All of lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH net 0/2] net: ipa: fix page free in two spots
@ 2022-05-22  0:59 Alex Elder
  2022-05-22  0:59 ` [PATCH net 1/2] net: ipa: fix page free in ipa_endpoint_trans_release() Alex Elder
                   ` (3 more replies)
  0 siblings, 4 replies; 5+ messages in thread
From: Alex Elder @ 2022-05-22  0:59 UTC (permalink / raw)
  To: davem, edumazet, kuba, pabeni
  Cc: mka, evgreen, bjorn.andersson, quic_cpratapa, quic_avuyyuru,
	quic_jponduru, quic_subashab, elder, netdev, linux-arm-msm,
	linux-kernel

When a receive buffer is not wrapped in an SKB and passed to the
network stack, the (compound) page gets freed within the IPA driver.
This is currently quite rare.

The pages are freed using __free_pages(), but they should instead be
freed using page_put().  This series fixes this, in two spots.

These patches work for Linux v5.18-rc7 and v5.17.y, but won't apply
cleanly to earlier stable branches.  (Nevertheless, the fix is
trivial.)

					-Alex

Alex Elder (2):
  net: ipa: fix page free in ipa_endpoint_trans_release()
  net: ipa: fix page free in ipa_endpoint_replenish_one()

 drivers/net/ipa/ipa_endpoint.c | 9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)

-- 
2.32.0


^ permalink raw reply	[flat|nested] 5+ messages in thread

* [PATCH net 1/2] net: ipa: fix page free in ipa_endpoint_trans_release()
  2022-05-22  0:59 [PATCH net 0/2] net: ipa: fix page free in two spots Alex Elder
@ 2022-05-22  0:59 ` Alex Elder
  2022-05-22  0:59 ` [PATCH net 2/2] net: ipa: fix page free in ipa_endpoint_replenish_one() Alex Elder
                   ` (2 subsequent siblings)
  3 siblings, 0 replies; 5+ messages in thread
From: Alex Elder @ 2022-05-22  0:59 UTC (permalink / raw)
  To: davem, edumazet, kuba, pabeni
  Cc: mka, evgreen, bjorn.andersson, quic_cpratapa, quic_avuyyuru,
	quic_jponduru, quic_subashab, elder, netdev, linux-arm-msm,
	linux-kernel

Currently the (possibly compound) page used for receive buffers are
freed using __free_pages().  But according to this comment above the
definition of that function, that's wrong:
    If you want to use the page's reference count to decide when
    to free the allocation, you should allocate a compound page,
    and use put_page() instead of __free_pages().

Convert the call to __free_pages() in ipa_endpoint_trans_release()
to use put_page() instead.

Fixes: ed23f02680caa ("net: ipa: define per-endpoint receive buffer size")
Signed-off-by: Alex Elder <elder@linaro.org>
---
 drivers/net/ipa/ipa_endpoint.c | 7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)

diff --git a/drivers/net/ipa/ipa_endpoint.c b/drivers/net/ipa/ipa_endpoint.c
index 0f489723689c5..675b7135644b8 100644
--- a/drivers/net/ipa/ipa_endpoint.c
+++ b/drivers/net/ipa/ipa_endpoint.c
@@ -1385,11 +1385,8 @@ void ipa_endpoint_trans_release(struct ipa_endpoint *endpoint,
 	} else {
 		struct page *page = trans->data;
 
-		if (page) {
-			u32 buffer_size = endpoint->config.rx.buffer_size;
-
-			__free_pages(page, get_order(buffer_size));
-		}
+		if (page)
+			put_page(page);
 	}
 }
 
-- 
2.32.0


^ permalink raw reply	[flat|nested] 5+ messages in thread

* [PATCH net 2/2] net: ipa: fix page free in ipa_endpoint_replenish_one()
  2022-05-22  0:59 [PATCH net 0/2] net: ipa: fix page free in two spots Alex Elder
  2022-05-22  0:59 ` [PATCH net 1/2] net: ipa: fix page free in ipa_endpoint_trans_release() Alex Elder
@ 2022-05-22  0:59 ` Alex Elder
  2022-05-22 12:46 ` [PATCH net 0/2] net: ipa: fix page free in two spots Alex Elder
  2022-05-22 20:00 ` David Miller
  3 siblings, 0 replies; 5+ messages in thread
From: Alex Elder @ 2022-05-22  0:59 UTC (permalink / raw)
  To: davem, edumazet, kuba, pabeni
  Cc: mka, evgreen, bjorn.andersson, quic_cpratapa, quic_avuyyuru,
	quic_jponduru, quic_subashab, elder, netdev, linux-arm-msm,
	linux-kernel

Currently the (possibly compound) pages used for receive buffers are
freed using __free_pages().  But according to this comment above the
definition of that function, that's wrong:
    If you want to use the page's reference count to decide
    when to free the allocation, you should allocate a compound
    page, and use put_page() instead of __free_pages().

Convert the call to __free_pages() in ipa_endpoint_replenish_one()
to use put_page() instead.

