Hello, Is skb_gro_receive doing the right thing for cloned packets?
When we are merging fragments, we do not seem to be taking a reference to the underlying page. To me, it looks like it should work fine for non-cloned packets. However, for cloned packets, when the gro-ed packet is eventually freed (because the original skb was not cloned and hence reference was 1), the merged skb's frags also get freed (put_page-ed) without taking into account the other references that were held for the fragments (dataref). We saw crashes because of this behavior. Our setup had a third party kernel forwarding module which uses GRO (napi_gro_receive). Doing iperf3 with small packets and doing tcpdump on the receiving tap interface results in the problem. With DEBUG_VM enabled, put page crashes. Without DEBUG_VM, bad page state results. Your thoughts (please CC me, since I am not part of this list). Thanks, Anand
