From nobody Fri Jul 24 22:51:48 2026 Received: from mail-pf1-f169.google.com (mail-pf1-f169.google.com [209.85.210.169]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C777836197B for ; Wed, 22 Jul 2026 15:51:43 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.169 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784735505; cv=none; b=Qd9fB8nVRz378Kqqe82la4MJc+P1ANSnMym1TX7STMyoviMXB+Zfxl6JwPD9P5ZPqA9dMNAONO66lDqOVo/fDB32+al2uWiteq+bHIVBEWUBhUkR3JBm02PPbm/lWM6O23UYwPSnSBx6LLUlJkLPJE5xfKhbKlEoyspOVF0aKsg= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784735505; c=relaxed/simple; bh=gPrUQdO25OwByqCIyJlEUK/ELw4zeJKA7HgCL0t4JFM=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=tKCnMF4vzi8Y0yM1XOJ+XvHkE2ehPHuFEnqOf7whUplVBoPJjuTwPRGHP/m6/l0snpSApsUfx+gj2WiNU094Ozwo5cKKtf2vSuIH7azhizVHaGag3mmiqdHCblL/6q4pQNsL2fmL4031WJSMBS83FlbBtdxMR/nVadeZXQE4iEA= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=F+ei2Sb/; arc=none smtp.client-ip=209.85.210.169 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="F+ei2Sb/" Received: by mail-pf1-f169.google.com with SMTP id d2e1a72fcca58-8487088510aso12802140b3a.0 for ; Wed, 22 Jul 2026 08:51:43 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1784735503; x=1785340303; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=3vWgKUErhnh3LH7sgMXLGxx8WVFuBhCCZ3IuRApi8yg=; b=F+ei2Sb/CXoI3UnlCtNMuM1h0lpKRg0UoQWh7g6lFQFhHQnmxFwY8BVRq0AgFSr3ZM kULnRyydxMOCtMRf3C6yr21yAyDX/rJqBu1EKlbnbwj9j+jpxMVi2gMhAaOy2yVJszKT 2Cy3EuGjGrJtylGY6YV6feiPkxPYxQIHwGtEf+eCyl8PkR02uBOS7DnB/7y/6/6Ikurj ZCSV51y4j0dyHLUErzClIE2l1fkrFJGRaeSfMlZOJyFQK2yoP853B4Y18fRttyOnKw5g HszfLzjPFZc13NhdFykr80rB58GNEYgobveqIcGgUIWQ+fqCfuKS6JMctyaCbbvbhvVU rgqw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784735503; x=1785340303; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=3vWgKUErhnh3LH7sgMXLGxx8WVFuBhCCZ3IuRApi8yg=; b=kh4k/1ClQgDOvGOevHOX6s0/SIoCbLtRsUEAs0XVGHj2LI0xbjLL4z8Lv5uDn84biQ ojgZU1jKZ9p6GFIdI/UKXBZlRv7Vo52DOCQBCOLL6Yru17p2JLkJiqjwSwfSdWWc1HUv uS9l3rIA7NpEo+wi+iQLZy0e2aPEescWotTgOiDNP008BjBGYETEKfv2+U9Rk/Ii68T5 yyPRy435++0Njvnj8q7SZnR5/li4oqgsbqkGjsTJBhbXpVypBDYOcxY7PhS/LS8ewPSe /nar3ACv/Y9FgBYdFQy5ipljV/2RkE+bfzHVxwpd1dTU74fDCx9eiiKMiqXpOZY9K94L umag== X-Forwarded-Encrypted: i=1; AHgh+Rp/h0xan3VNV2TBlqKa+9KVz6opv65wEiHTW1+aV0cqWLNUjJi6985ankmxS4I67SKD1QpqrEdc096zpsQ=@vger.kernel.org X-Gm-Message-State: AOJu0Ywslv9D8H1w7jttSu/647DGl9VBLFzHuu0ldxSiwme++i6C1ohK oAv0T+4UvqNv3bOlCIvg8PR9PBDb93fRZLuBOD8vS7H6X5FDl6k/fUSk X-Gm-Gg: AR+sD13E4xumRNf88FUbkld+rkVU2Vq43T+HIjz1Cc6NHgz5vjE0f0tdC1av0svq3xo bxg+a+91iYwtc8GWjQG5EAREIPg8d/y2OnXSz4MgJnOH3z44E/X/EXVbQc3dYXZMSvGRcLiTiAt 2EqJzVfi8JmXcL8DgOovzcWdUPD/7hLdjUWK53xRIR1WnU5buw+lVFnTyKj2hByn7JokHOuEdwA 9J6bhv8qpKPVc9UtCQNkWzpKd9iSBfhOY6CAYlZs0ua1v9YB+/UfUhtuOlbI46KyhuMzBjQsO6Z dVRezARBX/aC9gWLipkgBwAaPE5d0h24pFaSHnvzJRuQLtrMFfVkJ58t9C2+vhC6B3p7nZ66X7v r6AqDPDe75dPcjNM36QyaKiIaazbqVOUq9acEhMIJ7qFHKm3t1rN30CbezkbTG3w86Hwsi6EmI6 To9Hsxb0cQoNga8Ed8mVmFxqhVg2E= X-Received: by 2002:a05:6a21:478c:b0:3bf:b182:94e with SMTP id adf61e73a8af0-3c3ad66b538mr26308040637.5.1784735502943; Wed, 22 Jul 2026 08:51:42 -0700 (PDT) Received: from csl-conti-dell7858.ntu.edu.sg ([155.69.195.57]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-3147df097e0sm11123125eec.17.2026.07.22.08.51.39 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 22 Jul 2026 08:51:42 -0700 (PDT) From: Maoyi Xie To: Veerasenareddy Burru , Sathesh Edara , Satananda Burla , Shinas Rasheed Cc: Andrew Lunn , "David S . Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Maciej Fijalkowski , Simon Horman , Guangshuo Li , David Carlier , netdev@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH net v6 1/4] octeon_ep: free the dropped RX buffer pages Date: Wed, 22 Jul 2026 23:51:28 +0800 Message-Id: <20260722155131.2017597-2-maoyixie.tju@gmail.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20260722155131.2017597-1-maoyixie.tju@gmail.com> References: <20260722155131.2017597-1-maoyixie.tju@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" octep_oq_drop_rx() drains a dropped multi-buffer RX packet but never frees its pages. It unmaps each fragment descriptor and leaves the page behind. It also reuses the head buff_info for every fragment. octep_oq_next_pkt() then clears the head slot again instead of the fragment slot. The fragment slots keep their page pointers. A later ring teardown unmaps those descriptors a second time. The build_skb() failure path frees no page either. The head page leaks too. octep_oq_drop_rx() now indexes each fragment slot. It unmaps the slot and frees its page. The unmap stays before the free to keep the DMA API contract. The build_skb() failure path frees the head page. buff_info->len comes from the device and is not bounded. The drain length derives from it. A bad length could run the loop past the ring. It would then free live pages of other packets. The loop now stops after MAX_SKB_FRAGS fragments. A valid packet never holds more. Fixes: eb592008f79b ("octeon_ep: Add SKB allocation failures handling in __= octep_oq_process_rx()") Co-developed-by: Kaixuan Li Signed-off-by: Kaixuan Li Signed-off-by: Maoyi Xie --- drivers/net/ethernet/marvell/octeon_ep/octep_rx.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/drivers/net/ethernet/marvell/octeon_ep/octep_rx.c b/drivers/ne= t/ethernet/marvell/octeon_ep/octep_rx.c index e6ebc7e44a..b0162fb9d9 100644 --- a/drivers/net/ethernet/marvell/octeon_ep/octep_rx.c +++ b/drivers/net/ethernet/marvell/octeon_ep/octep_rx.c @@ -388,9 +388,15 @@ static void octep_oq_drop_rx(struct octep_oq *oq, u32 *read_idx, u32 *desc_used) { int data_len =3D buff_info->len - oq->max_single_buffer_size; + int i; + + for (i =3D 0; i < MAX_SKB_FRAGS && data_len > 0; i++) { + struct page *page; =20 - while (data_len > 0) { + buff_info =3D (struct octep_rx_buffer *)&oq->buff_info[*read_idx]; + page =3D buff_info->page; octep_oq_next_pkt(oq, buff_info, read_idx, desc_used); + put_page(page); data_len -=3D oq->buffer_size; } } @@ -457,6 +463,7 @@ static int __octep_oq_process_rx(struct octep_device *o= ct, if (!skb) { octep_oq_drop_rx(oq, buff_info, &read_idx, &desc_used); + put_page(virt_to_page(resp_hw)); oq->stats->alloc_failures++; continue; } --=20 2.34.1 From nobody Fri Jul 24 22:51:48 2026 Received: from mail-pl1-f173.google.com (mail-pl1-f173.google.com [209.85.214.173]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id AFF29361954 for ; Wed, 22 Jul 2026 15:51:47 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.173 