From: Wesley Atwell <[email protected]> nsim_do_psp() can leave an extra extension reference pinned until nsim_psp_handle_ext() reattaches it to a forwarded skb.
Route the drop paths through a common helper and release that extra reference when __dev_forward_skb() fails and when start_xmit() drops the skb before it reaches the peer RX path. This is separate from the peer RX truesize test hook itself. Signed-off-by: Wesley Atwell <[email protected]> --- drivers/net/netdevsim/netdev.c | 19 ++++++++++++++----- 1 file changed, 14 insertions(+), 5 deletions(-) diff --git a/drivers/net/netdevsim/netdev.c b/drivers/net/netdevsim/netdev.c index 22238df79b6a..c22513c523d6 100644 --- a/drivers/net/netdevsim/netdev.c +++ b/drivers/net/netdevsim/netdev.c @@ -187,6 +187,15 @@ static int nsim_napi_rx(struct net_device *tx_dev, struct net_device *rx_dev, return NET_RX_SUCCESS; } +/* nsim_do_psp() pins an extra extension ref until nsim_psp_handle_ext() + * reattaches it to a forwarded skb. + */ +static void nsim_psp_ext_put(struct skb_ext *psp_ext) +{ + if (psp_ext) + __skb_ext_put(psp_ext); +} + static int nsim_forward_skb(struct net_device *tx_dev, struct net_device *rx_dev, struct sk_buff *skb, @@ -196,8 +205,10 @@ static int nsim_forward_skb(struct net_device *tx_dev, int ret; ret = __dev_forward_skb(rx_dev, skb); - if (ret) + if (ret) { + nsim_psp_ext_put(psp_ext); return ret; + } nsim_psp_handle_ext(skb, psp_ext); @@ -278,11 +289,8 @@ static netdev_tx_t nsim_start_xmit(struct sk_buff *skb, struct net_device *dev) * the synthetic cost; sender-side skb accounting stays put. */ nskb = skb_clone(skb, GFP_ATOMIC); - if (!nskb) { - if (psp_ext) - __skb_ext_put(psp_ext); + if (!nskb) goto out_drop_free; - } consume_skb(skb); skb = nskb; @@ -303,6 +311,7 @@ static netdev_tx_t nsim_start_xmit(struct sk_buff *skb, struct net_device *dev) out_drop_any: dr = SKB_DROP_REASON_NOT_SPECIFIED; out_drop_free: + nsim_psp_ext_put(psp_ext); kfree_skb_reason(skb, dr); out_drop_cnt: rcu_read_unlock(); -- 2.43.0
