Re: [PATCH net v4 2/2] net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry

[Dragos Tatulea <dtatulea@nvidia.com>]

On 24.08.26 16:16, Jerome Tollet wrote:
> With AF_XDP on a striding RQ, mlx5e defers releasing XSK buffers until
> an MPWQE is refilled. If XSK allocation then returns -ENOMEM,
> actual_wq_head is not advanced and a later NAPI poll retries the same
> WQE.
> 
> mlx5e_free_rx_mpwqe() leaves each released slot marked as releasable. On
> retry it can therefore call xsk_buff_free() again through stale pointers
> after the frames have returned to the XSK pool and been reallocated.
> 
> Set all skip_release_bitmap bits in the common error path of
> mlx5e_xsk_alloc_rx_mpwqe(). This matches mlx5e_alloc_rx_mpwqe(). A
> successful allocation already clears the bitmap after replacing every
> buffer, so retries become idempotent without changing the success path.
> 
> Fault injection forced three consecutive failures for one selected MPWQE.
> Both an early allocation failure and a partial 8-of-16-buffer unwind
> released the original 16 XSK buffers only once. Each error left a full
> bitmap, the following NAPI retry skipped the release, and a later
> successful allocation cleared it. A 20-second AF_XDP zero-copy pressure
> run exercised 1,575,262 buffer allocation failures without invalid
> descriptors, WQE errors, or kernel warnings.
> 
> Fixes: 4c2a13236807 ("net/mlx5e: RX, Defer page release in striding rq for better recycling")
> Cc: stable@vger.kernel.org
> Signed-off-by: Jerome Tollet <jtollet@cisco.com>
> ---
>  drivers/net/ethernet/mellanox/mlx5/core/en/xsk/rx.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/xsk/rx.c b/drivers/net/ethernet/mellanox/mlx5/core/en/xsk/rx.c
> index 4f984f6a2cb9..55ec6387ab28 100644
> --- a/drivers/net/ethernet/mellanox/mlx5/core/en/xsk/rx.c
> +++ b/drivers/net/ethernet/mellanox/mlx5/core/en/xsk/rx.c
> @@ -3,6 +3,7 @@
>  
>  #include "rx.h"
>  #include "en/xdp.h"
> +#include <linux/bitmap.h>
>  #include <net/xdp_sock_drv.h>
>  #include <linux/filter.h>
>  
> @@ -156,6 +157,7 @@ err_reuse_batch:
>  		xsk_buff_free(xsk_buffs[batch]);
>  
>  err:
> +	bitmap_fill(wi->skip_release_bitmap, rq->mpwqe.pages_per_wqe);
>  	rq->stats->buff_alloc_err++;
>  	return -ENOMEM;
>  }

Reviewed-by: Dragos Tatulea <dtatulea@nvidia.com>

Thanks,
Dragos