[PATCH net-next v2 01/10] net: skbuff: add skb_drop_empty_frags()
flat view
WARM2d
From: Josef Bacik <josef@toxicpanda.com>
Date: 2026-10-08 21:03:24
Also in:
intel-wired-lan, linux-rdma, lkml, xen-devel
Subsystem:
networking [general], the rest · Maintainers:
"David S. Miller", Eric Dumazet, Jakub Kicinski, Paolo Abeni, Linus Torvalds
Revision v2 of 2 in this series.
Revisions (2)
- v1 [diff vs current]
- v2 current
__pskb_pull_tail() releases every zero-length page frag as it walks the
frags array, even when it's asked to pull nothing. Some drivers depend
on that. xen-netfront calls it with a zero count on purpose to make
room when a backend fills the frags with empty slots, see commit
d81c5054a5d1 ("xen/netfront: tolerate frags with no data"). netxen and
qlcnic get the same effect when the frags they pull to fit a TX
descriptor happen to be empty.
pskb_may_pull() returns before getting there when the head already
holds the requested length, so these drivers can't simply switch to
it. Add skb_drop_empty_frags() to do just that part, unsharing the skb
first if it's cloned like __pskb_pull_tail() does.
Assisted-by: LLM
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
---
include/linux/skbuff.h | 1 +
net/core/skbuff.c | 40 ++++++++++++++++++++++++++++++++++++++++
2 files changed, 41 insertions(+)
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index 27ec1e38c828..c1295f6baf6d 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h@@ -2840,6 +2840,7 @@ static inline void *skb_pull_inline(struct sk_buff *skb, unsigned int len) void *skb_pull_data(struct sk_buff *skb, size_t len); void *__pskb_pull_tail(struct sk_buff *skb, int delta); +int skb_drop_empty_frags(struct sk_buff *skb, gfp_t gfp); static __always_inline enum skb_drop_reason pskb_may_pull_reason(struct sk_buff *skb, unsigned int len)
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 43ebe61c7fc4..f798118df112 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c@@ -3004,6 +3004,46 @@ void *__pskb_pull_tail(struct sk_buff *skb, int delta) } EXPORT_SYMBOL(__pskb_pull_tail); +/** + * skb_drop_empty_frags - release the zero-length page frags of an skb + * @skb: buffer to clean up + * @gfp: allocation priority, used if @skb has to be unshared + * + * Releases every page frag of @skb that holds no data and closes up + * the frags array, so the remaining frags keep their order. The + * frag_list is left alone. A cloned @skb is unshared first, since + * the frags array is shared between clones. + * + * Returns 0 on success, or -ENOMEM if @skb had to be unshared and + * that failed, in which case @skb is unchanged. + */ +int skb_drop_empty_frags(struct sk_buff *skb, gfp_t gfp) +{ + struct skb_shared_info *shinfo = skb_shinfo(skb); + int i, k; + + for (i = 0; i < shinfo->nr_frags; i++) + if (!skb_frag_size(&shinfo->frags[i])) + break; + if (i == shinfo->nr_frags) + return 0; + + if (skb_unclone(skb, gfp)) + return -ENOMEM; + + shinfo = skb_shinfo(skb); + for (i = 0, k = 0; i < shinfo->nr_frags; i++) { + if (!skb_frag_size(&shinfo->frags[i])) { + skb_frag_unref(skb, i); + continue; + } + shinfo->frags[k++] = shinfo->frags[i]; + } + shinfo->nr_frags = k; + return 0; +} +EXPORT_SYMBOL(skb_drop_empty_frags); + /** * skb_copy_bits - copy bits from skb to kernel buffer * @skb: source skb
--
2.55.0