From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=74.125.82.200 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1793740470; b=KZ1fO0x6rNytxJK6aVWG0bx1o1/tTPPwjbeX74zF4+Ux4GRhah/uKrdffYGBIs2MHXSm /zKklFq+WxKMhmYfCAg8XgXKi8ut58NAbhINTsiJMiZzt73zTZzUE9G1xm4dCXBLs9IfI /DEpKONEaby6M7V35dh2hqn+C9E4Hl/etytrNZqu5/qHl1smTMux2h64N1TSYi4Z3Ta0d phJD0nOA+WNeNNuOlKpJQNuQiQ8Fpoa4f8JIL5oGDz7jmDsp1fPjCjReWFPNmdCEyvtB1 8G8JktT/U4AYgugWD79w1WOm7qgvIDzLlyYXHSdd8vL5x/GIsuNYAKx2rztc1fkc0QA== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1793740470; h=DMARC-Filter:Received:DKIM-Signature:X-Google-DKIM-Signature: X-Forwarded-Encrypted:X-Gm-Message-State:X-Received:Date:In-Reply-To: Mime-Version:References:X-Mailer:Message-ID:Subject:From:To:Cc: Content-Type; bh=Mqx62j/MS4Vpw2prk2XGbtfQUzR6R3P7OHsZIxuKjsE=; b=sTArJ+pqNvhAwJ76vZIn14UT6nUsgqtple86rVaFCG3z/BOX5FWZoSwz+pUlwofQgNUR d5Hs91585v5/VZ+Uz87P/r5utyuMmMixk9dvSEBZaenxR0UDS/9V7bWwLDjyxaEHkqFxk gbjg4iBwTe7O0+hlzTH2VxrMZmjFt6wRsWA/G4/WpzuirgptIHA+O93mWO7zHI1vjF1Rj 2iOynHHaaFCPFp92e6gkz75mnFd6u66L/nGjbjuQD9ZGYLIDFs1mwsfKBPcQKrvtg4vi6 4Y25T2uN9l5LsnxzqoltP5MnPG2PBVvRZoYh8NXDhaJkPfs+tXqf9FnJNxtNy0/sNtQ== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass header.from=google.com; spf=pass smtp.mailfrom=flex--almasrymina.bounces.google.com; dkim=pass header.d=google.com header.i=@google.com header.a=rsa-sha256 header.s=20260707 header.b=mYGS1684; arc=none smtp.remote-ip=74.125.82.200 Received: from mail-dy1-f200.google.com (mail-dy1-f200.google.com [74.125.82.200]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature ECDSA (prime256v1) server-digest SHA256) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id EFAC8606D829 for ; Tue, 3 Nov 2026 21:14:29 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.2 smtp.subspace.kernel.org EFAC8606D829 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--almasrymina.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key, unprotected) header.d=google.com header.i=@google.com header.a=rsa-sha256 header.s=20260707 header.b=mYGS1684 Received: by mail-dy1-f200.google.com with SMTP id 5a478bee46e88-3698bd5392cso1000978eec.1 for ; Tue, 03 Nov 2026 13:14:29 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20260707; t=1793740469; x=1794345269; darn=vger.kernel.org; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:from:to:cc:subject:date:message-id:reply-to :content-type; bh=Mqx62j/MS4Vpw2prk2XGbtfQUzR6R3P7OHsZIxuKjsE=; b=mYGS1684RqdpIK3Jfjbz6kYwRHrgKYWCC1uuvnoOTjJXIBein+s1KCDC7vlL6NmdcJ YJPv4Ur4CgDzErAdxwqLrsAYqUPSYXuMC+qmyYuTQmhquyhpS1vDQ1xYZkjIsf/pDFjB i0rug4OnGvOLknH2N8uBjGDfXXfMRGoKRaYD3ZW+YE/tCe/zBJ92Uf0jrZLRbv5IUuvp bcVIfchr0lzb86bMjOB5CRy60S2UB+LyHa0kxDCebJFLBzbJgIDOgVBURVQBbTo+GSYd cralVlMDdP3a1YXMxNbNxMJ2kWKOG/aFb1PN492xf7orGbZIp1/xLN61vOkM/ykO6NNX We0A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793740469; x=1794345269; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=Mqx62j/MS4Vpw2prk2XGbtfQUzR6R3P7OHsZIxuKjsE=; b=FZkNvJrsNj+rco/OEBg8ZsAMDvoPrUz0CTbwszVxb73nSI/U42RL5tTN3bQJgV3bO4 QLf1vD3gWMLOmQqdbD3rlUwGhSyVwwKMxZmyll2DLSL/gWthcR+F4T12LSzn5KLD7TCZ 3wPerSc2hUY82nWS+X2HoLB7aqol6yXGzEn9pcCNnHeYtjB6t0L3lwVYSGHO2q5aSvQx mtM53K/9fD0C1sKRaQrK4iTZcagL4RaOMD51jsYxRo7p49TNXG5+Hxx9rwVDLYnPiKAm