From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=74.125.82.169 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1793468406; b=KQXyOmWzAemNq3mH3OfarnOEja7wwHDFcFQJAiQBeTqXYxV98wb6Ss5M8i/B7pDA9Qnq EeGYAz8Val4s3wLTHt/Wjpp9nVrlEUbIe5RfFQujVdQSaXHg4MxAmome5Hq/JkKeJdeuD MYPIzCOsVPJgbYDelFXTOYDf6a7H87vaNctVVH+hukLIXQEXPQpB2O6RUMdpIy9Ka1QJx RorzE81fnMPlUvE4XRntuTLlhwdLmDl06HbRebrPjQIi5Ce064trQz7B8AiIsNcf4lawD D+m1rw/mQc+cLzPsdgGFjekz5AgLv/YbXxwuA1tNQHbPpbpvsOpQLcCPEbUPEb8RKSg== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1793468406; h=DMARC-Filter:Received:DKIM-Signature:X-Google-DKIM-Signature: X-Gm-Message-State:X-Gm-Gg:X-Received:Received:From:To:Cc:Subject: Date:Message-ID:X-Mailer:MIME-Version:Content-Transfer-Encoding; bh=h+VQh/AmL38ZCMvqzeydsTBuUNxyHdWMzBjWeSKxMc0=; b=dnbt7xVb7ZXq+VMJ6R8Oh9zHQxfnGgUWoQWy591/kGTkakLAepbbd9WfWvEXUlszrUnp zNiM/HeTnXBCpu0vAUaS7PpV3gQUfpt1aoYThf9Ze7xybLiGiOOzC0xzf4TraO0+YGmmX EFcgS4IWjBOaVTBPnCHGJIWjGyORmF3AT5xz3OK9ZMJF6ioeyAeFg4AbzQcjDtXtRJt45 g62nnyekjPQs0XuRu592TUYuc6f2aOKddP31gEniE/JML2fbGTRR4L4gWsrcATxw3YvIE 0BJBxfO5HatGti9brURJzqaFcxhCPQdH48EO0E5UU7MtGzA6Jmjr4VUzjT9QWv0tS9Q== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20260707 header.b="JGRW/2AM"; arc=none smtp.remote-ip=74.125.82.169 Received: from mail-dy1-f169.google.com (mail-dy1-f169.google.com [74.125.82.169]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature ECDSA (prime256v1) server-digest SHA256) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B7FF0606A31C for ; Sat, 31 Oct 2026 17:40:05 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.2 smtp.subspace.kernel.org B7FF0606A31C Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key, unprotected) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20260707 header.b=JGRW/2AM Received: by mail-dy1-f169.google.com with SMTP id 5a478bee46e88-36a0f27c9f4so3047224eec.1 for ; Sat, 31 Oct 2026 10:40:05 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20260707; t=1793468405; x=1794073205; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=h+VQh/AmL38ZCMvqzeydsTBuUNxyHdWMzBjWeSKxMc0=; b=JGRW/2AMeLNySqBe7BDRSGF8sZGlwaRlOclOiqJeJl6Gn6CSX+8lZHX+1zvL1qGGCm WGWgUP1m8VfPe2MSWHHtUqNOqVxwDeWHJkwy3GLSIlOnm6C1fINb47is5eX5lXLvW3PU OHlwOEJRw6uOf/taRkZwpwOHN3bf/P9Th7X4YrEaO1doceMhAhEngG5c8wYLDKFbYhBu g7UngjbOyEdba+Rzo7rnzLRD6hiOwH84SzdDJ4xr3iQo5eGQAh8LPGvLAZhCizOgEbEq 7KXgrQhDayXGbFetoF+HFvxTtyh/Zrl/cKdMtljRm0bheY23Un/jpLCIa7whQWD3c/gw whVQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793468405; x=1794073205; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=h+VQh/AmL38ZCMvqzeydsTBuUNxyHdWMzBjWeSKxMc0=; b=qeYW/JiPZGCPSoptiUQrkLZN/LNK/qsQs1lkbUcx/l4jLq4yVvI1woOizUGvEkMfOs 9CMJSH4ZgoYnd8r3GmBNzVZsiwKtj7XBIOs3yytmMqo99s6xVt7t+CzbHWaKzG1z0+nM ms2X1m2MZNp50Zls7m5fg3Fw1hd6OgCHOYPf8gpv1a8GwYPeWmXzQdnyIXD/yglIMwpr 9J8zEtjAFFAvzBsj19iHKQe0I3s2dkD4E1fuZuDDsFMOs3XOKd+VozraLPFeRo5NzUri