From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=74.125.82.69 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1794117622; b=TNOMqFpICqrgk82ensrv3ahQrhSqGLKwB9X5rDuFyXhba2P+5B6GsvNeGlTVnDJPvYKN ZwLC+9VxYKZq3Ttem/pvZ45Bf79zCDXB31xswQ2n9X7vPd+fmEhTmDuM+auWxmeiU/WqM xKgCpdNqVhL0qq08Tfdpx2QMdGfUesj6QFMyTOwPN7KgNwgtjI5gRmbGYtmOefHt4S+VK /rxHgUX7GO3IdvKfH+x0eR9f4sy6a3Zq46QOnynv6x1/gpy/q7CccZP0EhxGPI/boWgUf Xl5dp+KnZt8FbqnrWZq8wySG/Tk1MX8I5a+i3BGTNyVT3U9B2ptBTgF/aczxmEfYouw== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1794117622; h=DMARC-Filter:Received:DKIM-Signature:X-Google-DKIM-Signature: X-Forwarded-Encrypted:X-Gm-Message-State:X-Received:Date:In-Reply-To: Mime-Version:References:X-Mailer:Message-ID:Subject:From:To:Cc: Content-Type; bh=gFMZKE8rB1qHEs9YGj4+e/8ZQgkxp9yc4uMWlT943Dk=; b=KcmCT4HjjYj1GiqNZw7z3E6By4wM07Vtd5v/nrgER2rKObP+7Jcw0qeXXew/EIz+syVe tx5S79KbhG0LMeuzZXgJZNULoShj1Y6JaHDrhD3MeoUNMGuE1xVZQfhq5oPAGQF2zSxT+ fPMFKwHROBzfec+mE7ghnzZzdTfG9as9kDCHfbtua7UCE6Tv2nfHQBFXhBuvW1YkEJIWE A7uohPq45tp3XPLaHliN7d9EUbYbG6dFM9UkzTOzr1T+Rcz3kIaDtPyru0YRf0Q5jZ8Jj Mo8IBoh9+ZmX+LzLUAO+z/TX/8SsJTm1j4tsCBr9JBh+W+/vqspxketYnk+A0Hgv+VA== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass header.from=google.com; spf=pass smtp.mailfrom=flex--almasrymina.bounces.google.com; dkim=pass header.d=google.com header.i=@google.com header.a=rsa-sha256 header.s=20260707 header.b=NpT9AOZ5; arc=none smtp.remote-ip=74.125.82.69 Received: from mail-dl1-f69.google.com (mail-dl1-f69.google.com [74.125.82.69]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature ECDSA (prime256v1) server-digest SHA256) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 38642606D813 for ; Sun, 8 Nov 2026 06:00:22 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.2 smtp.subspace.kernel.org 38642606D813 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--almasrymina.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.a=rsa-sha256 header.s=20260707 header.b=NpT9AOZ5 Received: by mail-dl1-f69.google.com with SMTP id a92af1059eb24-1b238436265so61511c88.1 for ; Sat, 07 Nov 2026 22:00:22 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20260707; t=1794117621; x=1794722421; darn=vger.kernel.org; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:from:to:cc:subject:date:message-id:reply-to :content-type; bh=gFMZKE8rB1qHEs9YGj4+e/8ZQgkxp9yc4uMWlT943Dk=; b=NpT9AOZ5Md2YhJthgKisZgdg2A4MZVYGgCZ8bh9fcc+f2x20rDpG89VKosLx6fGq77 WT6EFTF2b2ciBsGXUnYEEbAa72fGUAEY3yq6P0ibYXhxVhTjMcTphKcPp6asKIZIKvip daj9yrctnzyUz7t5z2HVffndtBgF1S+9Ro2obX98CPEcmQNVJDYlkFA/oKqq2pqbf3te QJQ1lQ4UWdvz12HYNS/t14EIRIqOmj93uAINlpNFQPua9/8Q/do1FI4tye+NGV6ilZdn olC2C+esw3M4R+/pu/yJo4KNX6GbwpGtNz8bxNvbKXSA9EchEp/zeiqpytaO+UKs4PmQ 0WSg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1794117621; x=1794722421; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=gFMZKE8rB1qHEs9YGj4+e/8ZQgkxp9yc4uMWlT943Dk=; b=2FrRnKtMulC4hoGKyluL8btPKKpuqzTkbR1+Uf1Ft/27WtZX8xplaz5FdogZhj4RPh UsGvAVCbQmdrrV7BgHMO+cpKQN9+DPuCQk9DGtGFoygz2pGNHxd2kmVdzBnulX0GrlJ+ /qzxfa1QZxGL/SeFhhjcfyZ20yxIvubXAwqA0fd+YovyD9BgfvpsQLyfvm7hFAITLWZO yvBllndYuBgUJWkWsMRDjpfKuXaBJBeDA0kfsgfAlUmeOZ0xas2Ao/x/wvEZN2zqU7VA xf/Ey2w3WmQMlbKZ88WOO78MuTobTv1RR91HCK6zJpjhXtx9ytQY7actO09BxyBSOBxr qOEQ== X-Forwarded-Encrypted: i=1; AKwUvBzBWGcA6bqKf2iOP2tmPBGXfa4tFLYqzafD2EOTTnxsG9fVa7av55mZCAqIk7Oc1HscvbmGtQqMzgpVza4=@vger.kernel.org X-Gm-Message-State: APuU4Z9d87A84916TfgA/HnjPHkOeCzb5xG8I//8MytXD1DB5gTMa3+c Xjr/0UDB0zT3AM+G8xgdcpQAicv3UqaEl+ePrSo8/VjL4MwM8DV+0a4jHhYqfO18zAXlIgkcO8I