BWeR+Jv0jhHyD3YlE8UT0RDh6ZHCN4Lngp/bjWMSzOCdHWeXQzct6cnndMZuo4Dqtas9 KStA== X-Forwarded-Encrypted: i=1; AKwUvBzlbLpwuTbq1xJgE8kTATYY+pDS/OKK/W1f7sm7wQ7x6WBRV6gQwsK5GhxH88a6O7PKZgQnuHFx5w5Hw7M=@vger.kernel.org X-Gm-Message-State: APuU4Z/36LOjk1Z7Vn6IJZWpXprRfEawOEzLEWITfkB9lRnFJgs3qjdk wK35svVs9Wbur/9JZ+H5xPVEwpkm8vEUeC/BTenLUnRWQN5jqVRP7WAOvd7NlNT/SMYK8YJ4k6+ UfgBOC6ABupoD5oPAVFEquN1b/A== X-Received: from dycmb15-n2.prod.google.com ([2002:a05:693c:20cf:20b0:369:f67f:7a43]) (user=almasrymina job=prod-delivery.src-stubby-dispatcher) by 2002:a05:693c:20d2:20b0:368:2c6d:ddfe with SMTP id 5a478bee46e88-36a30008535mr24191511eec.9.1793740468575; Tue, 03 Nov 2026 13:14:28 -0800 (PST) Date: Tue, 3 Nov 2026 21:14:21 +0000 In-Reply-To: <20261103211424.127627-1-almasrymina@google.com> X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list Mime-Version: 1.0 References: <20261103211424.127627-1-almasrymina@google.com> X-Mailer: git-send-email 2.56.0.385.gac671c819a-goog Message-ID: <20261103211424.127627-3-almasrymina@google.com> Subject: [PATCH net-next v1 2/5] net: skbuff: refcount spliced page_pool frags via skb_pipe_buf_ops From: Mina Almasry To: netdev@vger.kernel.org, linux-kernel@vger.kernel.org, virtualization@lists.linux.dev, linux-mm@kvack.org, bpf@vger.kernel.org, linux-wireless@vger.kernel.org, linux-doc@vger.kernel.org, bcm-kernel-feedback-list@broadcom.com, imx@lists.linux.dev, linux-rdma@vger.kernel.org, linux-hyperv@vger.kernel.org, linux-renesas-soc@vger.kernel.org, linux-omap@vger.kernel.org Cc: Mina Almasry , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , Steffen Klassert , Herbert Xu , Willem de Bruijn , Stanislav Fomichev , Pavel Begunkov , Bobby Eshleman , Andrew Lunn , "Michael S. Tsirkin" , Jason Wang , "=?UTF-8?q?Eugenio=20P=C3=A9rez?=" , Xuan Zhuo , Andrew Morton , David Hildenbrand , Lorenzo Stoakes , "Liam R. Howlett" , Vlastimil Babka , Mike Rapoport , Suren Baghdasaryan , Michal Hocko , Jesper Dangaard Brouer , Ilias Apalodimas , Alexei Starovoitov , Daniel Borkmann , John Fastabend , Sabrina Dubroca , Johannes Berg , Byungchul Park , Jonathan Corbet , Shuah Khan , Randy Dunlap , Lorenzo Bianconi , Wen Gu , Philo Lu , Justin Chen , Florian Fainelli , Vikas Gupta , Michael Chan , Pavan Chebbi , Doug Berger , Nicolai Buchwitz , Satish Kharat , Wei Fang , Frank Li , Shenwei Wang , Joshua Washington , Harshitha Ramamurthy , Jijie Shao , Jian Shen , Fan Gong , Tony Nguyen , Przemek Kitszel , Marcin Wojtas , Russell King , Sunil Goutham , Geetha sowjanya , Ratheesh Kannoth , Subbaraya Sundeep , Bharat Bhushan , Felix Fietkau , Matthias Brugger , AngeloGioacchino Del Regno , Tariq Toukan , Saeed Mahameed , Mark Bloch , Leon Romanovsky , Ido Schimmel , Petr Machata , Horatiu Vultur , UNGLinuxDriver@microchip.com, Daniel Machon , Steen Hegelund , Haiyang Zhang , Wei Liu , Dexuan Cui , Yibo Dong , Brett Creeley , Justin Lai , Larry Chiu , "=?UTF-8?q?Niklas=20S=C3=B6derlund?