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784735509; cv=none; b=ZVA+VwmKgkJKqBjx46tEFv4wochrxOuv5Id0+tESgi878ne4+lRWNM7Y3rXS+rOueI4tFXWRBmyevyi8S4Kst3gLjKUP8d8eDvm2sAHHV0M2FfGztW7MAeBq5BGNxu1MfNQ1ivIvIfRdaGYHZlDvF8BeB5PNiAHm/mBx2Y1tuBw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784735509; c=relaxed/simple; bh=MaKDNUKQjWmWayDF5cS32+ZCJ4JvRRuKQRVPZiHyD2E=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=nNKNU8W++zuwL/v90KZ6cWr56wdWDPOG7xrzl+0a02mee26/rDKV6X1/mgAHWSRsx9EinO9xYNwRvxqV/Ka1fYR9Pk3dDw/DaLzVXz8yRGUbcNqtbYqfw1jWZhIA8fqygJP7s68NiRfLGCOQaimOqUlXFwjXSt45tXJKM4GtNjA= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=Xb3qYZPn; arc=none smtp.client-ip=209.85.214.173 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="Xb3qYZPn" Received: by mail-pl1-f173.google.com with SMTP id d9443c01a7336-2ceab75934dso136196345ad.2 for ; Wed, 22 Jul 2026 08:51:47 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1784735507; x=1785340307; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=6xyjk1qw4u8DGYX3M80XZHxNBFE7UmONsJaSKGY0mNY=; b=Xb3qYZPnmsm1YAUh3cppYUy2jqiOpa/h3g1J0/8Y6asX1tIUXoXVucJTnJrvTj1WRf Y4bzCvCQeRgJEGdEQAoZKbcKVOY1dMgoguabIgIXOtHAqCOP6hBDCgioFshNQhFJYe7w J1llTosXfu/tEgmK8rvizQvk07X+DZnZrK5X9Chvh9Zl9kcHzo9LWL1uJjWvIKoZjsnT qOoAIlaeb90vFLnEt3mzBJEM9nsoWYFpuDTYvt3OIwIW389evdLirwOHt7ekVCCdeB44 kJ13Iuj6uipNrFcyj/kAzCVPr9DOL5BHMmgTfGprBxN6KaS/Fx+z7X5+jlfoXWU92BnP SD+Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784735507; x=1785340307; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=6xyjk1qw4u8DGYX3M80XZHxNBFE7UmONsJaSKGY0mNY=; b=XBAe6rNZYLnF2gZhQz1HNseMVjExJORJIf3vaSnvdE6DEDTF4uu9pyXaJLDyub/Po+ h6c81tdRhYcjHr8w2sUhocjTMfocw5MTuUjJAYFDuEW8KEaoT5vIl8gWNPWEvkzwC64l 3p5ITmOY4sgrTGK6fBzqiVraMWhsKUW/J2dVJDHDY440J8GqVnrqtseu9wNpnWNQvDmv mycf11rbs4sMX+4ugmPCZuzFAn/Z4Wk0jTMNa2CWPDDiTvU3lWLj0PPgE93nBgcjiZw/ 6hjSct2U2P6GKR/ywj9zCVDJsuvim5tEwAnB2mRV30rKr+xEgXxFIRUFw/uko+gUuiRH SSFQ== X-Forwarded-Encrypted: i=1; AHgh+Rq8G7Gm9taZALT6vPxcOxaeNDBflz/SFdjvzjgHcK4P4wS4S4tlEbZozHo3s9zO8LizHUrKDAiLju2RyjU=@vger.kernel.org X-Gm-Message-State: AOJu0YxJKSdgaAjjr3AzRgHR3ETpIYFi1mWKxNlj6GV2VfLXF7JamGZ2 J2uSnSizkaq33e50qOD0I1sSWSchiybUYuMGo0ePh59CmLZGGRWh99NQ X-Gm-Gg: AR+sD13bPgTciATR89NBw33yRNatp7VAHrd9d38xzs9Rg+NeLeHhXShwski8GlvHrJW TReTOrlNFS/D5i5BCp+Oo5cUyNpLBAsVmJ+dswAJwXFUn+2qul6ukdo0h3/g5Lxaq1xo35X19YD jEopuy1jh06tljCIEAMWWiF6f/KdgEoN+bh6AAxITd7UR1AsQNnvUx63/j9o7quwjXw2dR3kZNX vedRdVRFJZUw9Vlr4A8VKaaPAtbrfX6scUkU/1jWSvMS7+tfAbkIbiczFyk/VpzsL7CoLZa3Kup a1VUEAq7JsDz9rR3lXGT+RXnzJ8A04JgbujK1ADNkGm2FqcDNYLOmOMV/3ZsKOXN5+qJQTOjJoC 7moCtApzfx/GMIeKEatKnpkRNE/Tccg0UNOH6CqviMEVbIoK8+Yw3MWDIcZLVtEmdgi/t3VxGEz OAMFaBIHmqGmDyZ1EY/deKRNaDODADbQJHNnas1g== X-Received: by 2002:a17:902:f710:b0:2cf:7d44:e14f with SMTP id d9443c01a7336-2cf7d44f558mr110005485ad.26.1784735507059; Wed, 22 Jul 2026 08:51:47 -0700 (PDT) Received: from csl-conti-dell7858.ntu.edu.sg ([155.69.195.57]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-3147df097e0sm11123125eec.17.2026.07.22.08.51.43 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 22 Jul 2026 08:51:46 -0700 (PDT) From: Maoyi Xie To: Veerasenareddy Burru , Sathesh Edara , Satananda Burla , Shinas Rasheed Cc: Andrew Lunn , "David S . Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Maciej Fijalkowski , Simon Horman , Guangshuo Li , David Carlier , netdev@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH net v6 2/4] octeon_ep: fix skb frags overflow in the RX path Date: Wed, 22 Jul 2026 23:51:29 +0800 Message-Id: <20260722155131.2017597-3-maoyixie.tju@gmail.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20260722155131.2017597-1-maoyixie.tju@gmail.com> References: <20260722155131.2017597-1-maoyixie.tju@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" __octep_oq_process_rx() builds an skb for a multi-buffer packet by adding one fragment per buffer_size chunk. data_len =3D buff_info->len - oq->max_single_buffer_size; while (data_len) { ... skb_add_rx_frag(skb, shinfo->nr_frags, buff_info->page, 0, buff_info->len, buff_info->len); ... } buff_info->len comes from the device response header (be64_to_cpu(resp_hw->length)). Nothing bounds the fragment count against MAX_SKB_FRAGS. data_len can be close to 65535. buffer_size defaults to about 3776 on 4K pages. A full packet then yields about 18 fragments. That is one more than the default MAX_SKB_FRAGS of 17. skb_add_rx_frag() writes past shinfo->frags[]. The fragment count is now checked before build_skb(). A packet that needs more fragments than the skb can hold is dropped. octep_oq_drop_rx() frees the fragment pages. This path frees the head page too. The same class was fixed in other RX paths, including commit 5ffcb7b890f6 ("net: atlantic: fix fragment overflow handling in RX path") and commit f0813bcd2d9d ("net: wwan: t7xx: fix potential skb->frags overflow in RX path"). Fixes: 37d79d059606 ("octeon_ep: add Tx/Rx processing and interrupt support= ") Co-developed-by: Kaixuan Li Signed-off-by: Kaixuan Li Signed-off-by: Maoyi Xie --- drivers/net/ethernet/marvell/octeon_ep/octep_rx.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/drivers/net/ethernet/marvell/octeon_ep/octep_rx.c b/drivers/ne= t/ethernet/marvell/octeon_ep/octep_rx.c index b0162fb9d9..20c7b9f53e 100644 --- a/drivers/net/ethernet/marvell/octeon_ep/octep_rx.c +++ b/drivers/net/ethernet/marvell/octeon_ep/octep_rx.c @@ -459,6 +459,16 @@ static int __octep_oq_process_rx(struct octep_device *= oct, =20 octep_oq_next_pkt(oq, buff_info, &read_idx, &desc_used); =20 + if (buff_info->len > oq->max_single_buffer_size) { + u32 data_len =3D buff_info->len - oq->max_single_buffer_size; + + if (DIV_ROUND_UP(data_len, oq->buffer_size) > MAX_SKB_FRAGS) { + octep_oq_drop_rx(oq, buff_info, &read_idx, &desc_used); + put_page(virt_to_page(resp_hw)); + continue; + } + } + skb =3D build_skb((void *)resp_hw, PAGE_SIZE); if (!skb) { octep_oq_drop_rx(oq, buff_info, --=20 2.34.1 From nobody Fri Jul 24 22:51:48 2026 Received: from mail-pl1-f178.google.com (mail-pl1-f178.google.com [209.85.214.178]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1190B41D134 for ; Wed, 22 Jul 2026 15:51:51 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.178 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784735514; cv=none; b=hxo0XubbrLaNzJYhy3VrGShq86i4YGnUx0rLVoxUh/xqHdIXvmOrwcbWn9aWEQUUl3etakJN8404qoeQdXPjBtAlrPOsM4p8mHUHoYt0P1zo/QSMvlmbDjxPOdVZjtxIw1aK379kz4Xr114djpfpCshci4rNFmHR0acOu0mYvrw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784735514; c=relaxed/simple; bh=cTQoP0lWlAxfFS21VMcXcV5AqjPUsdSmGaP2HtEb0nM=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=s22cIFsXPW3KAiX5ug87MdPoE73zibOfYtURDr0zIEgvuAJObs60njGjn4wugVsMwSmd9m1WcRqn4NsUKWmo7Z/RRDK4y+2v4VcN8VqJVf800Kg+xlxhRlh+zLv0fJik2Pv5jfZQZq/5Ftf6GH4pTjKbk23RXSjqCNh3sRCTYj0= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=g8Z1RWkF; arc=none