From nobody Mon Jun 8 09:49:32 2026 Received: from mail-pg1-f171.google.com (mail-pg1-f171.google.com [209.85.215.171]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 396893B3BF1 for ; Thu, 4 Jun 2026 11:31:43 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.215.171 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780572704; cv=none; b=eeN+uFb6HCKAWWik4AVlveZK6S7nS1ri/oeBXmW7e0B0xnw3bLh+B6o0UyTZ5EfNNgUI2o3P6Ixkxj1T2JPGQKmHKdEqvzX9l6fUV81GA0viksq3UZxu7wbIbKTKXpiip3ohI64k1fsvq7hIin8m7k+8fOl4n3XZsKAfML1vJso= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780572704; c=relaxed/simple; bh=LyyIlg3QPX1rQJHGpgzEqbAUkTXPZTiK+PQ73NyhaYc=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=OJobvaBZ2GulXm1uDLP6Yo1zt+8YaD9lUInfyRQ+lXSRfstBVL6u/6piHKMn/OGeZmst8KHg715edOzpc7CihkdMdosKdE1yyHfv1kqYLvpjqahfgzR8OezBXroommEVw505sXuJvBvdTGgdOtjESInyViRYQtH6mC2887ZKiFY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=pSR8395E; arc=none smtp.client-ip=209.85.215.171 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="pSR8395E" Received: by mail-pg1-f171.google.com with SMTP id 41be03b00d2f7-c8532ba6c95so213297a12.0 for ; Thu, 04 Jun 2026 04:31:43 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1780572702; x=1781177502; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=aWJU4AISHJoKW2jVY+HLmgCpe1wG/GRzkKLWOkBA9NQ=; b=pSR8395EYeg876uScrRj3WexBnuPB3+AmQJttzO2xqjXClIJWFxNcK5EDBg1mmy5K7 HxcqDZGkfbgPECLth7Y0RmlQhvoJM3LRJkS6piZOUU99xRikWKe/xfw/l4LmaKixw73R 9unVJ/uRhnbI5kLnaVwe2PNIvhHQKWvb+De+++RwLXAlxdllDbCYN4nMGcErDp+DcSEH MNzyYS0YYRdA2NPPHmRxGNbuXTTqNtwg8X9KvIGQHWgCcEPIa7H9mLEZUCveiQZ24apR QV69GuwFDgEkuwFCKZIEy5RzeHfZWw9oz+8xSnuX0Q+vq1P/SwteIrHXQDRY92pvPNRL MA4Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1780572702; x=1781177502; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=aWJU4AISHJoKW2jVY+HLmgCpe1wG/GRzkKLWOkBA9NQ=; b=H4zNZUSu4cSipoApwPacnb7eUZBDtEf4auvBp5SLhGz+ngIS+yDw2yxm+yUzxMyRWH 0w+ohe0CzHL2OmXrE6Keem6hqwvF9VGMxf/XEfBDUFhDVWlJlVS5bSLK0eJPE7DjlQ5k VX4fRlzUSldd+BdVCQUEbzv8Jw1Wc0ThSJ6ZkzlsdXshLTFH0xw3Q5apQl0CyASeh8K+ nWOdLIP9ELTpTN2g69zGSJwuHdxjMRlM8u8IqQVRO/akK0u/c2jln0fI1kFKj/tEmF2/ nFsoY0guIvV6XTDlAiiBMGdw2ruEqCSS88RVfoJhyuzqOuwK8dH27ENXSm8Y+DZcxaOW V2WA== X-Forwarded-Encrypted: i=1; AFNElJ/As9gVRHlYhvzQhQzS+Fv/sp64toC7VZphmCZCbeuTQd0oEmDh/fN+Vqwv6jFu4SlyZ/rl/F9ae7EEXMU=@vger.kernel.org X-Gm-Message-State: AOJu0YzFo0c3ZejAfdnk6UuEdaK54ZgjU9ysJBXWvNkTmCU7l4sUgUJW 6IodPSbhUedHOmEhy0F535kFsModXaqcRmqK8Xl+dKI2Ph5eB3STfmMc X-Gm-Gg: Acq92OFaUcuElIcmTDaWbK180CjMnDdJNfESbJdvKY+S2UyCoEh58t3RKJG2sm6+uwQ FhUwnq3lhT1mug8M86olxwC+8o2yjAepyBpyGRuEJtvxRXlUHe8U0tnGsPOudBIWkxvjRUcQdC4 21Nu2ntFLmyUSzxXlL1bRlxDnjUbnqMjEmzuXUPcNNHB+dd3e0hjhgL18zlU5CsZduWQHZ5cFli B5hg0gOHieFLRvRE5gaMmxYU25j3R6FZenWnw0/PnYexj+wnM9lIzR1jVU/XQ4JeOETQrUr/sfz TE1KOVeCDavd5MlVPxlupixpziSM/PZx3pQGlx4uXN+rotN9/gX4YVATs/JhTyIZ4Oowl7vf3wV E4LwucYOVe1pmX5sfdMvMpVrNv5Tc+cFpOdt4qPyCee+kQZaUNsv4tfcGYcoQwYGANIFib2U5ez ZZUoiovSvJ/u+k02H9GfXqMNDJZrw= X-Received: by 2002:a05:6a21:2212:b0:3a2:f7bd:a9a5 