Re: [PATCH net-next v7 7/7] net: bcmgenet: reject MTU changes incompatible with XDP

[sashiko-bot@kernel.org]

Sashiko AI review found 1 potential issue(s):
- [Medium] The added XDP MTU bounds check in `bcmgenet_change_mtu` is mathematically dead code and contains a logic error regarding L2 overhead.
--

commit ed63f1ac315cb265c4f6425861261ded1cad7433
Author: Nicolai Buchwitz <nb@tipi-net.de>

net: bcmgenet: reject MTU changes incompatible with XDP

Add a minimal ndo_change_mtu that rejects MTU values too large for
single-page XDP buffers when an XDP program is attached.

> diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
> index 02ad2f410d6c6..4d1ec68ec0c59 100644
> --- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c
> +++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
> @@ -4085,6 +4085,20 @@ static int bcmgenet_xdp_xmit(struct net_device *dev, int num_frames,
>  	return sent;
>  }
>  
> +static int bcmgenet_change_mtu(struct net_device *dev, int new_mtu)
> +{
> +	struct bcmgenet_priv *priv = netdev_priv(dev);
> +
> +	if (priv->xdp_prog && new_mtu > PAGE_SIZE - GENET_RX_HEADROOM -
> +	    SKB_DATA_ALIGN(sizeof(struct skb_shared_info))) {

Is this check reachable? The bcmgenet driver appears to rely on the
ether_setup() default of dev->max_mtu = ETH_DATA_LEN (1500) and never
overrides it to support jumbo frames.

The core networking stack's dev_validate_mtu() enforces new_mtu <=
dev->max_mtu before invoking ndo_change_mtu. Assuming a minimum Linux
PAGE_SIZE of 4096, this check requires new_mtu to be greater than ~3510
bytes, which should never be possible.

Also, does this formula account for L2 overhead?

new_mtu represents the L3 payload size, but the hardware will DMA the full L2
frame into the buffer, including the Ethernet header, VLAN tags, and the
Frame Check Sequence. If jumbo frames are enabled later and an MTU exactly
matched this limit, would the L2 frame silently overflow the page boundary
and corrupt the skb_shared_info structure?

> +		netdev_warn(dev, "MTU too large for single-page XDP buffer\n");
> +		return -EINVAL;
> +	}
> +
> +	WRITE_ONCE(dev->mtu, new_mtu);
> +	return 0;
> +}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260416054743.1289191-1-nb@tipi-net.de?part=7