NIPx7lPR/2dPCFJOZt4nPqO4wCllPsXnA/dkrgIKoAeccFji7OY4Ro5VzWEUTASI9f4g mtRg== X-Gm-Message-State: AFq9FYJ64elgmKhOK03CZUPQ0DeKHOSiZkgYdkFzYdfG1aX7ZhqXQMMb qJxVXVpmSNZHsaUaRAxqqjTTYpJNS5jpY2CAAHsFIn81U7rduprjrpEl X-Gm-Gg: AYBFou3OT+gPTxTb1l/5ajX/0RWySy2seGwlMA54QBPn9BMBX1HMFfFQVo+NpgaiyHQ 9p65XKinaSGbS1MzZMf9TkFZTTOnzIBf3fWDqDLKnwA8zw2q+7M5vig9uMxguDS3qFvdUEZCUQ6 8yiAzLnVmCXq+8e0yryLVW4B+D3wjAm1zzNTWwfKlbySuW6OihAfOARHZ0pvAfzaNHAJFkCC1id DG7a3U8qE7Rta05ppgLAN/SrCWqPqaGuYU31g8QQ5jzYtURGDIWYumvXjMbUJVKbrJSBTTSEsNk VBsfBLwaAm/QSKPbN7wEBItKAlWSQyNZmfRS3YQ2lsAVe8amo791c8MrmuZ+QoP28isvBZjIaBo 0CoMD/KCuz14FxJneuRFPac4V2H5a9YauqHQPKHfvLOkinwpzkz4SXXSbvVaIJAOutwQ23ODpos sQ5/oiL97vNDuodczN77PK/LBFWxod2wZ/0gQbD31gCBAK1fQmOQIfFTm3hmVul33F7s60qKqe5 7IDEYb5lN5OmO3F653AR080Ekh6Hz9I4LXtbZnzLhEi+YSWCS9i4+9WD88Ue8OiLcdRh/uPbdp2 9VHmQA560tkzZ0lrymnf7L2nH/Ta3s31Cn7vl0qWCXoEtQ== X-Received: by 2002:a05:7301:6787:b0:361:306f:c32a with SMTP id 5a478bee46e88-36a42345b05mr10664935eec.11.1793468404548; Sat, 31 Oct 2026 10:40:04 -0700 (PDT) Received: from localhost.localdomain ([2406:7400:51:284f:c2b6:f9ff:fe77:10a0]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-36a42a96172sm17207026eec.27.2026.10.31.10.39.59 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 31 Oct 2026 10:40:04 -0700 (PDT) From: Amaan Cheval To: netdev@vger.kernel.org Cc: linux-kernel@vger.kernel.org, Amaan Cheval , stable@vger.kernel.org, Joshua Washington , Harshitha Ramamurthy , Andrew Lunn , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Zhiling Zou , Jiayuan Chen , Kuniyuki Iwashima Subject: [PATCH net] gve: leave refcount headroom in the RX page bias Date: Sat, 31 Oct 2026 23:04:43 +0530 Message-ID: <20261031173449.2439047-1-amaan.cheval@gmail.com> X-Mailer: git-send-email 2.49.0 X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit gve's GQI and DQO-QPL RX paths set every RX page's refcount to INT_MAX and hand references to the stack by decrementing page_info->pagecnt_bias, to avoid an atomic op per packet. This leaves the page no headroom: while a fresh page's buffer sits in an skb its refcount is already INT_MAX, so a single get_page() from the stack wraps it negative. splice() of received TCP data into a pipe takes such a reference, and the onward splice into a socket then fails: skb_splice_from_iter() sees page_count() < 1, sendpage_ok() fails and the send returns -EIO (since commit 2e910b95329c ("net: Add a function to splice pages into an skbuff for MSG_SPLICE_PAGES")) tee() of the pipe fails with -EFAULT via try_get_page(). On GQI the reuse check gve_rx_can_recycle_buffer() also sees page_count() < pagecnt_bias, WARNs and calls gve_schedule_reset(), so a task that merely pins a fresh RX page (e.g. holds spliced data in an undrained tee() pipe) can reset the NIC. Use USHRT_MAX in a u16, as igb, igc, ixgbe, i40e and hns3 do: the bias only has to make the per-packet atomic rare so a small value leaves page_count() ample