Re: [PATCH net v2 3/4] net: mvpp2: do not return retired RX buffers to BM

[Jakub Kicinski <kuba@kernel.org>]

On Tue,  2 Jun 2026 18:46:34 +0200 Til Kaiser wrote:
> The RX refill failure path jumps to err_drop_frame, which returns the
> descriptor buffer to the hardware BM pool. That is only valid while the
> driver still owns the buffer.
> 
> After a non-PASS XDP verdict, mvpp2_run_xdp() may already have recycled,
> redirected, or queued the page for XDP_TX. After build_skb(), freeing the
> skb on refill failure also retires the data buffer. Returning either of
> those buffers to BM lets hardware DMA into memory that is no longer owned
> by the RX ring.
> 
> Split the error handling so buffers are returned to BM only while still
> owned by the driver. Once XDP or an skb owns the buffer, only account the
> RX error. Mark page-pool skbs for recycle before they can be freed on the
> refill failure path, and unmap non-page-pool buffers before freeing them.

As Gemini points out the driver seems to be following the "if I can't
allocate a new buffer I'll drop the packet and give the current buffer
back to the HW" flow. So after your change on allocation error we're
permanently leaking a slot on in the buffer pool. Leaking as in it will
never be filled, if it happens enough times the pool will be empty,
and no Rx can happen.
-- 
pw-bot: cr