Re: [PATCH net] octeontx2-pf: fix XDP frames freed as skbs on interface down

[Daniel Machon]

Hi Nicolai,

> On interface down, the TX completion cleanup also runs on the XDP
> queues, but treats the pending xdp_frames as skbs. Freeing them with
> dev_kfree_skb_any() corrupts page pool memory.
> 
> This happens when XDP_TX or redirected packets are still in flight on
> ifdown, or when the XDP program is replaced.
> 
> Fixes: 94c80f748873 ("octeontx2-pf: use xdp_return_frame() to free xdp buffers")
> Signed-off-by: Nicolai Buchwitz <nb@xxxxxxxxxxx>
> ---
> Pre-existing bug, flagged by the clashiko review of my ipsec transmit
> fixes for this driver [1], which seems reasonable (and fixable) to me.
> 
> The other pre-existing findings there (e.g. the SA lifetime in
> cn10k_ipsec_del_state()) may be worth fixing too, but I'll leave those
> to the maintainers.
> 
> Compile-tested only, I have no octeontx2 hardware.
> 
> [1] https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20261027-nb-otx2-ipsec-tx-fixes-net-v1-0-2114c4f10c36%40tipi-net.de
> ---
>  drivers/net/ethernet/marvell/octeontx2/nic/otx2_txrx.c | 5 +++++
>  1 file changed, 5 insertions(+)
> 
> diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_txrx.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_txrx.c
> index 90af9b9044aa0..e3b07e5335fb8 100644
> --- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_txrx.c
> +++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_txrx.c
> @@ -1332,6 +1332,7 @@ void otx2_cleanup_tx_cqes(struct otx2_nic *pfvf, struct otx2_cq_queue *cq)
>  	struct nix_cqe_tx_s *cqe;
>  	struct netdev_queue *txq;
>  	int processed_cqe = 0;
> +	int xsk_frames = 0;
>  	struct sg_list *sg;
>  	int qidx;
>  
> @@ -1348,6 +1349,10 @@ void otx2_cleanup_tx_cqes(struct otx2_nic *pfvf, struct otx2_cq_queue *cq)
>  
>  		if (!cqe)
>  			continue;
> +		if (cq->cq_type == CQ_XDP) {
> +			otx2_xdp_snd_pkt_handler(pfvf, sq, cqe, &xsk_frames);

Any reason xsk_frames is never handed to xsk_tx_completed()?

> +			continue;
> +		}
>  		sg = &sq->sg[cqe->comp.sqe_id];
>  		skb = (struct sk_buff *)sg->skb;
>  		if (skb) {
> 
> ---
> base-commit: d8a4f4c59da52b7c31ae337243b8473a19a3f819
> change-id: 20261028-nb-otx2-xdp-cqe-cleanup-net-5810d40e1d30
> 
> Best regards,
> --  
> Nicolai Buchwitz <nb@xxxxxxxxxxx>
> 

/Daniel