Re: [PATCH net] net: mana: never hand a non-page_pool buffer to XDP

[Simon Horman <horms@kernel.org>]

On Thu, Sep 10, 2026 at 11:17:47AM -0400, Gunter Woytowitz wrote:
> mana_create_rxq() registers MEM_TYPE_PAGE_POOL for the rxq
> unconditionally, so every buffer XDP can see must be owned by that
> page_pool: on XDP_REDIRECT the frame is freed through __xdp_return()
> -> page_pool_put_full_page().
> 
> mana_xdp_set() assigns apc->bpf_prog before calling
> mana_pre_alloc_rxbufs(), which allocates with dev_alloc_pages(), and
> mana_fill_rx_oob() prefers those buffers whenever mpc->rxbufs_pre is
> set, leaving from_pool false. So for a port that is up when a program
> is attached, the entire re-created ring is filled with pages the
> page_pool does not own.
> 
> The page_pool then sees pp_ref_count == 0 when such a frame is
> returned, so the atomic_long_sub_return() in page_pool_unref_netmem()
> goes negative and trips its WARN_ON(ret < 0), once per redirected
> frame. Observed on a 5.14-based distro kernel, where that warning sits
> at helpers.h:269:
> 
>   WARNING: CPU: 3 PID: 0 at include/net/page_pool/helpers.h:269
>                                             __xdp_return+0x2b3/0x2c0
>   mana_process_rx_cqe -> mana_run_xdp -> mana_rx_skb -> xsk_map_redirect
>                                             -> __xdp_return
> 
> On a VM booted with console=ttyS0 the resulting stack traces peg the
> console thread and the machine becomes unusable.
> 
> Fill from the page_pool when a program is attached, using
> mana_xdp_get() -- the predicate mana_get_rxbuf_cfg() already uses to
> choose the XDP buffer geometry. With no program attached nothing
> changes, so the pre-allocation still does its job of keeping
> mana_attach() from failing on allocation.
> 
> Leaving the pre-allocated buffers unconsumed is safe:
> mana_pre_dealloc_rxbufs() dma-unmaps and put_page()s the remainder,
> and every caller (mana_xdp_set(), mana_change_mtu(), and both ethtool
> ring and channel paths) already runs it after mana_attach().
> 
> The rxq->xdp_save_va reuse in mana_get_rxfrag() also leaves from_pool
> false, but that cache is fed only by the drop path's non-pool branch,
> which this change makes unreachable while a program is attached, so
> it needs no fix.
> 
> Found and fixed on a 5.14-based distro kernel running AF_XDP over
> MANA in copy mode: 24M+ redirected frames with no warnings, where the
> unpatched driver warned on essentially every redirected frame. All of
> the code involved is unchanged in mainline.
> 
> Fixes: b1d13f7a3b53 ("net: mana: Add page pool for RX buffers")
> Signed-off-by: Gunter Woytowitz <gunter@vcinity.io>

Unfortunately the CI failed to apply this patch to net.
Which is curious, because I am able to apply it locally.

But perhaps it would be best to (rebase and?) repost
after waiting for the usual 24h[*] to elapse.

[*] https://docs.kernel.org/process/maintainer-netdev.html

-- 
pw-bot: changes-requested