CtfSODBzsWvZKakC5ovEmdPLoKQ== X-Received: from dlev11.prod.google.com ([2002:a05:701b:464b:b0:189:931c:18ef]) (user=almasrymina job=prod-delivery.src-stubby-dispatcher) by 2002:a05:7022:e02:b0:191:3c:aae7 with SMTP id a92af1059eb24-1b39feec174mr1478394c88.26.1794117620448; Sat, 07 Nov 2026 22:00:20 -0800 (PST) Date: Sun, 8 Nov 2026 06:00:13 +0000 In-Reply-To: <20261108060016.2131509-1-almasrymina@google.com> X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list Mime-Version: 1.0 References: <20261108060016.2131509-1-almasrymina@google.com> X-Mailer: git-send-email 2.56.0.455.g6c5a503b38-goog Message-ID: <20261108060016.2131509-3-almasrymina@google.com> Subject: [PATCH net-next v2 2/5] net: skbuff: refcount spliced page_pool frags via skb_pipe_buf_ops From: Mina Almasry To: netdev@vger.kernel.org Cc: Mina Almasry , Jesper Dangaard Brouer , Ilias Apalodimas , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , Neal Cardwell , Kuniyuki Iwashima , Pavel Begunkov , Bobby Eshleman , Stanislav Fomichev , linux-kernel@vger.kernel.org, Steffen Klassert , Herbert Xu , Willem de Bruijn , John Fastabend , Sabrina Dubroca , Andrew Lunn , "Michael S. Tsirkin" , Jason Wang , "=?UTF-8?q?Eugenio=20P=C3=A9rez?=" , Xuan Zhuo , Andrew Morton , David Hildenbrand , Lorenzo Stoakes , "Liam R. Howlett" , Vlastimil Babka , Mike Rapoport , Suren Baghdasaryan , Michal Hocko , Alexei Starovoitov , Daniel Borkmann , Johannes Berg , Byungchul Park , Zi Yan , virtualization@lists.linux.dev, linux-mm@kvack.org, bpf@vger.kernel.org, linux-wireless@vger.kernel.org, Jonathan Corbet , Shuah Khan , Randy Dunlap , Lorenzo Bianconi , Wen Gu , Philo Lu , Justin Chen , Florian Fainelli , Vikas Gupta , Michael Chan , Pavan Chebbi , Doug Berger , Nicolai Buchwitz , Broadcom internal kernel review list , Satish Kharat , Wei Fang , Frank Li , Shenwei Wang , Joshua Washington , Harshitha Ramamurthy , Jijie Shao , Jian Shen , Fan Gong , Tony Nguyen , Przemek Kitszel , Marcin Wojtas , Russell King , Sunil Goutham , Geetha sowjanya , Ratheesh Kannoth , Subbaraya Sundeep , Bharat Bhushan , Felix Fietkau , Matthias Brugger , AngeloGioacchino Del Regno , Tariq Toukan , Saeed Mahameed , Mark Bloch , Leon Romanovsky , Ido Schimmel , Petr Machata , Horatiu Vultur , UNGLinuxDriver@microchip.com, Daniel Machon , Steen Hegelund , Haiyang Zhang , Wei Liu , Dexuan Cui , Yibo Dong , Brett Creeley , Justin Lai , Larry Chiu , "=?UTF-8?q?Niklas=20S=C3=B6derlund?=" , Paul Barker , Masahisa Kojima , Maxime Chevallier , Maxime Coquelin , Alexandre Torgue , FUJITA Tomonori , Siddharth Vadapalli , Roger Quadros , MD Danish Anwar , Jiawen Wu , Mengyuan Lou , Ronak Doshi , Ryder Lee , Shayne Chen , Sean Wang , Juergen Gross , Stefano Stabellini , Oleksandr Tyshchenko , Jordan Rhee , Ankit Garg , Tim Hostetler , Eric Joyner , Prabu Thayalan , "Nikhil P. Rao" , Chintan Vankar , Nora Schiffer , Alexander Sverdlin , Kevin Hao , Karl Mehltretter , Aleksandr Loktionov , Meghana Malladi , Jacob Keller , StanleyYP Wang , linux-doc@vger.kernel.org, imx@lists.linux.dev, linux-rdma@vger.kernel.org, linux-hyperv@vger.kernel.org, linux-renesas-soc@vger.kernel.org, linux-omap@vger.kernel.org Content-Type: text/plain; charset="UTF-8" Update skb_splice_bits() (spd_fill_page(), sock_spd_release(), and skb_pipe_buf_ops) and skb_append_pagefrags() to acquire and release references via netmem_inc_ref(), netmem_dec_ref(), and skb_frag_ref() so page_pool RX fragments spliced into a pipe remain pinned in the pool while in the pipe and pair with skb_append_pagefrags() and