Re: [PATCH net-next v9 7/7] net: bcmgenet: reject MTU changes incompatible with XDP

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Low] The introduced `ndo_change_mtu` callback is entirely dead code based on a false premise.
--

commit 4a63ea349d9dde80e552364564a8fc480bce7552
Author: Nicolai Buchwitz <nb@tipi-net.de>

net: bcmgenet: reject MTU changes incompatible with XDP

Add a minimal ndo_change_mtu that rejects MTU values too large for
single-page XDP buffers when an XDP program is attached.

> diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
> --- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c
> +++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
> @@ -4095,6 +4095,20 @@ static int bcmgenet_xdp_xmit(struct net_device *dev, int num_frames,
[ ... ]
> +static int bcmgenet_change_mtu(struct net_device *dev, int new_mtu)
> +{
> +	struct bcmgenet_priv *priv = netdev_priv(dev);
> +
> +	if (priv->xdp_prog && new_mtu > PAGE_SIZE - GENET_RX_HEADROOM -
> +	    SKB_DATA_ALIGN(sizeof(struct skb_shared_info))) {

Is this check actually reachable?

The networking core (dev_validate_mtu()) strictly enforces that any
requested MTU cannot exceed dev->max_mtu. Because the bcmgenet driver
does not manually override dev->max_mtu, it inherits the default value
of ETH_DATA_LEN (1500 bytes) set by ether_setup().

On a system with the minimum 4KB page size, the right side of this
condition evaluates to approximately 3400 bytes. Since new_mtu is
strictly bounded to 1500, the condition new_mtu > ~3400 seems
mathematically impossible to satisfy, rendering the check dead code.

Additionally, the driver statically configures the hardware MAC to a
maximum frame length of 1522 bytes (ENET_MAX_MTU_SIZE) and the DMA ring
to a maximum receive buffer length of 2048 bytes (RX_BUF_LENGTH). Thus,
a buffer overflow rewriting the skb_shared_info appears structurally
impossible even if the MTU check were somehow bypassed.

> +		netdev_warn(dev, "MTU too large for single-page XDP buffer\n");
> +		return -EINVAL;
> +	}
> +
> +	WRITE_ONCE(dev->mtu, new_mtu);
> +	return 0;
> +}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260506095553.55357-1-nb@tipi-net.de?part=7