with SMTP id adf61e73a8af0-3b4979e946fmr8507751637.38.1780572702468; Thu, 04 Jun 2026 04:31:42 -0700 (PDT) Received: from lgs.. ([2001:250:5800:1000::f280]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-8428221c3e4sm6124968b3a.5.2026.06.04.04.31.36 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 04 Jun 2026 04:31:42 -0700 (PDT) From: Guangshuo Li To: Horatiu Vultur , UNGLinuxDriver@microchip.com, Andrew Lunn , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Alexei Starovoitov , Daniel Borkmann , Jesper Dangaard Brouer , John Fastabend , Stanislav Fomichev , David Carlier , netdev@vger.kernel.org, linux-kernel@vger.kernel.org, bpf@vger.kernel.org Cc: Guangshuo Li Subject: [PATCH] net: lan966x: restore XDP RXQ page pool on reload failure Date: Thu, 4 Jun 2026 19:28:46 +0800 Message-ID: <20260604112846.1420908-1-lgs201920130244@gmail.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" lan966x_fdma_rx_alloc_page_pool() registers the newly allocated page pool with each port's XDP RXQ. During an FDMA reload, this registration is performed before fdma_alloc_coherent() is called. If fdma_alloc_coherent() fails, lan966x_fdma_rx_alloc() destroys the new page pool and returns an error. The reload rollback path restores rx->page_pool and rx->fdma to their old values, but it does not restore the per-port XDP RXQ mem model registration. As a result, the XDP RXQ state can remain associated with the page pool from the failed allocation attempt while the RX state has been rolled back to the old page pool. Restore the old page pool registration for each port's XDP RXQ in the reload rollback path before RX is started again, so the XDP RXQ state matches the restored RX state. Fixes: 59c3d55a946c ("net: lan966x: fix use-after-free and leak in lan966x_= fdma_reload()") Signed-off-by: Guangshuo Li --- .../net/ethernet/microchip/lan966x/lan966x_fdma.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/drivers/net/ethernet/microchip/lan966x/lan966x_fdma.c b/driver= s/net/ethernet/microchip/lan966x/lan966x_fdma.c index f8ce735a7fc0..76654b44baf2 100644 --- a/drivers/net/ethernet/microchip/lan966x/lan966x_fdma.c +++ b/drivers/net/ethernet/microchip/lan966x/lan966x_fdma.c @@ -855,6 +855,21 @@ static int lan966x_fdma_reload(struct lan966x *lan966x= , int new_mtu) restore: lan966x->rx.page_pool =3D page_pool; memcpy(&lan966x->rx.fdma, &fdma_rx_old, sizeof(struct fdma)); + /* + * lan966x_fdma_rx_alloc_page_pool() registered the new pool with + * each port's XDP RXQ before the allocation failed. The new pool is + * destroyed by lan966x_fdma_rx_alloc(), so restore the old pool's + * registration before restarting RX. + */ + for (int i =3D 0; i < lan966x->num_phys_ports; i++) { + if (!lan966x->ports[i]) + continue; + + xdp_rxq_info_unreg_mem_model(&lan966x->ports[i]->xdp_rxq); + xdp_rxq_info_reg_mem_model(&lan966x->ports[i]->xdp_rxq, + MEM_TYPE_PAGE_POOL, page_pool); + } + lan966x_fdma_rx_start(&lan966x->rx); =20 lan966x_fdma_wakeup_netdev(lan966x); --=20 2.43.0