix by its subject. Dropped Narcisa's Reviewed-by
  since the test changed.

v1: https://lore.kernel.org/netdev/20261108100617.23840-1-yanhaishuang@xxxxxxxxxxxxxxxxxxxx/

Haishuang Yan (2):
  net: do not run out of frags in alloc_skb_with_frags()
  net: add a KUnit test for the alloc_skb_with_frags() tail split

 net/core/net_test.c | 35 +++++++++++++++++++++++++++++++++++
 net/core/skbuff.c   | 30 ++++++++++++++++++++++++++++--
 2 files changed, 63 insertions(+), 2 deletions(-)


base-commit: a45dbf182137275f44ad7c8bc8acd23f7af6b2cf
-- 
2.43.0