| Message ID | 20240812152126.14598-1-eladwf@gmail.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | [net,v2] net: ethernet: mtk_eth_soc: fix memory leak in LRO rings release | expand |
On Mon, Aug 12, 2024 at 06:21:19PM +0300, Elad Yifee wrote: > For LRO we allocate more than one page, yet 'skb_free_frag' is used > to free the buffer, which only frees a single page. > Fix it by using 'free_pages' instead. > > Fixes: 2f2c0d2919a1 ("net: ethernet: mtk_eth_soc: fix misuse of mem alloc interface netdev[napi]_alloc_frag") > Signed-off-by: Elad Yifee <eladwf@gmail.com> > --- > v2: fixed compilation warnings > --- > drivers/net/ethernet/mediatek/mtk_eth_soc.c | 10 ++++++---- > 1 file changed, 6 insertions(+), 4 deletions(-) > > diff --git a/drivers/net/ethernet/mediatek/mtk_eth_soc.c b/drivers/net/ethernet/mediatek/mtk_eth_soc.c > index 16ca427cf4c3..e25b552d70f7 100644 > --- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c > +++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c > @@ -1762,8 +1762,10 @@ static void mtk_rx_put_buff(struct mtk_rx_ring *ring, void *data, bool napi) > if (ring->page_pool) > page_pool_put_full_page(ring->page_pool, > virt_to_head_page(data), napi); > - else > + else if (ring->frag_size <= PAGE_SIZE) > skb_free_frag(data); > + else > + free_pages(unsigned long)data, get_order(mtk_max_frag_size(ring->frag_size))); You miss on open '(' there. Won't even compile like that. Please always compile- and run-time test patches before sending them to the mailing list. > } > > static int mtk_xdp_frame_map(struct mtk_eth *eth, struct net_device *dev, > @@ -2132,7 +2134,7 @@ static int mtk_poll_rx(struct napi_struct *napi, int budget, > ring->buf_size, DMA_FROM_DEVICE); > if (unlikely(dma_mapping_error(eth->dma_dev, > dma_addr))) { > - skb_free_frag(new_data); > + mtk_rx_put_buff(ring, new_data, true); > netdev->stats.rx_dropped++; > goto release_desc; > } > @@ -2146,7 +2148,7 @@ static int mtk_poll_rx(struct napi_struct *napi, int budget, > skb = build_skb(data, ring->frag_size); > if (unlikely(!skb)) { > netdev->stats.rx_dropped++; > - skb_free_frag(data); > + mtk_rx_put_buff(ring, data, true); > goto skip_rx; > } > > @@ -2691,7 +2693,7 @@ static int mtk_rx_alloc(struct mtk_eth *eth, int ring_no, int rx_flag) > ring->buf_size, DMA_FROM_DEVICE); > if (unlikely(dma_mapping_error(eth->dma_dev, > dma_addr))) { > - skb_free_frag(data); > + mtk_rx_put_buff(ring, data, false); > return -ENOMEM; > } > } > -- > 2.45.2 >
On 12.08.24 17:21, Elad Yifee wrote: > For LRO we allocate more than one page, yet 'skb_free_frag' is used > to free the buffer, which only frees a single page. > Fix it by using 'free_pages' instead. > > Fixes: 2f2c0d2919a1 ("net: ethernet: mtk_eth_soc: fix misuse of mem alloc interface netdev[napi]_alloc_frag") > Signed-off-by: Elad Yifee <eladwf@gmail.com> Are you sure about this change? From what I can see, the LRO buffer is (or at least should be) allocated as a compound page. Because of that, skb_free_frag should work on it. If it doesn't, wouldn't we run into the same issue when the network stack frees received packets? - Felix
On Mon, Aug 12, 2024 at 6:34 PM Felix Fietkau <nbd@nbd.name> wrote: > > On 12.08.24 17:21, Elad Yifee wrote: > > For LRO we allocate more than one page, yet 'skb_free_frag' is used > > to free the buffer, which only frees a single page. > > Fix it by using 'free_pages' instead. > > > > Fixes: 2f2c0d2919a1 ("net: ethernet: mtk_eth_soc: fix misuse of mem alloc interface netdev[napi]_alloc_frag") > > Signed-off-by: Elad Yifee <eladwf@gmail.com> > > Are you sure about this change? From what I can see, the LRO buffer is > (or at least should be) allocated as a compound page. Because of that, > skb_free_frag should work on it. If it doesn't, wouldn't we run into the > same issue when the network stack frees received packets? > > - Felix > Hey Felix, I encountered this problem while testing the HWLRO operation on NETSYS3, but it was part of a series of changes, so you’re right, with GFP_COMP it shouldn’t be a problem. I automatically assumed it was a necessary fix. Sorry for the mess, I'll continue testing HWLRO and resubmit this patch if I still find it necessary.
