Re: [REGRESSION] Commit 447cbe95ebb9 causes IOMMU DMA faults on macvlan/vlan with bnxt_en

["Fabian Grünbichler" <f.gruenbichler@proxmox.com>]

On October 5, 2026 3:59 am, Eric Dumazet wrote:
> 
> 
> On 10/5/26 00:29, Michael Chan wrote:
>> 
>> I think skb->len is not updated with the padded length here.  So the
>> HW will drop the packet seeing that the length is too short.  There is
>> another skb_put_padto() that might work better?
> 
> +1 Exactly, thanks!

FWIW, we suspect we have quite a few users running into this since
importing upstream changes from 7.2.2-7.2.5.

Will report back once we've provided those users with a kernel with the
below diff.

> diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c 
> b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
> index 
> d7728d0c5b6e63ee72de9dea54426bb4c8b7a9fc..7ea27e81e88c5ca82a453b449982b791e8acc831 
> 100644
> --- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
> +++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
> @@ -486,7 +486,7 @@ static netdev_tx_t bnxt_start_xmit(struct sk_buff 
> *skb, struct net_device *dev)
>          struct netdev_queue *txq;
>          int i;
>          dma_addr_t mapping;
> -       unsigned int length, pad = 0;
> +       unsigned int length;
>          u32 len, free_size, vlan_tag_flags, cfa_action, flags;
>          struct bnxt_ptp_cfg *ptp = bp->ptp_cfg;
>          struct pci_dev *pdev = bp->pdev;
> @@ -672,14 +672,12 @@ static netdev_tx_t bnxt_start_xmit(struct sk_buff 
> *skb, struct net_device *dev)
>          }
> 
>   normal_tx:
> -       if (length < BNXT_MIN_PKT_SIZE) {
> -               pad = BNXT_MIN_PKT_SIZE - length;
> -               if (skb_pad(skb, pad))
> -                       /* SKB already freed. */
> -                       goto tx_kick_pending;
> -               length = BNXT_MIN_PKT_SIZE;
> +       if (skb_put_padto(skb, BNXT_MIN_PKT_SIZE)) {
> +               /* SKB already freed. */
> +               goto tx_kick_pending;
>          }
> -
> +       length = skb->len;
> +       len = skb_headlen(skb);
>          mapping = dma_map_single(&pdev->dev, skb->data, len, 
> DMA_TO_DEVICE);
> 
>          if (unlikely(dma_mapping_error(&pdev->dev, mapping)))
> @@ -759,10 +757,7 @@ static netdev_tx_t bnxt_start_xmit(struct sk_buff 
> *skb, struct net_device *dev)
>                  txbd->tx_bd_len_flags_type = cpu_to_le32(flags);
>          }
> 
> -       flags &= ~TX_BD_LEN;
> -       txbd->tx_bd_len_flags_type =
> -               cpu_to_le32(((len + pad) << TX_BD_LEN_SHIFT) | flags |
> -                           TX_BD_FLAGS_PACKET_END);
> +       txbd->tx_bd_len_flags_type |= cpu_to_le32(TX_BD_FLAGS_PACKET_END);
> 
>          netdev_tx_sent_queue(txq, skb->len);
> 
> 
> 
> 
>