Re: [PATCH net v2 2/2] octeon_ep_vf: fix skb frags overflow in the RX path

[Maciej Fijalkowski]

On Fri, Jul 03, 2026 at 02:05:18AM +0800, Maoyi Xie wrote:
> __octep_vf_oq_process_rx() has the same unbounded fragment loop as the PF
> driver. buff_info->len comes from the device response header, and one
> fragment is added per buffer_size chunk with no check against
> MAX_SKB_FRAGS. A long packet yields about 18 fragments, one past the
> default MAX_SKB_FRAGS of 17, so skb_add_rx_frag() writes past
> shinfo->frags[].
> 
> The fragment count is now checked before napi_build_skb(). A packet that
> needs more fragments than the skb can hold is dropped. Its descriptors are
> drained the same way the build_skb failure path does.
> 
> Fixes: 1cd3b407977c ("octeon_ep_vf: add Tx/Rx processing and interrupt support")
> Co-developed-by: Kaixuan Li <kaixuan.li@xxxxxxxxxx>
> Signed-off-by: Kaixuan Li <kaixuan.li@xxxxxxxxxx>
> Signed-off-by: Maoyi Xie <maoyixie.tju@xxxxxxxxx>
> ---
>  .../marvell/octeon_ep_vf/octep_vf_rx.c        | 20 +++++++++++++++++++
>  1 file changed, 20 insertions(+)
> 
> diff --git a/drivers/net/ethernet/marvell/octeon_ep_vf/octep_vf_rx.c b/drivers/net/ethernet/marvell/octeon_ep_vf/octep_vf_rx.c
> index d982474082..7af6a80671 100644
> --- a/drivers/net/ethernet/marvell/octeon_ep_vf/octep_vf_rx.c
> +++ b/drivers/net/ethernet/marvell/octeon_ep_vf/octep_vf_rx.c
> @@ -431,6 +431,26 @@ static int __octep_vf_oq_process_rx(struct octep_vf_device *oct,
>  			struct skb_shared_info *shinfo;
>  			u16 data_len;
>  
> +			data_len = buff_info->len - oq->max_single_buffer_size;
> +			if (DIV_ROUND_UP(data_len, oq->buffer_size) > MAX_SKB_FRAGS) {
> +				desc_used++;
> +				read_idx = octep_vf_oq_next_idx(oq, read_idx);
> +				while (data_len) {
> +					dma_unmap_page(oq->dev, oq->desc_ring[read_idx].buffer_ptr,
> +						       PAGE_SIZE, DMA_FROM_DEVICE);
> +					buff_info = (struct octep_vf_rx_buffer *)
> +						    &oq->buff_info[read_idx];
> +					buff_info->page = NULL;
> +					if (data_len < oq->buffer_size)
> +						data_len = 0;
> +					else
> +						data_len -= oq->buffer_size;
> +					desc_used++;
> +					read_idx = octep_vf_oq_next_idx(oq, read_idx);
> +				}
> +				continue;
> +			}

This is exactly repeated code for !skb case below, right? Please pull it
out to helper function then.

> +
>  			skb = napi_build_skb((void *)resp_hw, PAGE_SIZE);
>  			if (!skb) {
>  				oq->stats->alloc_failures++;
> -- 
> 2.34.1
>