We are seeing pp_ref_count underflow warnings on virtio_net hosts with
heavy netconsole traffic, followed by general protection faults in
napi_consume_skb() on frag addresses made of packet data, when
skb_defer_free_flush() frees the corrupted skbs:
WARNING: ./include/net/page_pool/helpers.h:297 at
page_pool_alloc_frag_netmem+0x1d9/0x230, CPU#540: swapper/540/0
Call Trace:
<IRQ>
try_fill_recv+0x399/0x940
virtnet_poll+0x538/0xc10
net_rx_action+0x21d/0x610
irq_exit_rcu+0xf9/0x3a0
common_interrupt+0x85/0x90
</IRQ>
The theory is that virtnet_poll() refills the Rx ring when netpoll
calls it. netpoll polls NAPI with a zero budget to reclaim Tx buffers,
on whatever CPU is transmitting, but virtnet_receive() still refills
it.
Since commit 24fbd3967f3f ("virtio_net: add page_pool support for buffer
allocation") that refill allocates from the page pool, which must not be
used with a zero budget (see Documentation/networking/napi.rst).
A reproducer on the net tree supports the theory: an 8-CPU arm64 VM with
QEMU user networking, a netconsole target on the virtio_net device and
three TCP receivers on other CPUs checking a known byte pattern. A
printk flood through netconsole corrupted all three streams within about
three minutes, after which recvmsg() failed with -EFAULT and the same
warning fired. A test kthread calling netpoll_poll_dev() in a loop, as
__netpoll_send_skb() does while the Tx queue is busy, corrupts the
streams within seconds.
Only reclaim Tx when the budget is zero
Fixes: 24fbd3967f3f ("virtio_net: add page_pool support for buffer allocation")
Signed-off-by: Breno Leitao <[email protected]>
---
drivers/net/virtio_net.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index dd2c41ef6fbe72..9db5ec875c141f 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -3037,6 +3037,9 @@ static int virtnet_poll(struct napi_struct *napi, int
budget)
virtnet_poll_cleantx(rq, budget);
+ if (unlikely(!budget))
+ return 0;
+
received = virtnet_receive(rq, budget, &xdp_xmit);
rq->packets_in_napi += received;
---
base-commit: 1d5e2c57e9ffc134e14b3f837c8d7c53b508bd22
change-id: 20261109-virtio-net-netpoll-pp-170f0dc4d6e0
Best regards,
--
Breno Leitao <[email protected]>
