net/sched: fix packet reordering on requeue

dev_requeue_skb() appends requeued skbs to the tail of q->gso_skb, while
dequeue_skb() takes them back one at a time from the head. If the driver
returns NETDEV_TX_BUSY again for the first of them, it moves behind the
skbs still parked there and is sent after them.

This showed up as heavy TCP reordering while benchmarking over veth,
which returns NETDEV_TX_BUSY whenever its ring is full since
commit dc82a33297 ("veth: apply qdisc backpressure on full ptr_ring to reduce TX drops").

Requeue the skbs at the head of gso_skb, keeping their order. With 4 TCP
streams over a veth pair with a pfifo qdisc, this removes about 1.3M
out-of-order segments and 15-37k retransmits per 15 seconds, and raises
throughput from about 40 to 76 Gbit/s.

Fixes: a53851e2c3 ("net: sched: explicit locking in gso_cpu fallback")
Fixes: 9540d97761 ("net: sched: fix skb leak in dev_requeue_skb()")
Cc: stable@vger.kernel.org
Signed-off-by: Antonio Quartulli <antonio@mandelbit.com>
Reviewed-by: Eric Dumazet <edumazet@kernel.org>
Acked-by: Jesper Dangaard Brouer <hawk@kernel.org>
Link: https://patch.msgid.link/20261026153113.3275494-1-antonio@mandelbit.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
This commit is contained in:
Antonio Quartulli 2026-10-26 16:31:12 +01:00 committed by Jakub Kicinski
parent 7cceaba6ff
commit 14368b9aa1

View File

@ -168,8 +168,11 @@ static inline void qdisc_enqueue_skb_bad_txq(struct Qdisc *q,
static inline void dev_requeue_skb(struct sk_buff *skb, struct Qdisc *q)
{
struct sk_buff_head requeue;
spinlock_t *lock = NULL;
__skb_queue_head_init(&requeue);
if (q->flags & TCQ_F_NOLOCK) {
lock = qdisc_lock(q);
spin_lock(lock);
@ -178,7 +181,7 @@ static inline void dev_requeue_skb(struct sk_buff *skb, struct Qdisc *q)
while (skb) {
struct sk_buff *next = skb->next;
__skb_queue_tail(&q->gso_skb, skb);
__skb_queue_tail(&requeue, skb);
/* it's still part of the queue */
if (qdisc_is_percpu_stats(q)) {
@ -194,6 +197,11 @@ static inline void dev_requeue_skb(struct sk_buff *skb, struct Qdisc *q)
skb = next;
}
/* the skbs may come from the head of gso_skb, so put them back there:
* appending them would let the ones still parked overtake them
*/
skb_queue_splice(&requeue, &q->gso_skb);
if (lock) {
spin_unlock(lock);
set_bit(__QDISC_STATE_MISSED, &q->state);