On Thu, Jul 16, 2026 at 02:34:29PM +0800, Maoyi Xie wrote:
> The octeon_ep and octeon_ep_vf RX paths add one skb fragment per buffer
> with no bound against MAX_SKB_FRAGS. buff_info->len comes from the device
> response header. A long packet needs about 18 fragments. That is one past
> the default MAX_SKB_FRAGS of 17, so skb_add_rx_frag() writes past
> shinfo->frags[]. Patch 1 bounds octeon_ep. Patch 3 bounds octeon_ep_vf.
>
> Patch 2 is Guangshuo Li's fix for an octeon_ep_vf RX page leak on the
> napi_build_skb() failure path. It touches the same drop code as patch 3.
> I carry it here so the series applies without conflict, per Maciej. Patch 3
> moves that drain loop into a helper. The helper carries the page frees from
> patch 2, so the overflow drop path frees its pages too.
>
> octeon_ep has the same leak on its drop path. A separate patch will fix it
> once this series lands.
>
> v5:
> - octeon_ep, octeon_ep_vf: widen data_len to u32, per Simon Horman.
> buff_info->len is a u64, a u16 could truncate a long length.
> - octeon_ep: dropped Maciej Fijalkowski's Reviewed-by, the check changed.
> - octeon_ep_vf: the drop helper drains the length in a u32 too.
The check changed however I provided certain suggestions that are included
in this set (checking frags before build_skb, wrapping common code to
helper), so I feel I still can have my review here.
For the series:
Reviewed-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com>
>
> v1: https://lore.kernel.org/r/20260701112825.1653044-1-maoyixie.tju@gmail.com
> v2: https://lore.kernel.org/r/20260702180518.2013324-1-maoyixie.tju@gmail.com
> v3: https://lore.kernel.org/r/20260704061511.2350737-1-maoyixie.tju@gmail.com
> v4: https://lore.kernel.org/r/20260706150208.2944898-1-maoyixie.tju@gmail.com
>
> Guangshuo Li (1):
> octeon_ep_vf: Fix RX page leak on napi_build_skb() failure
>
> Maoyi Xie (2):
> octeon_ep: fix skb frags overflow in the RX path
> octeon_ep_vf: fix skb frags overflow in the RX path
>
> .../net/ethernet/marvell/octeon_ep/octep_rx.c | 9 ++++
> .../marvell/octeon_ep_vf/octep_vf_rx.c | 51 ++++++++++++-------
> 2 files changed, 43 insertions(+), 17 deletions(-)
>
> --
> 2.34.1
>