Re: [PATCH net v5 0/3] octeon_ep, octeon_ep_vf: fix RX skb frags overflow and page leak

[Maciej Fijalkowski]

On Thu, Jul 16, 2026 at 02:34:29PM +0800, Maoyi Xie wrote:
> The octeon_ep and octeon_ep_vf RX paths add one skb fragment per buffer
> with no bound against MAX_SKB_FRAGS. buff_info->len comes from the device
> response header. A long packet needs about 18 fragments. That is one past
> the default MAX_SKB_FRAGS of 17, so skb_add_rx_frag() writes past
> shinfo->frags[]. Patch 1 bounds octeon_ep. Patch 3 bounds octeon_ep_vf.
> 
> Patch 2 is Guangshuo Li's fix for an octeon_ep_vf RX page leak on the
> napi_build_skb() failure path. It touches the same drop code as patch 3.
> I carry it here so the series applies without conflict, per Maciej. Patch 3
> moves that drain loop into a helper. The helper carries the page frees from
> patch 2, so the overflow drop path frees its pages too.
> 
> octeon_ep has the same leak on its drop path. A separate patch will fix it
> once this series lands.
> 
> v5:
>  - octeon_ep, octeon_ep_vf: widen data_len to u32, per Simon Horman.
>    buff_info->len is a u64, a u16 could truncate a long length.
>  - octeon_ep: dropped Maciej Fijalkowski's Reviewed-by, the check changed.
>  - octeon_ep_vf: the drop helper drains the length in a u32 too.

The check changed however I provided certain suggestions that are included
in this set (checking frags before build_skb, wrapping common code to
helper), so I feel I still can have my review here.

For the series:
Reviewed-by: Maciej Fijalkowski <maciej.fijalkowski@xxxxxxxxx>

> 
> v1: https://lore.kernel.org/r/20260701112825.1653044-1-maoyixie.tju@xxxxxxxxx
> v2: https://lore.kernel.org/r/20260702180518.2013324-1-maoyixie.tju@xxxxxxxxx
> v3: https://lore.kernel.org/r/20260704061511.2350737-1-maoyixie.tju@xxxxxxxxx
> v4: https://lore.kernel.org/r/20260706150208.2944898-1-maoyixie.tju@xxxxxxxxx
> 
> Guangshuo Li (1):
>   octeon_ep_vf: Fix RX page leak on napi_build_skb() failure
> 
> Maoyi Xie (2):
>   octeon_ep: fix skb frags overflow in the RX path
>   octeon_ep_vf: fix skb frags overflow in the RX path
> 
>  .../net/ethernet/marvell/octeon_ep/octep_rx.c |  9 ++++
>  .../marvell/octeon_ep_vf/octep_vf_rx.c        | 51 ++++++++++++-------
>  2 files changed, 43 insertions(+), 17 deletions(-)
> 
> --
> 2.34.1
>