Re: [PATCH net] octeontx2-pf: fix XDP frames freed as skbs on interface down

From: Ratheesh Kannoth

Date: Sun Nov 01 2026 - 23:29:31 EST


On 2026-10-31 at 01:42:03, Nicolai Buchwitz (nb@xxxxxxxxxxx) wrote:
> On interface down, the TX completion cleanup also runs on the XDP
> queues, but treats the pending xdp_frames as skbs. Freeing them with
> dev_kfree_skb_any() corrupts page pool memory.
>
> This happens when XDP_TX or redirected packets are still in flight on
> ifdown, or when the XDP program is replaced.
>
> Fixes: 94c80f748873 ("octeontx2-pf: use xdp_return_frame() to free xdp buffers")
> Signed-off-by: Nicolai Buchwitz <nb@xxxxxxxxxxx>
> ---
> Pre-existing bug, flagged by the clashiko review of my ipsec transmit
> fixes for this driver [1], which seems reasonable (and fixable) to me.
>
> The other pre-existing findings there (e.g. the SA lifetime in
> cn10k_ipsec_del_state()) may be worth fixing too, but I'll leave those
> to the maintainers.
>
Thank you.

Reviewed-by: Ratheesh Kannoth <rkannoth@xxxxxxxxxxx>