> __pskb_pull_tail() releases every zero-length page frag as it walks the
> frags array, even when it's asked to pull nothing. Some drivers depend
> on that. xen-netfront calls it with a zero count on purpose to make
> room when a backend fills the frags with empty slots, see commit
> d81c5054a5d1 ("xen/netfront: tolerate frags with no data"). netxen and
> qlcnic get the same effect when the frags they pull to fit a TX
> descriptor happen to be empty.
>
> pskb_may_pull() returns before getting there when the head already
> holds the requested length, so these drivers can't simply switch to
> it. Add skb_drop_empty_frags() to do just that part, unsharing the skb
> first if it's cloned like __pskb_pull_tail() does.
>
> Assisted-by: LLM
> Signed-off-by: Josef Bacik <[email protected]>
Sashiko has reviewed this patch and found no issues. It looks great!
--
Sashiko AI review ยท
https://sashiko.dev/#/patchset/20261008-b4-pskb-pull-tail-drivers-v2-0-8f2bd9bee...@toxicpanda.com?part=1