headroom below INT_MAX for the stack's references, and the u16 bounds it. Refill by adding a fixed batch and setting the bias to it, which keeps the rule `references = page_count() - bias` intact. Reproduced on gVNIC in GQI-QPL mode (GCE n2-standard-8, 6.12), no kernel changes needed, with relay.py -- a small splice(2) TCP proxy -- relaying a download while the RX ring is refilled with fresh pages: ethtool -G eth0 rx 512 && ethtool -G eth0 rx 1024 # fresh RX pages ./relay.py $HOST 8080 & # splice()s both ways for i in $(seq 200); do curl -so /dev/null \ --connect-to $HOST:80:127.0.0.1:8080 http://$HOST/file; done Most downloads failed with EIO before the fix (tee() with EFAULT) and all completed after it, including with the bias forced to 1. Built allmodconfig W=1, no new warnings; no selftests run. relay.py is at the Link below. This bug was found and fixed with the help of an AI coding assistant (Claude Code) over an interactive session; it read the driver and splice/pipe code and ran the tests above. Link: https://github.com/amaanc/kernel-bias Fixes: 9b8dd5e5ea48 ("gve: DQO: Add RX path") Fixes: 58401b2a46e7 ("gve: Add rx buffer pagecnt bias") Fixes: 82fd151d38d9 ("gve: Reduce alloc and copy costs in the GQ rx path") Cc: stable@vger.kernel.org Signed-off-by: Amaan Cheval --- drivers/net/ethernet/google/gve/gve.h | 2 +- .../net/ethernet/google/gve/gve_buffer_mgmt_dqo.c | 4 ++-- drivers/net/ethernet/google/gve/gve_rx.c | 8 ++++---- drivers/net/ethernet/google/gve/gve_utils.c | 12 +++--------- drivers/net/ethernet/google/gve/gve_utils.h | 8 +++++++- 5 files changed, 17 insertions(+), 17 deletions(-) diff --git a/drivers/net/ethernet/google/gve/gve.h b/drivers/net/ethernet/google/gve/gve.h index b7ce6e8632db..18d7edbf4b3b 100644 --- a/drivers/net/ethernet/google/gve/gve.h +++ b/drivers/net/ethernet/google/gve/gve.h @@ -119,7 +119,7 @@ struct gve_rx_slot_page_info { void *page_address; u32 page_offset; /* offset to write to in page */ unsigned int buf_size; - int pagecnt_bias; /* expected pagecnt if only the driver has a ref */ + u16 pagecnt_bias; /* expected pagecnt if only the driver has a ref */ u16 pad; /* adjustment for rx padding */ u8 can_flip; /* tracks if the networking stack is using the page */ }; diff --git a/drivers/net/ethernet/google/gve/gve_buffer_mgmt_dqo.c b/drivers/net/ethernet/google/gve/gve_buffer_mgmt_dqo.c index 6880d1531ba5..571f851d6dcd 100644 --- a/drivers/net/ethernet/google/gve/gve_buffer_mgmt_dqo.c +++ b/drivers/net/ethernet/google/gve/gve_buffer_mgmt_dqo.c @@ -149,8 +149,8 @@ int gve_alloc_qpl_page_dqo(struct gve_rx_ring *rx, buf_state->last_single_ref_offset = 0; /* The page already has 1 ref. */ - page_ref_add(buf_state->page_info.page, INT_MAX - 1); - buf_state->page_info.pagecnt_bias = INT_MAX; + page_ref_add(buf_state->page_info.page, GVE_PAGECNT_BIAS - 1); + buf_state->page_info.pagecnt_bias = GVE_PAGECNT_BIAS; return 0; } diff --git