skb_release_data() when spliced into a TX socket once netmem_inc_ref() and netmem_dec_ref() handle page_pool netmems. In tls_push_data(), fall back to copying when MSG_SPLICE_PAGES encounters a page_pool page because kTLS device offload record->frags[] tracks pages via raw struct page references rather than pp_ref_count before handing them to tls_push_sg(). Caveats: - Because pipe buffers created by skb_splice_bits() hold pp_ref_count until released (including across tee()), user pipes holding unconsumed spliced data keep those page_pool pages in-flight and DMA-mapped in the pool (bounded by pipe capacity and RLIMIT_NOFILE rather than sk_rcvbuf) until the pipe buffers are consumed or closed, with page_pool_destroy() deferring pool release via its periodic workqueue and page_pool_scrub() unmapping DMA. Signed-off-by: Mina Almasry --- net/core/skbuff.c | 31 +++++++++++++++++++++++++++---- net/tls/tls_device.c | 6 ++++++ 2 files changed, 33 insertions(+), 4 deletions(-) diff --git a/net/core/skbuff.c b/net/core/skbuff.c index 48f6764117243..19d4ce347c41b 100644 --- a/net/core/skbuff.c +++ b/net/core/skbuff.c @@ -3114,9 +3114,32 @@ EXPORT_SYMBOL(skb_copy_bits); */ static void sock_spd_release(struct splice_pipe_desc *spd, unsigned int i) { - put_page(spd->pages[i]); + netmem_dec_ref(page_to_netmem(spd->pages[i])); } +static void skb_pipe_buf_release(struct pipe_inode_info *pipe, + struct pipe_buffer *buf) +{ + netmem_dec_ref(page_to_netmem(buf->page)); +} + +static bool skb_pipe_buf_get(struct pipe_inode_info *pipe, + struct pipe_buffer *buf) +{ + struct page *page = compound_head(buf->page); + + if (WARN_ON_ONCE(page_ref_count(page) <= 0)) + return false; + + netmem_inc_ref(page_to_netmem(page)); + return true; +} + +static const struct pipe_buf_operations skb_pipe_buf_ops = { + .release = skb_pipe_buf_release, + .get = skb_pipe_buf_get, +}; + static struct page *linear_to_page(struct page *page, unsigned int *len, unsigned int *offset, struct sock *sk) @@ -3165,7 +3188,7 @@ static bool spd_fill_page(struct splice_pipe_desc *spd, struct page *page, spd->partial[spd->nr_pages - 1].len += *len; return false; } - get_page(page); + netmem_inc_ref(page_to_netmem(page)); spd->pages[spd->nr_pages] = page; spd->partial[spd->nr_pages].len = *len; spd->partial[spd->nr_pages].offset = offset; @@ -3281,7 +3304,7 @@ int skb_splice_bits(struct sk_buff *skb, struct sock *sk, unsigned int offset, .pages = pages, .partial = partial, .nr_pages_max = MAX_SKB_FRAGS, - .ops = &nosteal_pipe_buf_ops, + .ops = &skb_pipe_buf_ops, .spd_release = sock_spd_release, }; int ret = 0; @@ -4692,8 +4715,8 @@ int skb_append_pagefrags(struct sk_buff *skb, struct page *page, skb_frag_size_add(&skb_shinfo(skb)->frags[i - 1], size); } else if (i < max_frags) { skb_zcopy_downgrade_managed(skb); - get_page(page); skb_fill_page_desc_noacc(skb, i, page, offset, size); + skb_frag_ref(skb, i); } else { return -EMSGSIZE; } diff --git a/net/tls/tls_device.c b/net/tls/tls_device.c index 4cdfbb57ecff0..05abf8e23f78a 100644 --- a/net/tls/tls_device.c +++ b/net/tls/tls_device.c @@ -513,10 +513,16 @@ static int tls_push_data(struct sock *sk, goto handle_error; } + if (page_pool_page_is_pp(compound_head(*pages))) { + iov_iter_revert(iter, copy); + goto copy_data; + } + zc_pfrag.offset = off; zc_pfrag.size = copy; tls_append_frag(record, &zc_pfrag, copy); } else if (copy) { +copy_data: copy = min_t(size_t, copy, pfrag->size - pfrag->offset); rc = tls_device_copy_data(page_address(pfrag->page) + -- 2.56.0.455.g6c5a503b38-goog