Commit 6de1dec1 authored by Eric Dumazet's avatar Eric Dumazet Committed by Paolo Abeni
Browse files

udp: do not use skb_release_head_state() before skb_attempt_defer_free() 



Michal reported and bisected an issue after recent adoption
of skb_attempt_defer_free() in UDP.

The issue here is that skb_release_head_state() is called twice per skb,
one time from skb_consume_udp(), then a second time from skb_defer_free_flush()
and napi_consume_skb().

As Sabrina suggested, remove skb_release_head_state() call from
skb_consume_udp().

Add a DEBUG_NET_WARN_ON_ONCE(skb_nfct(skb)) in skb_attempt_defer_free()

Many thanks to Michal, Sabrina, Paolo and Florian for their help.

Fixes: 6471658d ("udp: use skb_attempt_defer_free()")
Reported-and-bisected-by: default avatarMichal Kubecek <mkubecek@suse.cz>
Closes: https://lore.kernel.org/netdev/gpjh4lrotyephiqpuldtxxizrsg6job7cvhiqrw72saz2ubs3h@g6fgbvexgl3r/


Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
Tested-by: default avatarMichal Kubecek <mkubecek@suse.cz>
Cc: Sabrina Dubroca <sd@queasysnail.net>
Cc: Florian Westphal <fw@strlen.de>
Reviewed-by: default avatarSabrina Dubroca <sd@queasysnail.net>
Link: https://patch.msgid.link/20251015052715.4140493-1-edumazet@google.com


Signed-off-by: default avatarPaolo Abeni <pabeni@redhat.com>
parent 8d93ff40

net/core/skbuff.c

+1 −0
Original line number Diff line number Diff line
@@ -7200,6 +7200,7 @@ nodefer: kfree_skb_napi_cache(skb); 


	DEBUG_NET_WARN_ON_ONCE(skb_dst(skb));

	DEBUG_NET_WARN_ON_ONCE(skb->destructor);

	DEBUG_NET_WARN_ON_ONCE(skb_nfct(skb));



	sdn = per_cpu_ptr(net_hotdata.skb_defer_nodes, cpu) + numa_node_id();

net/ipv4/udp.c

+0 −2
Original line number Diff line number Diff line
@@ -1851,8 +1851,6 @@ void skb_consume_udp(struct sock *sk, struct sk_buff *skb, int len) 
		sk_peek_offset_bwd(sk, len);



	if (!skb_shared(skb)) {

		if (unlikely(udp_skb_has_head_state(skb)))

			skb_release_head_state(skb);

		skb_attempt_defer_free(skb);

		return;

	}