smtp.client-ip=209.85.214.178 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="g8Z1RWkF" Received: by mail-pl1-f178.google.com with SMTP id d9443c01a7336-2ca64c3ce5fso144971595ad.3 for ; Wed, 22 Jul 2026 08:51:51 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1784735511; x=1785340311; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=SAC+WsEZ64mnrQj0pnVENutWORk+53oxQVLeMc2X3SA=; b=g8Z1RWkFOiht2zK58jdP0GYPqXNst5miiQeltDBRxLzvareVhEVri7K8RRJpIw3vx1 EwZ5awsB6HFh4ixUNjK2cRQtduiuGDaI2FLMu1HJljawjEaZSc27djqsmuOdhyyg065y aREuMStiBGPdoE0TWyzcqISdUXxLUOg26OIATYS41l2CM6otaI7gX9VqBXy/wNOpmpXE MDioWLz3uh3U8+N2Zz5V8p3L9jf5wBoj9aQWrYsOQe8PhHrOFfwOz3yat2sgNsJikN/4 3UVVZgYuujconBfVvoYwzDoUlXQ3xbbGFpeDzVmSP0HM7UD/UxHEyr47fmJcltPDvbEZ 9zbw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784735511; x=1785340311; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=SAC+WsEZ64mnrQj0pnVENutWORk+53oxQVLeMc2X3SA=; b=C3VxXLGnIQ/BB/0SHtJ57Wc3J+XsnnAR7DlbPvUGrRMzhqVC4/lihloq3hryZQXq2U Tjz/0uMLz41yhTMHNuQpvALvy6fwCbyG9ici0Q9ONo2p6Qsg64K/hoca0A0KeuquTBLq Ww2Y6XVmTNf68tHRFsEooRqL8Fcbgl1Wf9AnzU2wRUILas3LXrY2+c7GC6FWK10F8kg3 TnQAofq43NXvErYUUdwwkRF9qo9mMfB0YLG4SNSSjDH/H2gbygNYaVUxWCfioyTWVsW4 e+ORXhO5s4Nh0nkRZ2606JQiC23S8ICQvIppETMt9DnsU5KA3agnlj1ihuZj/Sur1N14 Mv2g== X-Forwarded-Encrypted: i=1; AHgh+Rqr0tN2NHhW9TRFC6jTKK0cU3m18L0obBLwBF73k9sMDUKOE4+p1UqofCYLV+T5yzfeiWR1sr0y0z/sBB8=@vger.kernel.org X-Gm-Message-State: AOJu0Yz17rQlYgYxlNneSZ0m3vSDKsTW6W0sCcKnUMCzjxF6pD6IiVPl i+KZR0QjMuc5BllQ4/lr2MbJNuZGXNAnV0TULUBxLI5sUwNsQ62V4VVh X-Gm-Gg: AR+sD13I83RQSuwfWNsIeCA3/T+IqORpc5qAj586FsVqr2vp0STZctb/Mihj/03D59V IzQ9NLfuPHArcgp6h9KSWL8fyiaxvwhPHGjSjNqB5os7MfeSZCqtBKjsjIlWSAVUDcFsrVIRw1m mjzuontTzXdue0AVcizmMe+grM5UqvcAa0dVpdWhSUeI+70HdomAnLTdlShElcwCwy58rXCJewk rS3wFkO2SXfI7ZFQjWQRo2ZwQQU5HVoDCV0pX+FWeFLjQL20kI7d3kRoP12UP0wtL5x8NNmQeqN Lzddb4p6ntgC3J6rSdCU2pCZVpQlOLdBZ9sd8mJt2CYN8IrasctRMwaNIm+7VBERykk35+xvjLo ddqi1cz1fQZIJTIdV7gGku9stt2wXe+ROPJUBw2pyNLmh6ipsxH1i1SSEz1l+j5na/5UdzJTNJ2 vZctWSSyyoODp7gLPcOQTx3lVZN00= X-Received: by 2002:a17:903:13c6:b0:2ce:b096:e517 with SMTP id d9443c01a7336-2cf3489548bmr257323065ad.5.1784735511158; Wed, 22 Jul 2026 08:51:51 -0700 (PDT) Received: from csl-conti-dell7858.ntu.edu.sg ([155.69.195.57]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-3147df097e0sm11123125eec.17.2026.07.22.08.51.47 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 22 Jul 2026 08:51:50 -0700 (PDT) From: Maoyi Xie To: Veerasenareddy Burru , Sathesh Edara , Satananda Burla , Shinas Rasheed Cc: Andrew Lunn , "David S . Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Maciej Fijalkowski , Simon Horman , Guangshuo Li , David Carlier , netdev@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH net v6 3/4] octeon_ep_vf: Fix RX page leak on napi_build_skb() failure Date: Wed, 22 Jul 2026 23:51:30 +0800 Message-Id: <20260722155131.2017597-4-maoyixie.tju@gmail.