I'm always confused which tree(net or bpf) should XDP target.

bpf_xdp_shrink_data() frees a page_pool frag with the wrong memory type on
skb-backed XDP, hitting "Bad page state ... page_pool leak". Both the
generic XDP path and the veth path are affected.

Patch 1 fixes it by tagging the xdp_buff, so it no longer depends on
rxq->mem.type (which is shared on generic XDP and gets reset on veth). It
is reported by syzbot.

Patch 2 adds a selftest that reproduces the leak on both paths.


v2 -> v3: handle some feedback from AI review.
v2: https://lore.kernel.org/bpf/20260824030257.263179-1-jiayuan.chen@linux.dev/
v1 -> v2: AI found the fix was insufficient and we need a general way
          to fix them.
v1: https://lore.kernel.org/bpf/20260816031245.268898-1-jiayuan.chen@linux.dev/

Jiayuan Chen (2):
  bpf, veth: xdp: fix page_pool page leak on skb-backed XDP
  selftests/bpf: add xdp_shrink_frags

 drivers/net/veth.c                            |   6 +
 include/net/xdp.h                             |  30 +-
 net/core/dev.c                                |   6 +
 net/core/filter.c                             |   7 +
 .../bpf/prog_tests/xdp_shrink_frags.c         | 288 ++++++++++++++++++
 .../selftests/bpf/progs/xdp_shrink_frags.c    |  34 +++
 6 files changed, 370 insertions(+), 1 deletion(-)
 create mode 100644 tools/testing/selftests/bpf/prog_tests/xdp_shrink_frags.c
 create mode 100644 tools/testing/selftests/bpf/progs/xdp_shrink_frags.c

-- 
2.43.0

On Fri, 11 Sep 2026 21:56:50 +0800 Jiayuan Chen wrote:
> I'm always confused which tree(net or bpf) should XDP target.

Selfishly Id prefer net so that all our CI would just run without any
manual effort on my part :) But perhaps BPF folks will disagree using
basically the same argument.. :S If not perhaps please switch to net?

On Thu, Sep 17, 2026 at 6:59 PM Jakub Kicinski <kuba@kernel.org> wrote:
>
> On Fri, 11 Sep 2026 21:56:50 +0800 Jiayuan Chen wrote:
> > I'm always confused which tree(net or bpf) should XDP target.
>
> Selfishly Id prefer net so that all our CI would just run without any
> manual effort on my part :) But perhaps BPF folks will disagree using
> basically the same argument.. :S If not perhaps please switch to net?

yes please :)
all of xsk, xdp, veth can (should?) go through net tree.
We can deal with sockmap poster child until it's cured of bugs.