[PATCH net-next v2 01/10] net: skbuff: add skb_drop_empty_frags()

[Josef Bacik <josef@xxxxxxxxxxxxxx>]

__pskb_pull_tail() releases every zero-length page frag as it walks the
frags array, even when it's asked to pull nothing.  Some drivers depend
on that.  xen-netfront calls it with a zero count on purpose to make
room when a backend fills the frags with empty slots, see commit
d81c5054a5d1 ("xen/netfront: tolerate frags with no data").  netxen and
qlcnic get the same effect when the frags they pull to fit a TX
descriptor happen to be empty.

pskb_may_pull() returns before getting there when the head already
holds the requested length, so these drivers can't simply switch to
it.  Add skb_drop_empty_frags() to do just that part, unsharing the skb
first if it's cloned like __pskb_pull_tail() does.

Assisted-by: LLM
Signed-off-by: Josef Bacik <josef@xxxxxxxxxxxxxx>
---
 include/linux/skbuff.h |  1 +
 net/core/skbuff.c      | 40 ++++++++++++++++++++++++++++++++++++++++
 2 files changed, 41 insertions(+)

diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index 27ec1e38c828..c1295f6baf6d 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -2840,6 +2840,7 @@ static inline void *skb_pull_inline(struct sk_buff *skb, 
unsigned int len)
 void *skb_pull_data(struct sk_buff *skb, size_t len);
 
 void *__pskb_pull_tail(struct sk_buff *skb, int delta);
+int skb_drop_empty_frags(struct sk_buff *skb, gfp_t gfp);
 
 static __always_inline enum skb_drop_reason
 pskb_may_pull_reason(struct sk_buff *skb, unsigned int len)
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 43ebe61c7fc4..f798118df112 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -3004,6 +3004,46 @@ void *__pskb_pull_tail(struct sk_buff *skb, int delta)
 }
 EXPORT_SYMBOL(__pskb_pull_tail);
 
+/**
+ *     skb_drop_empty_frags - release the zero-length page frags of an skb
+ *     @skb: buffer to clean up
+ *     @gfp: allocation priority, used if @skb has to be unshared
+ *
+ *     Releases every page frag of @skb that holds no data and closes up
+ *     the frags array, so the remaining frags keep their order.  The
+ *     frag_list is left alone.  A cloned @skb is unshared first, since
+ *     the frags array is shared between clones.
+ *
+ *     Returns 0 on success, or -ENOMEM if @skb had to be unshared and
+ *     that failed, in which case @skb is unchanged.
+ */
+int skb_drop_empty_frags(struct sk_buff *skb, gfp_t gfp)
+{
+       struct skb_shared_info *shinfo = skb_shinfo(skb);
+       int i, k;
+
+       for (i = 0; i < shinfo->nr_frags; i++)
+               if (!skb_frag_size(&shinfo->frags[i]))
+                       break;
+       if (i == shinfo->nr_frags)
+               return 0;
+
+       if (skb_unclone(skb, gfp))
+               return -ENOMEM;
+
+       shinfo = skb_shinfo(skb);
+       for (i = 0, k = 0; i < shinfo->nr_frags; i++) {
+               if (!skb_frag_size(&shinfo->frags[i])) {
+                       skb_frag_unref(skb, i);
+                       continue;
+               }
+               shinfo->frags[k++] = shinfo->frags[i];
+       }
+       shinfo->nr_frags = k;
+       return 0;
+}
+EXPORT_SYMBOL(skb_drop_empty_frags);
+
 /**
  *     skb_copy_bits - copy bits from skb to kernel buffer
  *     @skb: source skb

-- 
2.55.0