Fixes: 6a606b90153b8 ("net: ipa: allocate transaction in replenish loop")
Signed-off-by: Alex Elder <elder@linaro.org>
---
 drivers/net/ipa/ipa_endpoint.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ipa/ipa_endpoint.c b/drivers/net/ipa/ipa_endpoint.c
index 675b7135644b8..dac4845cf596c 100644
--- a/drivers/net/ipa/ipa_endpoint.c
+++ b/drivers/net/ipa/ipa_endpoint.c
@@ -1062,7 +1062,7 @@ static int ipa_endpoint_replenish_one(struct ipa_endpoint *endpoint,
 
 	ret = gsi_trans_page_add(trans, page, len, offset);
 	if (ret)
-		__free_pages(page, get_order(buffer_size));
+		put_page(page);
 	else
 		trans->data = page;	/* transaction owns page now */
 
-- 
2.32.0


^ permalink raw reply	[flat|nested] 5+ messages in thread

* Re: [PATCH net 0/2] net: ipa: fix page free in two spots
  2022-05-22  0:59 [PATCH net 0/2] net: ipa: fix page free in two spots Alex Elder
  2022-05-22  0:59 ` [PATCH net 1/2] net: ipa: fix page free in ipa_endpoint_trans_release() Alex Elder
  2022-05-22  0:59 ` [PATCH net 2/2] net: ipa: fix page free in ipa_endpoint_replenish_one() Alex Elder
@ 2022-05-22 12:46 ` Alex Elder
  2022-05-22 20:00 ` David Miller
  3 siblings, 0 replies; 5+ messages in thread
From: Alex Elder @ 2022-05-22 12:46 UTC (permalink / raw)
  To: davem, edumazet, kuba, pabeni
  Cc: mka, evgreen, bjorn.andersson, quic_cpratapa, quic_avuyyuru,
	quic_jponduru, quic_subashab, elder, netdev, linux-arm-msm,
	linux-kernel

On 5/21/22 7:59 PM, Alex Elder wrote:
> When a receive buffer is not wrapped in an SKB and passed to the
> network stack, the (compound) page gets freed within the IPA driver.
> This is currently quite rare.
> 
> The pages are freed using __free_pages(), but they should instead be
> freed using page_put().  This series fixes this, in two spots.
> 
> These patches work for Linux v5.18-rc7 and v5.17.y, but won't apply
> cleanly to earlier stable branches.  (Nevertheless, the fix is
> trivial.)
> 
> 					-Alex

I accidentally based this on net-next/master rather than net/master.
Sorry about that.  I'll send version 2 in a few days.

					-Alex

> Alex Elder (2):
>    net: ipa: fix page free in ipa_endpoint_trans_release()
>    net: ipa: fix page free in ipa_endpoint_replenish_one()
> 
>   drivers/net/ipa/ipa_endpoint.c | 9 +++------
>   1 file changed, 3 insertions(+), 6 deletions(-)
> 


^ permalink raw reply	[flat|nested] 5+ messages in thread

* Re: [PATCH net 0/2] net: ipa: fix page free in two spots
  2022-05-22  0:59 [PATCH net 0/2] net: ipa: fix page free in two spots Alex Elder
                   ` (2 preceding siblings ...)
  2022-05-22 12:46 ` [PATCH net 0/2] net: ipa: fix page free in two spots Alex Elder
@ 2022-05-22 20:00 ` David Miller
  3 siblings, 0 replies; 5+ messages in thread
From: David Miller @ 2022-05-22 20:00 UTC (permalink / raw)
  To: elder
  Cc: edumazet, kuba, pabeni, mka, evgreen, bjorn.andersson,
	quic_cpratapa, quic_avuyyuru, quic_jponduru, quic_subashab,
	elder, netdev, linux-arm-msm, linux-kernel

From: Alex Elder <elder@linaro.org>
Date: Sat, 21 May 2022 19:59:57 -0500

> When a receive buffer is not wrapped in an SKB and passed to the
> network stack, the (compound) page gets freed within the IPA driver.
> This is currently quite rare.
> 
> The pages are freed using __free_pages(), but they should instead be
> freed using page_put().  This series fixes this, in two spots.
> 
> These patches work for Linux v5.18-rc7 and v5.17.y, but won't apply
> cleanly to earlier stable branches.  (Nevertheless, the fix is
> trivial.)

This does not apply to the current net tree, please respin.

Thank you.

^ permalink raw reply	[flat|nested] 5+ messages in thread

end of thread, other threads:[~2022-05-22 20:01 UTC | newest]

Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-05-22  0:59 [PATCH net 0/2] net: ipa: fix page free in two spots Alex Elder
2022-05-22  0:59 ` [PATCH net 1/2] net: ipa: fix page free in ipa_endpoint_trans_release() Alex Elder
2022-05-22  0:59 ` [PATCH net 2/2] net: ipa: fix page free in ipa_endpoint_replenish_one() Alex Elder
2022-05-22 12:46 ` [PATCH net 0/2] net: ipa: fix page free in two spots Alex Elder
2022-05-22 20:00 ` David Miller

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.