Hi Elad, kernel test robot noticed the following build errors: [auto build test ERROR on net/main] url: https://github.com/intel-lab-lkp/linux/commits/Elad-Yifee/net-ethernet-mtk_eth_soc-fix-memory-leak-in-LRO-rings-release/20240813-015755 base: net/main patch link: https://lore.kernel.org/r/20240812152126.14598-1-eladwf%40gmail.com patch subject: [PATCH net v2] net: ethernet: mtk_eth_soc: fix memory leak in LRO rings release config: arm-randconfig-003-20240813 (https://download.01.org/0day-ci/archive/20240814/202408140256.AkgMaR7u-lkp@intel.com/config) compiler: arm-linux-gnueabi-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240814/202408140256.AkgMaR7u-lkp@intel.com/reproduce) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp@intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202408140256.AkgMaR7u-lkp@intel.com/ All error/warnings (new ones prefixed by >>): drivers/net/ethernet/mediatek/mtk_eth_soc.c: In function 'mtk_rx_put_buff': >> drivers/net/ethernet/mediatek/mtk_eth_soc.c:1768:28: error: expected expression before 'unsigned' 1768 | free_pages(unsigned long)data, get_order(mtk_max_frag_size(ring->frag_size))); | ^~~~~~~~ >> drivers/net/ethernet/mediatek/mtk_eth_soc.c:1768:17: error: too few arguments to function 'free_pages' 1768 | free_pages(unsigned long)data, get_order(mtk_max_frag_size(ring->frag_size))); | ^~~~~~~~~~ In file included from include/linux/xarray.h:16, from include/linux/radix-tree.h:21, from include/linux/idr.h:15, from include/linux/kernfs.h:12, from include/linux/sysfs.h:16, from include/linux/kobject.h:20, from include/linux/of.h:18, from drivers/net/ethernet/mediatek/mtk_eth_soc.c:9: include/linux/gfp.h:372:13: note: declared here 372 | extern void free_pages(unsigned long addr, unsigned int order); | ^~~~~~~~~~ >> drivers/net/ethernet/mediatek/mtk_eth_soc.c:1768:42: error: expected ';' before 'data' 1768 | free_pages(unsigned long)data, get_order(mtk_max_frag_size(ring->frag_size))); | ^~~~ | ; >> drivers/net/ethernet/mediatek/mtk_eth_soc.c:1767:9: warning: this 'else' clause does not guard... [-Wmisleading-indentation] 1767 | else | ^~~~ drivers/net/ethernet/mediatek/mtk_eth_soc.c:1768:93: note: ...this statement, but the latter is misleadingly indented as if it were guarded by the 'else' 1768 | free_pages(unsigned long)data, get_order(mtk_max_frag_size(ring->frag_size))); | ^ >> drivers/net/ethernet/mediatek/mtk_eth_soc.c:1768:93: error: expected statement before ')' token vim +/unsigned +1768 drivers/net/ethernet/mediatek/mtk_eth_soc.c 1759 1760 static void mtk_rx_put_buff(struct mtk_rx_ring *ring, void *data, bool napi) 1761 { 1762 if (ring->page_pool) 1763 page_pool_put_full_page(ring->page_pool, 1764 virt_to_head_page(data), napi); 1765 else if (ring->frag_size <= PAGE_SIZE) 1766 skb_free_frag(data); > 1767 else > 1768 free_pages(unsigned long)data, get_order(mtk_max_frag_size(ring->frag_size))); 1769 } 1770
