| From 8550ff8d8c75416e984d9c4b082845e57e560984 Mon Sep 17 00:00:00 2001 |
| From: Paul Blakey <paulb@nvidia.com> |
| Date: Mon, 5 Jul 2021 13:54:51 +0300 |
| Subject: skbuff: Release nfct refcount on napi stolen or re-used skbs |
| |
| From: Paul Blakey <paulb@nvidia.com> |
| |
| commit 8550ff8d8c75416e984d9c4b082845e57e560984 upstream. |
| |
| When multiple SKBs are merged to a new skb under napi GRO, |
| or SKB is re-used by napi, if nfct was set for them in the |
| driver, it will not be released while freeing their stolen |
| head state or on re-use. |
| |
| Release nfct on napi's stolen or re-used SKBs, and |
| in gro_list_prepare, check conntrack metadata diff. |
| |
| Fixes: 5c6b94604744 ("net/mlx5e: CT: Handle misses after executing CT action") |
| Reviewed-by: Roi Dayan <roid@nvidia.com> |
| Signed-off-by: Paul Blakey <paulb@nvidia.com> |
| Signed-off-by: David S. Miller <davem@davemloft.net> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| --- |
| net/core/dev.c | 13 +++++++++++++ |
| net/core/skbuff.c | 1 + |
| 2 files changed, 14 insertions(+) |
| |
| --- a/net/core/dev.c |
| +++ b/net/core/dev.c |
| @@ -5981,6 +5981,18 @@ static void gro_list_prepare(const struc |
| diffs = memcmp(skb_mac_header(p), |
| skb_mac_header(skb), |
| maclen); |
| + |
| + diffs |= skb_get_nfct(p) ^ skb_get_nfct(skb); |
| + |
| + if (!diffs) { |
| + struct tc_skb_ext *skb_ext = skb_ext_find(skb, TC_SKB_EXT); |
| + struct tc_skb_ext *p_ext = skb_ext_find(p, TC_SKB_EXT); |
| + |
| + diffs |= (!!p_ext) ^ (!!skb_ext); |
| + if (!diffs && unlikely(skb_ext)) |
| + diffs |= p_ext->chain ^ skb_ext->chain; |
| + } |
| + |
| NAPI_GRO_CB(p)->same_flow = !diffs; |
| } |
| } |
| @@ -6245,6 +6257,7 @@ static void napi_reuse_skb(struct napi_s |
| skb_shinfo(skb)->gso_type = 0; |
| skb->truesize = SKB_TRUESIZE(skb_end_offset(skb)); |
| skb_ext_reset(skb); |
| + nf_reset_ct(skb); |
| |
| napi->skb = skb; |
| } |
| --- a/net/core/skbuff.c |
| +++ b/net/core/skbuff.c |
| @@ -939,6 +939,7 @@ void __kfree_skb_defer(struct sk_buff *s |
| |
| void napi_skb_free_stolen_head(struct sk_buff *skb) |
| { |
| + nf_reset_ct(skb); |
| skb_dst_drop(skb); |
| skb_ext_put(skb); |
| napi_skb_cache_put(skb); |