From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-qt1-f172.google.com (mail-qt1-f172.google.com [209.85.160.172]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A73C2441633 for ; Thu, 8 Oct 2026 21:03:34 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.160.172 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1791493422; cv=none; b=P0YLzAxKqpaDv4LzeWape8SuCD8Ijglnh36p28DW27B33eiko99dkoCMA1Z5xk9dR4kKcRypRO9HnBtxMhK2x5DHj84rrBqWjNdQVEA1J5wpe3iQIUTttITt5zwIvHgFEjLtz4x/8nG67+SvFIqtAtExG6pHuImz86KswifQQeU= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1791493422; c=relaxed/simple; bh=eg6ZiA9VrIpAG1HGYjPkKMEWwjo8D3VwigBhj0jOQMI=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=dXD0jvDh0wpcv490Parg1UisRti0GpiPpdtg23RO19oEXbEL45V/iG2REbAqG1KtJdjrf6DqOYmYColgrkGlUnmMOy08pnIfnjiFpWavAfxlrVc/eBVVNw7UNKGLAPWimJ4wBEXfUPxyQUaC95IGfGMsmMFru1TqPm5vMQ/dMg8= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=toxicpanda.com; spf=pass smtp.mailfrom=toxicpanda.com; dkim=pass (2048-bit key) header.d=toxicpanda.com header.i=@toxicpanda.com header.b=YRK3ADz0; arc=none smtp.client-ip=209.85.160.172 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=toxicpanda.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=toxicpanda.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=toxicpanda.com header.i=@toxicpanda.com header.b="YRK3ADz0" Received: by mail-qt1-f172.google.com with SMTP id d75a77b69052e-53391022dc0so36962291cf.2 for ; Thu, 08 Oct 2026 14:03:34 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=toxicpanda.com; s=google; t=1791493413; x=1792098213; darn=vger.kernel.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=jXT5xqnUz/gqqG3F9wxnjnCJ7kPBk+m9Im3cz1NP6m0=; b=YRK3ADz0+hVZ7K+hfPF/hdt/Z9G46F8iuh3Tai54g+aiuP/kTbub+RY1VS9e7ZyaPO 3FV/plDWv4vVxCsXSnqyTnhWgyyCXZHR4tKGFEXQNy/KRbW3y70tIiKburGK6xrdOoUg rUHKlsifMKyuwQZ5pSu8vDzzKVddmbPUrdL2vhUNmYQx2SdLh5JwoUthCmyANxDlRoea FDghV9wBdpO7MWw8iXitbN4pOyuP4sfBzqNUZ1PlNilBrhfmbj9y3IDdqjekZqluOXNd 54fakGnvgLOaY/5Ywy2PeElX2Ps1jqMKLgGceLRiwpQKsc39jOz6LcAyseWjDhmMnOU0 ukjg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791493413; x=1792098213; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=jXT5xqnUz/gqqG3F9wxnjnCJ7kPBk+m9Im3cz1NP6m0=; b=bRRT8FsWg9F79/32ov/FuV8f4XQRJFqu+bz05ev5h7K63HEFfOPWu5KWUY+aNL/ZBr TvSKzj642Ivt37eL3oXscZH6gaQSYwrD4WMBLVpEIufeJpiYsKra0QWRDGeMo6sBH3L1 9OxvuEvCnw3u51kzfybtju2OeoH7PTJol97rv11HWwhQW3P1t9meB1lSj27HDcdWPbGi JyNT74+lZBbB27IuIMi+eLTXKpramoZFgOcndqrl29YZ8p/Wxnl4ubMitpud/9ibNmJA BGlaYkAbHAUMIr+DDCFMUzCR7E0p9vEynPOtzfjcUPksP1FHF3Qjbjsow2NzVkHvwHMn 2Mjg== X-Forwarded-Encrypted: i=1; AKwUvBx6QRN7UbdE+o35cev5nq4kcUf4J4ELhUjFD9WCmt3ukj7e+PlVNMfYs+t9CmeOGPTGuv1OUx+Y3jZMNEU=@vger.kernel.org X-Gm-Message-State: AFuF++kQCtQFRyRVJTFLN2G/M8fWHj+M5vC2WoXk1DSQnwlol2uXR7qL K3GTyHys9CMtFXzFjJZRODHyCN7HmrXtGhUQnxaM17eNG8aH3IeHVrMn8D+GmHDV8gQ= X-Gm-Gg: AYBFou2F0CbI4qRk8ogrkLcsxbjl3M791zvlelIKjtSFCyrL/CfQOxfLf4B5EPYWzBF j1IjYHIZez8qYCCfUlaXU2JfbSSmWC1OX/YMa1zUOAUw3vwLjMwjMkEyP0eFECLMD9jw7NREvpy swrQxE4jOL13aaOWuesbUZn+V4qDgQAKa6cVi9n459cVWsfQ1Ea3WQvk95UAsaTHa2NiY19yiqW nnYGTZw9mSA/tc/nGDhTUSpIDzzTnRicJt+rlepTOW883SBTmu/J0eafk2J/OuopYUXX6+EBiFD 6zpkx0JeA2OW1iAkt373HOyhihqtyDibjLIMdDa4E89GNqEfsGEJzNTlwipqAqsc7J2XJsirdB2 qxpbcxrFVa2FFuEF7uE34osvJjrKp7VqIAEsEHcsgzTBfA7cIQ6Eyw30lp1wYChTY7wP1XhK9sT PT0Q7jibnhEljJLyLGBPEeXJ/Wi6rplj5Viy7F5/d1i9N8+KzIjPWOxUq/f5PXZplTf9kfxy4qE dgJ0kDOhp+tlak= X-Received: by 2002:a05:622a:1a91:b0:535:70c4:9a94 with SMTP id d75a77b69052e-535757c8eecmr123953171cf.74.1791493413537; Thu, 08 Oct 2026 14:03:33 -0700 (PDT) Received: from toxicpanda.com ([153.61.196.246]) by smtp.gmail.com with ESMTPSA id d75a77b69052e-5359b46dda0sm3472151cf.4.2026.10.08.14.03.32 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 08 Oct 2026 14:03:32 -0700 (PDT) From: