]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
net/mlx5e: kTLS, Fix incorrect page refcounting
authorDragos Tatulea <dtatulea@nvidia.com>
Thu, 7 Nov 2024 18:35:24 +0000 (20:35 +0200)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sat, 14 Dec 2024 18:47:38 +0000 (19:47 +0100)
commitffad2ac8c859c1c1a981fe9c4f7ff925db684a43
tree38ffd631a195a6f393c7134e97e76bf2c968d70b
parenta508c74ceae2f5a4647f67c362126516d6404ed9
net/mlx5e: kTLS, Fix incorrect page refcounting

[ Upstream commit dd6e972cc5890d91d6749bb48e3912721c4e4b25 ]

The kTLS tx handling code is using a mix of get_page() and
page_ref_inc() APIs to increment the page reference. But on the release
path (mlx5e_ktls_tx_handle_resync_dump_comp()), only put_page() is used.

This is an issue when using pages from large folios: the get_page()
references are stored on the folio page while the page_ref_inc()
references are stored directly in the given page. On release the folio
page will be dereferenced too many times.

This was found while doing kTLS testing with sendfile() + ZC when the
served file was read from NFS on a kernel with NFS large folios support
(commit 49b29a573da8 ("nfs: add support for large folios")).

Fixes: 84d1bb2b139e ("net/mlx5e: kTLS, Limit DUMP wqe size")
Signed-off-by: Dragos Tatulea <dtatulea@nvidia.com>
Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
Link: https://patch.msgid.link/20241107183527.676877-5-tariqt@nvidia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls_tx.c