On Wed, 2025-10-22 at 16:31 +0200, Paolo Abeni wrote:
> In the MPTCP receive path, we release the subflow allocated
> fwd memory just to allocate it again shortly after for the msk.
>
> That could increases the failures chances, especially during
> backlog processing, when other actions could consume the just
> released memory before the msk socket has a chance to do the
> rcv allocation.
>
> Replace the skb_orphan() call with an open-coded variant that
> explicitly borrows, with a PAGE_SIZE granularity, the fwd memory
> from the subflow socket instead of releasing it. During backlog
> processing the borrowed memory is accounted at release_cb time.
>
> Signed-off-by: Paolo Abeni <pabeni@redhat.com>
> ---
> v1 -> v2:
> - rebased
> - explain why skb_orphan is removed
> ---
> net/mptcp/protocol.c | 19 +++++++++++++++----
> 1 file changed, 15 insertions(+), 4 deletions(-)
>
> diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c
> index 804227736638e3..372ae2d9fd229e 100644
> --- a/net/mptcp/protocol.c
> +++ b/net/mptcp/protocol.c
> @@ -337,11 +337,12 @@ static void mptcp_data_queue_ofo(struct
> mptcp_sock *msk, struct sk_buff *skb)
> mptcp_rcvbuf_grow(sk);
> }
>
> -static void mptcp_init_skb(struct sock *ssk, struct sk_buff *skb,
> int offset,
> - int copy_len)
> +static int mptcp_init_skb(struct sock *ssk,
> + struct sk_buff *skb, int offset, int
> copy_len)
nit:
int mptcp_init_skb(struct sock *ssk, struct sk_buff *skb, int offset,
int copy_len)
is better.
> {
> const struct mptcp_subflow_context *subflow =
> mptcp_subflow_ctx(ssk);
> bool has_rxtstamp = TCP_SKB_CB(skb)->has_rxtstamp;
> + int borrowed;
>
> /* the skb map_seq accounts for the skb offset:
> * mptcp_subflow_get_mapped_dsn() is based on the current
> tp->copied_seq
> @@ -357,6 +358,13 @@ static void mptcp_init_skb(struct sock *ssk,
> struct sk_buff *skb, int offset,
>
> skb_ext_reset(skb);
> skb_dst_drop(skb);
> +
> + /* "borrow" the fwd memory from the subflow, instead of
> reclaiming it */
> + skb->destructor = NULL;
> + borrowed = ssk->sk_forward_alloc -
> sk_unused_reserved_mem(ssk);
> + borrowed &= ~(PAGE_SIZE - 1);
> + sk_forward_alloc_add(ssk, skb->truesize - borrowed);
> + return borrowed;
> }
>
> static bool __mptcp_move_skb(struct sock *sk, struct sk_buff *skb)
> @@ -690,9 +698,12 @@ static bool
> __mptcp_move_skbs_from_subflow(struct mptcp_sock *msk,
>
> if (offset < skb->len) {
> size_t len = skb->len - offset;
> + int bmem;
>
> - mptcp_init_skb(ssk, skb, offset, len);
> - skb_orphan(skb);
> + bmem = mptcp_init_skb(ssk, skb, offset,
> len);
> + skb->sk = NULL;
> + sk_forward_alloc_add(sk, bmem);
> + atomic_sub(skb->truesize, &ssk-
> >sk_rmem_alloc);
> ret = __mptcp_move_skb(sk, skb) || ret;
> seq += len;
>