a/drivers/net/ethernet/google/gve/gve_rx.c b/drivers/net/ethernet/google/gve/gve_rx.c index 81ea800e66e9..6533fff06155 100644 --- a/drivers/net/ethernet/google/gve/gve_rx.c +++ b/drivers/net/ethernet/google/gve/gve_rx.c @@ -152,8 +152,8 @@ static void gve_setup_rx_buffer(struct gve_rx_ring *rx, page_info->buf_size = rx->packet_buffer_size; *slot_addr = cpu_to_be64(addr); /* The page already has 1 ref */ - page_ref_add(page, INT_MAX - 1); - page_info->pagecnt_bias = INT_MAX; + page_ref_add(page, GVE_PAGECNT_BIAS - 1); + page_info->pagecnt_bias = GVE_PAGECNT_BIAS; } static int gve_rx_alloc_buffer(struct gve_priv *priv, struct device *dev, @@ -230,8 +230,8 @@ static int gve_rx_prefill_pages(struct gve_rx_ring *rx, rx->qpl_copy_pool[j].buf_size = rx->packet_buffer_size; /* The page already has 1 ref. */ - page_ref_add(page, INT_MAX - 1); - rx->qpl_copy_pool[j].pagecnt_bias = INT_MAX; + page_ref_add(page, GVE_PAGECNT_BIAS - 1); + rx->qpl_copy_pool[j].pagecnt_bias = GVE_PAGECNT_BIAS; } } diff --git a/drivers/net/ethernet/google/gve/gve_utils.c b/drivers/net/ethernet/google/gve/gve_utils.c index caed38cd5f2b..cb6fba3122d5 100644 --- a/drivers/net/ethernet/google/gve/gve_utils.c +++ b/drivers/net/ethernet/google/gve/gve_utils.c @@ -93,15 +93,9 @@ void gve_dec_pagecnt_bias(struct gve_rx_slot_page_info *page_info) { page_info->pagecnt_bias--; if (page_info->pagecnt_bias == 0) { - int pagecount = page_count(page_info->page); - - /* If we have run out of bias - set it back up to INT_MAX - * minus the existing refs. - */ - page_info->pagecnt_bias = INT_MAX - pagecount; - - /* Set pagecount back up to max. */ - page_ref_add(page_info->page, INT_MAX - pagecount); + /* Out of bias: take another batch of references. */ + page_info->pagecnt_bias = GVE_PAGECNT_BIAS; + page_ref_add(page_info->page, GVE_PAGECNT_BIAS); } } diff --git a/drivers/net/ethernet/google/gve/gve_utils.h b/drivers/net/ethernet/google/gve/gve_utils.h index bf2e9a0adb36..316f97607351 100644 --- a/drivers/net/ethernet/google/gve/gve_utils.h +++ b/drivers/net/ethernet/google/gve/gve_utils.h @@ -25,7 +25,13 @@ struct sk_buff *gve_rx_copy_data(struct net_device *dev, struct napi_struct *nap struct sk_buff *gve_rx_copy(struct net_device *dev, struct napi_struct *napi, struct gve_rx_slot_page_info *page_info, u16 len); -/* Decrement pagecnt_bias. Set it back to INT_MAX if it reached zero. */ +/* Up-front references gve holds on an RX page, so handing a buffer to the + * stack is a pagecnt_bias decrement, not a get_page(). Keep it in a u16 so + * the 32-bit page refcount keeps the headroom every page needs below INT_MAX. + */ +#define GVE_PAGECNT_BIAS USHRT_MAX + +/* Decrement pagecnt_bias. Top it up by GVE_PAGECNT_BIAS if it reached zero. */ void gve_dec_pagecnt_bias(struct gve_rx_slot_page_info *page_info); void gve_add_napi(struct gve_priv *priv, int ntfy_idx, base-commit: d8a4f4c59da52b7c31ae337243b8473a19a3f819 -- 2.47.3