Josef Bacik Date: Thu, 08 Oct 2026 21:02:52 +0000 Subject: [PATCH net-next v2 05/10] xen/netfront: check for failure when pulling in xennet_fill_frags() Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Message-Id: <20261008-b4-pskb-pull-tail-drivers-v2-5-8f2bd9bee138@toxicpanda.com> References: <20261008-b4-pskb-pull-tail-drivers-v2-0-8f2bd9bee138@toxicpanda.com> In-Reply-To: <20261008-b4-pskb-pull-tail-drivers-v2-0-8f2bd9bee138@toxicpanda.com> To: Jakub Kicinski , Paolo Abeni , Eric Dumazet , "David S. Miller" , Andrew Lunn Cc: Saeed Mahameed , Tariq Toukan , Mark Bloch , Leon Romanovsky , Juergen Gross , Stefano Stabellini , Oleksandr Tyshchenko , Tony Nguyen , Przemek Kitszel , Manish Chopra , Rahul Verma , GR-Linux-NIC-Dev@marvell.com, Shahed Shaikh , Simon Horman , netdev@vger.kernel.org, linux-kernel@vger.kernel.org, linux-rdma@vger.kernel.org, xen-devel@lists.xenproject.org, intel-wired-lan@lists.osuosl.org, Josef Bacik X-Mailer: b4 0.15.2 X-Developer-Signature: v=1; a=openssh-sha256; t=1791493385; l=2516; i=josef@toxicpanda.com; h=from:subject:message-id; bh=eg6ZiA9VrIpAG1HGYjPkKMEWwjo8D3VwigBhj0jOQMI=; b=U1NIU0lHAAAAAQAAADMAAAALc3NoLWVkMjU1MTkAAAAgUBr36M/n0nWN0DNbnxwzIiCZez6MG JiruuNaSCI/zXsAAAAGcGF0YXR0AAAAAAAAAAZzaGE1MTIAAABTAAAAC3NzaC1lZDI1NTE5AAAA QAYzg3nASJLuLmRvMNvnGKJmwP15K/QJrV/X+gIw+dmiWX6S/LgMrQ8OB+kIWHKPWdMQHYgaFiD sh9Hj7FexRAU= X-Developer-Key: i=josef@toxicpanda.com; a=openssh; fpr=SHA256:C8kOX2QUJCMqnCX+KEeoqRAjLo9L+ELOSH2NSAJHqGA When the skb already has MAX_SKB_FRAGS frags, xennet_fill_frags() calls __pskb_pull_tail() to free up a frag slot. That frees slots in two ways: it pulls the start of the packet into the head, and it releases empty frags, even when there's nothing left to pull. The second part is what commit d81c5054a5d1 ("xen/netfront: tolerate frags with no data") relies on. The return value is ignored, which works out only because the nr_frags check right after it drops the packet if no slot was freed. Use pskb_may_pull() followed by skb_drop_empty_frags(), and take the error path explicitly if either fails. pskb_may_pull() does nothing if the head already holds pull_to bytes, so the BUG_ON() for pull_to < skb_headlen(skb), which protected the subtraction, can go. Assisted-by: LLM Signed-off-by: Josef Bacik --- drivers/net/xen-netfront.c | 26 ++++++++++++++------------ 1 file changed, 14 insertions(+), 12 deletions(-) diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c index 2ed673649c48..007fa3bbc9e6 100644 --- a/drivers/net/xen-netfront.c +++ b/drivers/net/xen-netfront.c @@ -1174,18 +1174,15 @@ static int xennet_fill_frags(struct netfront_queue *queue, RING_COPY_RESPONSE(&queue->rx, ++cons, &rx); - if (skb_shinfo(skb)->nr_frags == MAX_SKB_FRAGS) { - unsigned int pull_to = NETFRONT_SKB_CB(skb)->pull_to; - - BUG_ON(pull_to < skb_headlen(skb)); - __pskb_pull_tail(skb, pull_to - skb_headlen(skb)); - } - if (unlikely(skb_shinfo(skb)->nr_frags >= MAX_SKB_FRAGS)) { - xennet_set_rx_rsp_cons(queue, - ++cons + skb_queue_len(list)); - kfree_skb(nskb); - return -ENOENT; - } + /* Out of frag slots: pull the start of the packet into the + * head and drop empty frags to make room. + */ + if (skb_shinfo(skb)->nr_frags == MAX_SKB_FRAGS && + unlikely(!pskb_may_pull(skb, NETFRONT_SKB_CB(skb)->pull_to) || + skb_drop_empty_frags(skb, GFP_ATOMIC))) + goto err; + if (unlikely(skb_shinfo(skb)->nr_frags >= MAX_SKB_FRAGS)) + goto err; skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags, skb_frag_page(nfrag), @@ -1198,6 +1195,11 @@ static int xennet_fill_frags(struct netfront_queue *queue, xennet_set_rx_rsp_cons(queue, cons); return 0; + +err: + xennet_set_rx_rsp_cons(queue, ++cons + skb_queue_len(list)); + kfree_skb(nskb); + return -ENOENT; } static int checksum_setup(struct net_device *dev, struct sk_buff *skb) -- 2.55.0