queue_userspace_packet() calls skb_tx_error() on the packet skb in its error path, but it only borrows that skb: on the OVS_ACTION_ATTR_USERSPACE action path do_execute_actions() ignores output_userspace()'s return value and keeps forwarding the same skb through the flow's remaining actions. skb_tx_error() completes the zerocopy uarg and clears SKBFL_ALL_ZEROCOPY, and with it SKBFL_SHARED_FRAG.
For a MSG_ZEROCOPY skb carrying page-cache frags, SKBFL_SHARED_FRAG is what makes esp_input() skb_cow_data() instead of taking the in-place AEAD path. Once it is stripped, a later local ESP delivery decrypts in place over pages the sender still shares with the page cache. Patch 1 moves the skb_tx_error() into the one path that does drop the packet, the "default" arm of ovs_dp_process_packet()'s switch(error). Patch 2 removes a second such strip, in skb_zerocopy(), which calls skb_tx_error() on its source when skb_orphan_frags() fails. A copy helper should not perform a destructive action on its source, and both callers already report the error on their own drop path. MSG_ZEROCOPY skbs cannot reach that one -- SKBFL_DONT_ORPHAN makes skb_orphan_frags() return early -- but producers that do not set that flag, such as af_packet's TX_RING path, can. Norbert Szetei (2): openvswitch: only skb_tx_error() a packet we are about to drop net: skbuff: don't skb_tx_error() the source skb in skb_zerocopy() net/core/skbuff.c | 5 ++--- net/openvswitch/datapath.c | 3 +-- 2 files changed, 3 insertions(+), 5 deletions(-) -- 2.55.0 _______________________________________________ dev mailing list [email protected] https://mail.openvswitch.org/mailman/listinfo/ovs-dev
