RE: [PATCH bpf v2 4/9] ice: change XDP RxQ frag_size from DMA write length to xdp.frame_sz

[Loktionov, Aleksandr]

> -----Original Message-----
> From: Zaremba, Larysa <larysa.zaremba@xxxxxxxxx>
> Sent: Thursday, February 12, 2026 7:33 PM
> To: bpf@xxxxxxxxxxxxxxx
> Cc: Zaremba, Larysa <larysa.zaremba@xxxxxxxxx>; Claudiu Manoil
> <claudiu.manoil@xxxxxxx>; Vladimir Oltean <vladimir.oltean@xxxxxxx>;
> Wei Fang <wei.fang@xxxxxxx>; Clark Wang <xiaoning.wang@xxxxxxx>;
> Andrew Lunn <andrew+netdev@xxxxxxx>; David S. Miller
> <davem@xxxxxxxxxxxxx>; Eric Dumazet <edumazet@xxxxxxxxxx>; Jakub
> Kicinski <kuba@xxxxxxxxxx>; Paolo Abeni <pabeni@xxxxxxxxxx>; Nguyen,
> Anthony L <anthony.l.nguyen@xxxxxxxxx>; Kitszel, Przemyslaw
> <przemyslaw.kitszel@xxxxxxxxx>; Alexei Starovoitov <ast@xxxxxxxxxx>;
> Daniel Borkmann <daniel@xxxxxxxxxxxxx>; Jesper Dangaard Brouer
> <hawk@xxxxxxxxxx>; John Fastabend <john.fastabend@xxxxxxxxx>;
> Stanislav Fomichev <sdf@xxxxxxxxxxx>; Andrii Nakryiko
> <andrii@xxxxxxxxxx>; Martin KaFai Lau <martin.lau@xxxxxxxxx>; Eduard
> Zingerman <eddyz87@xxxxxxxxx>; Song Liu <song@xxxxxxxxxx>; Yonghong
> Song <yonghong.song@xxxxxxxxx>; KP Singh <kpsingh@xxxxxxxxxx>; Hao Luo
> <haoluo@xxxxxxxxxx>; Jiri Olsa <jolsa@xxxxxxxxxx>; Simon Horman
> <horms@xxxxxxxxxx>; Shuah Khan <shuah@xxxxxxxxxx>; Lobakin, Aleksander
> <aleksander.lobakin@xxxxxxxxx>; Fijalkowski, Maciej
> <maciej.fijalkowski@xxxxxxxxx>; Bastien Curutchet (eBPF Foundation)
> <bastien.curutchet@xxxxxxxxxxx>; Vyavahare, Tushar
> <tushar.vyavahare@xxxxxxxxx>; Jason Xing <kernelxing@xxxxxxxxxxx>;
> Ricardo B. Marlière <rbm@xxxxxxxx>; Eelco Chaudron
> <echaudro@xxxxxxxxxx>; Lorenzo Bianconi <lorenzo@xxxxxxxxxx>; Toke
> Hoiland-Jorgensen <toke@xxxxxxxxxx>; imx@xxxxxxxxxxxxxxx;
> netdev@xxxxxxxxxxxxxxx; linux-kernel@xxxxxxxxxxxxxxx; intel-wired-
> lan@xxxxxxxxxxxxxxxx; linux-kselftest@xxxxxxxxxxxxxxx; Loktionov,
> Aleksandr <aleksandr.loktionov@xxxxxxxxx>; Dragos Tatulea
> <dtatulea@xxxxxxxxxx>
> Subject: [PATCH bpf v2 4/9] ice: change XDP RxQ frag_size from DMA
> write length to xdp.frame_sz
> 
> The only user of frag_size field in XDP RxQ info is
> bpf_xdp_frags_increase_tail(). It clearly expects whole buff size
> instead of DMA write size. Different assumptions in ice driver
> configuration lead to negative tailroom.
> 
> This allows to trigger kernel panic, when using
> XDP_ADJUST_TAIL_GROW_MULTI_BUFF xskxceiver test and changing packet
> size to
> 6912 and the requisted offset to a huge value, e.g.

"requisted offset" -> "requested offset"

Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@xxxxxxxxx>
> XSK_UMEM__MAX_FRAME_SIZE * 100.
> 
> Due to other quirks of the ZC configuration in ice, panic is not
> observed in ZC mode, but tailroom growing still fails when it should
> not.
> 
> Use fill queue buffer truesize instead of DMA write size in XDP RxQ
> info.
> Fix ZC mode too by using the new helper.
> 
> Fixes: 2fba7dc5157b ("ice: Add support for XDP multi-buffer on Rx
> side")
> Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@xxxxxxxxx>
> Signed-off-by: Larysa Zaremba <larysa.zaremba@xxxxxxxxx>
> ---

...
 
> --
> 2.52.0