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20260722155131.2017597-1-maoyixie.tju@gmail.com> References: <20260722155131.2017597-1-maoyixie.tju@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Guangshuo Li __octep_vf_oq_process_rx() clears buff_info->page before building an skb from the RX page. On the success path the page is consumed by the skb, either as the skb head or as an RX fragment. If napi_build_skb() fails, however, the page is not consumed by an skb. The error path advances the descriptor and leaves the ring slot cleared, so the page is no longer tracked and is leaked. In the multi-fragment case, the remaining fragment pages are also unmapped and removed from their ring slots without being released. Release the head page when napi_build_skb() fails, and release each remaining fragment page before clearing its ring slot. Fixes: dd66b4285470 ("octeon_ep_vf: add NULL check for napi_build_skb()") Signed-off-by: Guangshuo Li --- drivers/net/ethernet/marvell/octeon_ep_vf/octep_vf_rx.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/net/ethernet/marvell/octeon_ep_vf/octep_vf_rx.c b/driv= ers/net/ethernet/marvell/octeon_ep_vf/octep_vf_rx.c index d982474082..302559b16b 100644 --- a/drivers/net/ethernet/marvell/octeon_ep_vf/octep_vf_rx.c +++ b/drivers/net/ethernet/marvell/octeon_ep_vf/octep_vf_rx.c @@ -418,6 +418,7 @@ static int __octep_vf_oq_process_rx(struct octep_vf_dev= ice *oct, skb =3D napi_build_skb((void *)resp_hw, PAGE_SIZE); if (!skb) { oq->stats->alloc_failures++; + put_page(virt_to_page(resp_hw)); desc_used++; read_idx =3D octep_vf_oq_next_idx(oq, read_idx); continue; @@ -434,6 +435,7 @@ static int __octep_vf_oq_process_rx(struct octep_vf_dev= ice *oct, skb =3D napi_build_skb((void *)resp_hw, PAGE_SIZE); if (!skb) { oq->stats->alloc_failures++; + put_page(virt_to_page(resp_hw)); desc_used++; read_idx =3D octep_vf_oq_next_idx(oq, read_idx); data_len =3D buff_info->len - oq->max_single_buffer_size; @@ -442,6 +444,7 @@ static int __octep_vf_oq_process_rx(struct octep_vf_dev= ice *oct, PAGE_SIZE, DMA_FROM_DEVICE); buff_info =3D (struct octep_vf_rx_buffer *) &oq->buff_info[read_idx]; + put_page(buff_info->page); buff_info->page =3D NULL; if (data_len < oq->buffer_size) data_len =3D 0; --=20 2.34.1 From nobody Fri Jul 24 22:51:48 2026 Received: from mail-pg1-f180.google.com (mail-pg1-f180.google.com [209.85.215.180]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A62FA41D11B for ; Wed, 22 Jul 2026 15:51:57 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.215.180 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784735520; cv=none; b=PXdtio4zMANmV8zkQ9oNvhpXf1xl9hCqg5QF2dimv0iFp5z8wZTSd3mPo4CljXoStNetEK4PSsvsvYtmfggZgWjLCtmvx1tH+mMiHy0DkZSANEUh75kAKC+qdvZY96V0CRU6Ll5STSZwUlhvvJIWPDymh/7kNm/j8dTAyh+QAcI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784735520; c=relaxed/simple; bh=YiOZsq6Y1IbB4b4lwLMmIwOT04xVy4fzjYkWQ7AnOlQ=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=B6zpM2txXCmifpEvIttcQcSa5khj09LgF07o8dGaH3zghdfz9IP6DJfFoOehWbLgczVZX8DXUIWSnCVJvkRZVFBX/r7+kqOHj05gT1HoL8+Pl41nda4j/YocnVZC6rKPIkBla3M1P1/i7qWVDPW2xYYKZK/A/3d5NDY7cqBGH90= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=DcmVj7pd; arc=none smtp.client-ip=209.85.215.180 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="DcmVj7pd" Received: by mail-pg1-f180.google.com with SMTP id 41be03b00d2f7-ca80d708489so4320309a12.1 