=" , Paul Barker , Masahisa Kojima , Maxime Chevallier , Maxime Coquelin , Alexandre Torgue , FUJITA Tomonori , Siddharth Vadapalli , Roger Quadros , MD Danish Anwar , Jiawen Wu , Mengyuan Lou , Ronak Doshi , Ryder Lee , Shayne Chen , Sean Wang , Juergen Gross , Stefano Stabellini , Oleksandr Tyshchenko , Jordan Rhee , Ankit Garg , Tim Hostetler , Erni Sri Satya Vennela , Eric Joyner , Mohammad Heib , Prabu Thayalan , Chintan Vankar , Nora Schiffer , Alexander Sverdlin , Kevin Hao , Karl Mehltretter , Aleksandr Loktionov , Meghana Malladi , Jacob Keller , StanleyYP Wang Content-Type: text/plain; charset="UTF-8" Update skb_splice_bits() (spd_fill_page(), sock_spd_release(), and skb_pipe_buf_ops) and skb_append_pagefrags() to acquire and release references via netmem_inc_ref(), netmem_dec_ref(), and skb_frag_ref() so page_pool RX fragments spliced into a pipe remain pinned in the pool while in the pipe and pair with skb_append_pagefrags() and skb_release_data() when spliced into a TX socket once netmem_inc_ref() and netmem_dec_ref() handle page_pool netmems. Caveats: - Because pipe buffers created by skb_splice_bits() hold pp_ref_count until released (including across tee()), user pipes holding unconsumed spliced data keep those page_pool pages in-flight and DMA-mapped in the pool (bounded by pipe capacity and RLIMIT_NOFILE rather than sk_rcvbuf) until the pipe buffers are consumed or closed, with page_pool_destroy() deferring pool release via its periodic workqueue and page_pool_scrub() unmapping DMA. Signed-off-by: Mina Almasry --- net/core/skbuff.c | 26 ++++++++++++++++++++++---- 1 file changed, 22 insertions(+), 4 deletions(-) diff --git a/net/core/skbuff.c b/net/core/skbuff.c index 48f6764117243..32a9dcdf2cb22 100644 --- a/net/core/skbuff.c +++ b/net/core/skbuff.c @@ -3114,9 +3114,27 @@ EXPORT_SYMBOL(skb_copy_bits); */ static void sock_spd_release(struct splice_pipe_desc *spd, unsigned int i) { - put_page(spd->pages[i]); + netmem_dec_ref(page_to_netmem(spd->pages[i])); } +static void skb_pipe_buf_release(struct pipe_inode_info *pipe, + struct pipe_buffer *buf) +{ + netmem_dec_ref(page_to_netmem(buf->page)); +} + +static bool skb_pipe_buf_get(struct pipe_inode_info *pipe, + struct pipe_buffer *buf) +{ + netmem_inc_ref(page_to_netmem(buf->page)); + return true; +} + +static const struct pipe_buf_operations skb_pipe_buf_ops = { + .release = skb_pipe_buf_release, + .get = skb_pipe_buf_get, +}; + static struct page *linear_to_page(struct page *page, unsigned int *len, unsigned int *offset, struct sock *sk) @@ -3165,7 +3183,7 @@ static bool spd_fill_page(struct splice_pipe_desc *spd, struct page *page, spd->partial[spd->nr_pages - 1].len += *len; return false; } - get_page(page); + netmem_inc_ref(page_to_netmem(page)); spd->pages[spd->nr_pages] = page; spd->partial[spd->nr_pages].len = *len; spd->partial[spd->nr_pages].offset = offset; @@ -3281,7 +3299,7 @@ int skb_splice_bits(struct sk_buff *skb, struct sock *sk, unsigned int offset, .pages = pages, .partial = partial, .nr_pages_max = MAX_SKB_FRAGS, - .ops = &nosteal_pipe_buf_ops, + .ops = &skb_pipe_buf_ops, .spd_release = sock_spd_release, }; int ret = 0; @@ -4692,8 +4710,8 @@ int skb_append_pagefrags(struct sk_buff *skb, struct page *page, skb_frag_size_add(&skb_shinfo(skb)->frags[i - 1], size); } else if (i < max_frags) { skb_zcopy_downgrade_managed(skb); - get_page(page); skb_fill_page_desc_noacc(skb, i, page, offset, size); + skb_frag_ref(skb, i); } else { return -EMSGSIZE; } -- 2.56.0.385.gac671c819a-goog