fbnic_add_rx_frag() takes a page_pool reference out of the buffer's
pagecnt_bias before handing the fragment to xdp_buff_add_frag(). If that
call fails it has not taken ownership of the netmem: the fragment is not
recorded in the shared info, and fbnic_put_pkt_buff() will not put the
reference back.

Put the netmem reference back on the failure path.

Signed-off-by: Daniel Zahka <daniel.zahka@gmail.com>
---
This error path was introduced in commit 61f9a066c309 ("eth: fbnic: Use
shinfo to track frags state on Rx"). This is not a fix though, because
the branch is unreachable if the device is behaving correctly.
---
 drivers/net/ethernet/meta/fbnic/fbnic_txrx.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/ethernet/meta/fbnic/fbnic_txrx.c b/drivers/net/ethernet/meta/fbnic/fbnic_txrx.c
index 447ec5522499..bbc3c9e89a38 100644
--- a/drivers/net/ethernet/meta/fbnic/fbnic_txrx.c
+++ b/drivers/net/ethernet/meta/fbnic/fbnic_txrx.c
@@ -1045,6 +1045,7 @@ static void fbnic_add_rx_frag(struct fbnic_napi_vector *nv, u64 rcd,
 		pkt->add_frag_failed = true;
 		netdev_err_once(nv->napi.dev,
 				"Failed to add fragment to xdp_buff\n");
+		page_pool_put_full_netmem(qt->sub1.page_pool, netmem, true);
 	}
 }
 

---
base-commit: 6598456d72e48d779445bfec8f72114747f8b8d7
change-id: 20260922-fbnic-refcount-fix-a78b3a7e536b

Best regards,
-- 
Daniel Zahka <daniel.zahka@gmail.com>