Re: [PATCH bpf v2 4/9] ice: change XDP RxQ frag_size from DMA write length to xdp.frame_sz

[Larysa Zaremba]

On Fri, Feb 13, 2026 at 04:57:25AM +0100, Loktionov, Aleksandr wrote:
> 
> 
> > -----Original Message-----
> > From: Zaremba, Larysa <larysa.zaremba@xxxxxxxxx>
> > Sent: Thursday, February 12, 2026 7:33 PM
> > To: bpf@xxxxxxxxxxxxxxx
> > Cc: Zaremba, Larysa <larysa.zaremba@xxxxxxxxx>; Claudiu Manoil
> > <claudiu.manoil@xxxxxxx>; Vladimir Oltean <vladimir.oltean@xxxxxxx>;
> > Wei Fang <wei.fang@xxxxxxx>; Clark Wang <xiaoning.wang@xxxxxxx>;
> > Andrew Lunn <andrew+netdev@xxxxxxx>; David S. Miller
> > <davem@xxxxxxxxxxxxx>; Eric Dumazet <edumazet@xxxxxxxxxx>; Jakub
> > Kicinski <kuba@xxxxxxxxxx>; Paolo Abeni <pabeni@xxxxxxxxxx>; Nguyen,
> > Anthony L <anthony.l.nguyen@xxxxxxxxx>; Kitszel, Przemyslaw
> > <przemyslaw.kitszel@xxxxxxxxx>; Alexei Starovoitov <ast@xxxxxxxxxx>;
> > Daniel Borkmann <daniel@xxxxxxxxxxxxx>; Jesper Dangaard Brouer
> > <hawk@xxxxxxxxxx>; John Fastabend <john.fastabend@xxxxxxxxx>;
> > Stanislav Fomichev <sdf@xxxxxxxxxxx>; Andrii Nakryiko
> > <andrii@xxxxxxxxxx>; Martin KaFai Lau <martin.lau@xxxxxxxxx>; Eduard
> > Zingerman <eddyz87@xxxxxxxxx>; Song Liu <song@xxxxxxxxxx>; Yonghong
> > Song <yonghong.song@xxxxxxxxx>; KP Singh <kpsingh@xxxxxxxxxx>; Hao Luo
> > <haoluo@xxxxxxxxxx>; Jiri Olsa <jolsa@xxxxxxxxxx>; Simon Horman
> > <horms@xxxxxxxxxx>; Shuah Khan <shuah@xxxxxxxxxx>; Lobakin, Aleksander
> > <aleksander.lobakin@xxxxxxxxx>; Fijalkowski, Maciej
> > <maciej.fijalkowski@xxxxxxxxx>; Bastien Curutchet (eBPF Foundation)
> > <bastien.curutchet@xxxxxxxxxxx>; Vyavahare, Tushar
> > <tushar.vyavahare@xxxxxxxxx>; Jason Xing <kernelxing@xxxxxxxxxxx>;
> > Ricardo B. Marlière <rbm@xxxxxxxx>; Eelco Chaudron
> > <echaudro@xxxxxxxxxx>; Lorenzo Bianconi <lorenzo@xxxxxxxxxx>; Toke
> > Hoiland-Jorgensen <toke@xxxxxxxxxx>; imx@xxxxxxxxxxxxxxx;
> > netdev@xxxxxxxxxxxxxxx; linux-kernel@xxxxxxxxxxxxxxx; intel-wired-
> > lan@xxxxxxxxxxxxxxxx; linux-kselftest@xxxxxxxxxxxxxxx; Loktionov,
> > Aleksandr <aleksandr.loktionov@xxxxxxxxx>; Dragos Tatulea
> > <dtatulea@xxxxxxxxxx>
> > Subject: [PATCH bpf v2 4/9] ice: change XDP RxQ frag_size from DMA
> > write length to xdp.frame_sz
> > 
> > The only user of frag_size field in XDP RxQ info is
> > bpf_xdp_frags_increase_tail(). It clearly expects whole buff size
> > instead of DMA write size. Different assumptions in ice driver
> > configuration lead to negative tailroom.
> > 
> > This allows to trigger kernel panic, when using
> > XDP_ADJUST_TAIL_GROW_MULTI_BUFF xskxceiver test and changing packet
> > size to
> > 6912 and the requisted offset to a huge value, e.g.
> 
> "requisted offset" -> "requested offset"
> 

I am curious why codespell thinks this is fine.

Will fix, bot has correctly identified that u32 rx_buf_len; is not longer needed 
after this patch.

> Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@xxxxxxxxx>
> > XSK_UMEM__MAX_FRAME_SIZE * 100.
> > 
> > Due to other quirks of the ZC configuration in ice, panic is not
> > observed in ZC mode, but tailroom growing still fails when it should
> > not.
> > 
> > Use fill queue buffer truesize instead of DMA write size in XDP RxQ
> > info.
> > Fix ZC mode too by using the new helper.
> > 
> > Fixes: 2fba7dc5157b ("ice: Add support for XDP multi-buffer on Rx
> > side")
> > Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@xxxxxxxxx>
> > Signed-off-by: Larysa Zaremba <larysa.zaremba@xxxxxxxxx>
> > ---
> 
> ...
>  
> > --
> > 2.52.0
>