for ; Wed, 22 Jul 2026 08:51:57 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1784735515; x=1785340315; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=onDvN0sOyUsUE/lLtZeTVoz1SOZ06K7HZFi9ZupIfc4=; b=DcmVj7pdpmc0Sy9cG4sfn7+gn27889loPRUjR0rap+s8HiuKu2/VzVnv2x/TrVIlfY 7jZvcHXl601q4xpPufmOPZ8loeDmemCGXNQ8ackeXfCvy8CeNr2r8i8F0r+62fk8OZ8N +yybKsEKD7ptFQ1/aoBpWvKabJvYUIoqLSgokDP99/HSnWwteKMqcAJnQ5zLl0C/seCq 42/3wbP0wywHcEFX92VZNquUsblME1MXplYJz2GgIHdo4Ap4NRjJpr+qrfI99r79oUvt qDXlIX6+AbyY+XxwgQTgqi+7NbS1g5djFf/L4AWhNcl3FxqJQkmlHv/ga94uM2qM/zP2 eY7g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784735515; x=1785340315; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=onDvN0sOyUsUE/lLtZeTVoz1SOZ06K7HZFi9ZupIfc4=; b=g5db8RkqeNKPmEm5xt/NLlX5bwnDs6/UptuEcQ2OfKqT6VyuFjAl3haOcxD9yZZHUd CKfLcuwPVUv9krYUfUcXG3M8ecuoqIBGlMqHBHSNlw+pU23jVwtDIcTJgPFQlNEWbiwg oArMGmEGvL8dnFbiLdkOk7/nS4iaPBpjecc/fPzBQvJktTY+kfaoa7rZq7kydvgroxUo 015463Rn5DoFHCaesHMEzCUZ4WD/rXlldmLf6N3Caq54csM2dEovMV933A655A9iIY7H sUjvAXq1c5opcySaam38A8g8WMI2F6+GS33fhQhs/NdOg/jAdGBMrbWFVrDUGfRgrZNp hlcg== X-Forwarded-Encrypted: i=1; AHgh+Rq6QE3vvtStbh7HaPDfyQyfXR7HqLlce+oY6vciDhncK8rq8unwWSmkM6tHfMG5kffRk4C0igHMsQdUkm4=@vger.kernel.org X-Gm-Message-State: AOJu0Ywm+TCcacT/aWdjrYHORpbwr0kvbdMAR/Jnf+RUpTnoiYF1kEfi 8k9zQ7cVG/0tgKGKSlLqytY/SJDlNLsH5LYDPZthMrlsKeCo4c8MSJu/NiDvkxDfXbE= X-Gm-Gg: AR+sD12eY07Y5mJhAKmNwVdjnjWuvaGxvlT6cLI672widUnSgiTeCL53GPsoGbyXUxE 2B7ON64n4XErwsP+tC1xpQ4kQoA226LLhabE2iSmvob2YYpg2QdMF7fm/kMJd7V2b1vwVOI5WPt Pc6c/+EX1T0DvBXd3v5IK6OtJEtFIr0rpBjvbNJ7PQIOLWdvvm2tAQ5tHK16XmxPjyW5DI3M6/E MdtBzGuuR4wrzqaIybcH7RNZg+LzOV8Zyyxc2rf/JMECrkRODDN4A57BPsvUmnF9ZfZkTQkiuf7 nM6L8vmcoa2X2f4raOkOGEpj4oO7K3+wJjLKml5mVKoueQ8SDO94ORV8yMb0AxOaugFHCtNrcpU UWqbu0F+6y4xcGEpCC3cDAXqwckDT8uo1Ne4domifCUF4QRE1yIct19EzTpOBN8hG5Hq2FicbDz 0h9rLmOK8WelmOlNRoS3mGEt+Sv7RA4ZoHNQ2xXA== X-Received: by 2002:a05:6a20:2d21:b0:3bf:aa54:4cbc with SMTP id adf61e73a8af0-3c4294a6909mr5228486637.26.1784735515492; Wed, 22 Jul 2026 08:51:55 -0700 (PDT) Received: from csl-conti-dell7858.ntu.edu.sg ([155.69.195.57]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-3147df097e0sm11123125eec.17.2026.07.22.08.51.51 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 22 Jul 2026 08:51:54 -0700 (PDT) From: Maoyi Xie To: Veerasenareddy Burru , Sathesh Edara , Satananda Burla , Shinas Rasheed Cc: Andrew Lunn , "David S . Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Maciej Fijalkowski , Simon Horman , Guangshuo Li , David Carlier , netdev@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH net v6 4/4] octeon_ep_vf: fix skb frags overflow in the RX path Date: Wed, 22 Jul 2026 23:51:31 +0800 Message-Id: <20260722155131.2017597-5-maoyixie.tju@gmail.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20260722155131.2017597-1-maoyixie.tju@gmail.com> References: <20260722155131.2017597-1-maoyixie.tju@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" __octep_vf_oq_process_rx() has the same unbounded fragment loop as the PF driver. buff_info->len comes from the device response header. The loop adds one fragment per buffer_size chunk with no check against MAX_SKB_FRAGS. A long packet yields about 18 fragments. That is one past the default MAX_SKB_FRAGS of 17. skb_add_rx_frag() then