Hi Elad, kernel test robot noticed the following build errors: [auto build test ERROR on net/main] url: https://github.com/intel-lab-lkp/linux/commits/Elad-Yifee/net-ethernet-mtk_eth_soc-fix-memory-leak-in-LRO-rings-release/20240813-015755 base: net/main patch link: https://lore.kernel.org/r/20240812152126.14598-1-eladwf%40gmail.com patch subject: [PATCH net v2] net: ethernet: mtk_eth_soc: fix memory leak in LRO rings release config: x86_64-allyesconfig (https://download.01.org/0day-ci/archive/20240814/202408140408.smKpJgMF-lkp@intel.com/config) compiler: clang version 18.1.5 (https://github.com/llvm/llvm-project 617a15a9eac96088ae5e9134248d8236e34b91b1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240814/202408140408.smKpJgMF-lkp@intel.com/reproduce) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp@intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202408140408.smKpJgMF-lkp@intel.com/ All errors (new ones prefixed by >>): >> drivers/net/ethernet/mediatek/mtk_eth_soc.c:1768:14: error: expected expression 1768 | free_pages(unsigned long)data, get_order(mtk_max_frag_size(ring->frag_size))); | ^ 1 error generated. vim +1768 drivers/net/ethernet/mediatek/mtk_eth_soc.c 1759 1760 static void mtk_rx_put_buff(struct mtk_rx_ring *ring, void *data, bool napi) 1761 { 1762 if (ring->page_pool) 1763 page_pool_put_full_page(ring->page_pool, 1764 virt_to_head_page(data), napi); 1765 else if (ring->frag_size <= PAGE_SIZE) 1766 skb_free_frag(data); 1767 else > 1768 free_pages(unsigned long)data, get_order(mtk_max_frag_size(ring->frag_size))); 1769 } 1770
diff --git a/drivers/net/ethernet/mediatek/mtk_eth_soc.c b/drivers/net/ethernet/mediatek/mtk_eth_soc.c index 16ca427cf4c3..e25b552d70f7 100644 --- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c +++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c @@ -1762,8 +1762,10 @@ static void mtk_rx_put_buff(struct mtk_rx_ring *ring, void *data, bool napi) if (ring->page_pool) page_pool_put_full_page(ring->page_pool, virt_to_head_page(data), napi); - else + else if (ring->frag_size <= PAGE_SIZE) skb_free_frag(data); + else + free_pages(unsigned long)data, get_order(mtk_max_frag_size(ring->frag_size))); } static int mtk_xdp_frame_map(struct mtk_eth *eth, struct net_device *dev, @@ -2132,7 +2134,7 @@ static int mtk_poll_rx(struct napi_struct *napi, int budget, ring->buf_size, DMA_FROM_DEVICE); if (unlikely(dma_mapping_error(eth->dma_dev, dma_addr))) { - skb_free_frag(new_data); + mtk_rx_put_buff(ring, new_data, true); netdev->stats.rx_dropped++; goto release_desc; } @@ -2146,7 +2148,7 @@ static int mtk_poll_rx(struct napi_struct *napi, int budget, skb = build_skb(data, ring->frag_size); if (unlikely(!skb)) { netdev->stats.rx_dropped++; - skb_free_frag(data); + mtk_rx_put_buff(ring, data, true); goto skip_rx; } @@ -2691,7 +2693,7 @@ static int mtk_rx_alloc(struct mtk_eth *eth, int ring_no, int rx_flag) ring->buf_size, DMA_FROM_DEVICE); if (unlikely(dma_mapping_error(eth->dma_dev, dma_addr))) { - skb_free_frag(data); + mtk_rx_put_buff(ring, data, false); return -ENOMEM; } }
For LRO we allocate more than one page, yet 'skb_free_frag' is used to free the buffer, which only frees a single page. Fix it by using 'free_pages' instead. Fixes: 2f2c0d2919a1 ("net: ethernet: mtk_eth_soc: fix misuse of mem alloc interface netdev[napi]_alloc_frag") Signed-off-by: Elad Yifee <eladwf@gmail.com> --- v2: fixed compilation warnings --- drivers/net/ethernet/mediatek/mtk_eth_soc.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)