[PATCH net] net: ena: avoid RX copybreak for multi-descriptor packets

[PATCH net] net: ena: avoid RX copybreak for multi-descriptor packets

[Avi Weiss]

ena_rx_skb() selects the copybreak path based on the first RX
descriptor's length without checking the number of descriptors. When
a packet spans multiple descriptors, this copies only the first
buffer into the skb and fails to recycle the remaining request IDs,
while RX cleanup advances by the full descriptor count.

Restrict copybreak to single-descriptor packets and apply the same
restriction to the rx_copybreak_pkt statistic. Multi-descriptor
packets then use the existing fragment-processing path.

Discovered by comparing the in-tree ENA driver with Amazon's
standalone ENA driver.

Compiled with W=1 under x86_64 defconfig.

Fixes: 1738cd3ed342 ("net: ena: Add a driver for Amazon Elastic Network Adapters (ENA)")
Signed-off-by: Avi Weiss <thnkslprpt@gmail.com>
---
Already fixed in Amazon's standalone ENA driver:
https://github.com/amzn/amzn-drivers/commit/8c47df628bbc6623bd9a419f261ccc46abbd36de

 drivers/net/ethernet/amazon/ena/ena_netdev.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/amazon/ena/ena_netdev.c b/drivers/net/ethernet/amazon/ena/ena_netdev.c
index 7eb6456ed0d5..80f5d08305c2 100644
--- a/drivers/net/ethernet/amazon/ena/ena_netdev.c
+++ b/drivers/net/ethernet/amazon/ena/ena_netdev.c
@@ -986,7 +986,7 @@ static struct sk_buff *ena_rx_skb(struct ena_ring *rx_ring,
 	page_offset = rx_info->page_offset;
 	buf_addr = page_address(rx_info->page) + page_offset;
 
-	if (len <= rx_ring->rx_copybreak) {
+	if (len <= rx_ring->rx_copybreak && likely(descs == 1)) {
 		skb = ena_alloc_skb(rx_ring, NULL, len);
 		if (unlikely(!skb))
 			return NULL;
@@ -1293,7 +1293,8 @@ static int ena_clean_rx_irq(struct ena_ring *rx_ring, struct napi_struct *napi,
 
 		skb_record_rx_queue(skb, rx_ring->qid);
 
-		if (rx_ring->ena_bufs[0].len <= rx_ring->rx_copybreak)
+		if (rx_ring->ena_bufs[0].len <= rx_ring->rx_copybreak &&
+		    ena_rx_ctx.descs == 1)
 			rx_copybreak_pkt++;
 
 		total_len += skb->len;

base-commit: 1d5e2c57e9ffc134e14b3f837c8d7c53b508bd22
-- 
2.43.0

Re: [PATCH net] net: ena: avoid RX copybreak for multi-descriptor packets

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Mon,  9 Nov 2026 16:13:44 +0200 you wrote:
> ena_rx_skb() selects the copybreak path based on the first RX
> descriptor's length without checking the number of descriptors. When
> a packet spans multiple descriptors, this copies only the first
> buffer into the skb and fails to recycle the remaining request IDs,
> while RX cleanup advances by the full descriptor count.
> 
> Restrict copybreak to single-descriptor packets and apply the same
> restriction to the rx_copybreak_pkt statistic. Multi-descriptor
> packets then use the existing fragment-processing path.
> 
> [...]

Here is the summary with links:
  - [net] net: ena: avoid RX copybreak for multi-descriptor packets
    https://git.kernel.org/netdev/net/c/f3c790c34d22

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html