writes past shinfo->frags[]. The fragment count is now checked before napi_build_skb(). A packet that needs more fragments than the skb can hold is dropped. octep_vf_oq_drop_rx() drains those descriptors. It also frees the head page and every fragment page. The drain stops after MAX_SKB_FRAGS fragments. A bad device length cannot run it past the ring. The previous patch added those frees to the inline drop path. The napi_build_skb() failure path now uses the same helper. Fixes: 1cd3b407977c ("octeon_ep_vf: add Tx/Rx processing and interrupt supp= ort") Co-developed-by: Kaixuan Li Signed-off-by: Kaixuan Li Signed-off-by: Maoyi Xie --- .../marvell/octeon_ep_vf/octep_vf_rx.c | 53 ++++++++++++------- 1 file changed, 34 insertions(+), 19 deletions(-) diff --git a/drivers/net/ethernet/marvell/octeon_ep_vf/octep_vf_rx.c b/driv= ers/net/ethernet/marvell/octeon_ep_vf/octep_vf_rx.c index 302559b16b..9d71937074 100644 --- a/drivers/net/ethernet/marvell/octeon_ep_vf/octep_vf_rx.c +++ b/drivers/net/ethernet/marvell/octeon_ep_vf/octep_vf_rx.c @@ -357,6 +357,32 @@ static inline u32 octep_vf_oq_next_idx(struct octep_vf= _oq *oq, u32 idx) return (idx + 1 =3D=3D oq->max_count) ? 0 : idx + 1; } =20 +static void octep_vf_oq_drop_rx(struct octep_vf_oq *oq, + struct octep_vf_rx_buffer *buff_info, + void *resp_hw, u32 *read_idx, u32 *desc_used) +{ + u32 data_len =3D buff_info->len - oq->max_single_buffer_size; + int i; + + put_page(virt_to_page(resp_hw)); + (*desc_used)++; + *read_idx =3D octep_vf_oq_next_idx(oq, *read_idx); + for (i =3D 0; i < MAX_SKB_FRAGS && data_len; i++) { + dma_unmap_page(oq->dev, oq->desc_ring[*read_idx].buffer_ptr, + PAGE_SIZE, DMA_FROM_DEVICE); + buff_info =3D (struct octep_vf_rx_buffer *) + &oq->buff_info[*read_idx]; + put_page(buff_info->page); + buff_info->page =3D NULL; + if (data_len < oq->buffer_size) + data_len =3D 0; + else + data_len -=3D oq->buffer_size; + (*desc_used)++; + *read_idx =3D octep_vf_oq_next_idx(oq, *read_idx); + } +} + /** * __octep_vf_oq_process_rx() - Process hardware Rx queue and push to stac= k. * @@ -430,29 +456,18 @@ static int __octep_vf_oq_process_rx(struct octep_vf_d= evice *oct, read_idx =3D octep_vf_oq_next_idx(oq, read_idx); } else { struct skb_shared_info *shinfo; - u16 data_len; + u32 data_len; + + data_len =3D buff_info->len - oq->max_single_buffer_size; + if (DIV_ROUND_UP(data_len, oq->buffer_size) > MAX_SKB_FRAGS) { + octep_vf_oq_drop_rx(oq, buff_info, resp_hw, &read_idx, &desc_used); + continue; + } =20 skb =3D napi_build_skb((void *)resp_hw, PAGE_SIZE); if (!skb) { oq->stats->alloc_failures++; - put_page(virt_to_page(resp_hw)); - desc_used++; - read_idx =3D octep_vf_oq_next_idx(oq, read_idx); - data_len =3D buff_info->len - oq->max_single_buffer_size; - while (data_len) { - dma_unmap_page(oq->dev, oq->desc_ring[read_idx].buffer_ptr, - PAGE_SIZE, DMA_FROM_DEVICE); - buff_info =3D (struct octep_vf_rx_buffer *) - &oq->buff_info[read_idx]; - put_page(buff_info->page); - buff_info->page =3D NULL; - if (data_len < oq->buffer_size) - data_len =3D 0; - else - data_len -=3D oq->buffer_size; - desc_used++; - read_idx =3D octep_vf_oq_next_idx(oq, read_idx); - } + octep_vf_oq_drop_rx(oq, buff_info, resp_hw, &read_idx, &desc_used); continue; } rx_bytes +=3D buff_info->len; --=20 2.34.1