[PATCH net] virtio_net: skip Rx refill when polled by netpoll

[Breno Leitao <leitao@debian.org>]

We are seeing pp_ref_count underflow warnings on virtio_net hosts with
heavy netconsole traffic, followed by general protection faults in
napi_consume_skb() on frag addresses made of packet data, when
skb_defer_free_flush() frees the corrupted skbs:

  WARNING: ./include/net/page_pool/helpers.h:297 at page_pool_alloc_frag_netmem+0x1d9/0x230, CPU#540: swapper/540/0
  Call Trace:
   <IRQ>
   try_fill_recv+0x399/0x940
   virtnet_poll+0x538/0xc10
   net_rx_action+0x21d/0x610
   irq_exit_rcu+0xf9/0x3a0
   common_interrupt+0x85/0x90
   </IRQ>

The theory is that virtnet_poll() refills the Rx ring when netpoll
calls it. netpoll polls NAPI with a zero budget to reclaim Tx buffers,
on whatever CPU is transmitting, but virtnet_receive() still refills
it.

Since commit 24fbd3967f3f ("virtio_net: add page_pool support for buffer
allocation") that refill allocates from the page pool, which must not be
used with a zero budget (see Documentation/networking/napi.rst).

A reproducer on the net tree supports the theory: an 8-CPU arm64 VM with
QEMU user networking, a netconsole target on the virtio_net device and
three TCP receivers on other CPUs checking a known byte pattern. A
printk flood through netconsole corrupted all three streams within about
three minutes, after which recvmsg() failed with -EFAULT and the same
warning fired. A test kthread calling netpoll_poll_dev() in a loop, as
__netpoll_send_skb() does while the Tx queue is busy, corrupts the
streams within seconds.

Only reclaim Tx when the budget is zero

Fixes: 24fbd3967f3f ("virtio_net: add page_pool support for buffer allocation")
Signed-off-by: Breno Leitao <leitao@debian.org>
---
 drivers/net/virtio_net.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index dd2c41ef6fbe72..9db5ec875c141f 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -3037,6 +3037,9 @@ static int virtnet_poll(struct napi_struct *napi, int budget)
 
 	virtnet_poll_cleantx(rq, budget);
 
+	if (unlikely(!budget))
+		return 0;
+
 	received = virtnet_receive(rq, budget, &xdp_xmit);
 	rq->packets_in_napi += received;
 

---
base-commit: 1d5e2c57e9ffc134e14b3f837c8d7c53b508bd22
change-id: 20261109-virtio-net-netpoll-pp-170f0dc4d6e0

Best regards,
--  
Breno Leitao <leitao@debian.org>