From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mgamail.intel.com (mgamail.intel.com [192.198.163.14]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2E20036B057; Tue, 17 Feb 2026 13:54:46 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=192.198.163.14 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1771336487; cv=none; b=WozCQV/F2KnPIgl9R1MKJzpODtXt2Hsrb8fAeHt48hOeJHuD5Mb+gI9dq9GmCDMZtNQtWtbNZP3UoWdDKBezrqxUt0gNnL3Bi3wtXl849vlvRVoQvI+EL89SeW/I/uJl2+OIupJU52EzUsTWOUGAwHB2i7gDBnJp47KV+CsR+z4= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1771336487; c=relaxed/simple; bh=IM78JRWt+y/w2RyjvbJ7PZHjrkyXfpiFs71/8NtY6q8=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=mFwegtqwLENtpK2ymwFTztSYY4VPB5lZ4Hq00W6DWQGqoCZEHDTq0Jb6tSWDiWik5tYIhKCIWunOtV8fyOuDwvXqDTWXAVU2LPEv6FTduEWUdvTsxqZf9q6HDnO3bNp/w3gwbchJd192k/e5LACUxvEHr7Y5A5MBxRb7gEyBCFQ= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=intel.com; spf=pass smtp.mailfrom=intel.com; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b=KWuqxCR0; arc=none smtp.client-ip=192.198.163.14 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=intel.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=intel.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b="KWuqxCR0" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1771336486; x=1802872486; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=IM78JRWt+y/w2RyjvbJ7PZHjrkyXfpiFs71/8NtY6q8=; b=KWuqxCR0HxnyHzX4I7xCBJJw6t18kX7DoPR8DymeHX6r1MJo0os8ha4H rgEw5LUzBLCf7Al0zq3b5xdLhwADp5cy/wp2GV8Mey5zSw5QzY4T7wWYW Qlr3c3dkyFhekXZIN6KwcTuQh0FESwDLMJ0Gfm2fwJP9BK4el01BC8Uzv InoS8DhcAalYX2k4ynAuPPcsCzIiju/rv9Kqb0w6+F1TyTZJ77fdeT8/H mQEaSFKr6qmLsELyGSAPs9aw2qPxdPNgoyrkfsUk+R5uiyXqVpDquxYAv /hUmXUQew+BO2j/MVxRDQ8LfX1VT/jP/KR1pmtvJAgG8goQIhhHb47blO w==; X-CSE-ConnectionGUID: 8mipo/31RIqY3KYgT7M1eA== X-CSE-MsgGUID: 8DMoOBLBSg2DfOKn60grcA== X-IronPort-AV: E=McAfee;i="6800,10657,11703"; a="72470428" X-IronPort-AV: E=Sophos;i="6.21,296,1763452800"; d="scan'208";a="72470428" Received: from orviesa008.jf.intel.com ([10.64.159.148]) by fmvoesa108.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 17 Feb 2026 05:54:46 -0800 X-CSE-ConnectionGUID: p2FlM6ICS0+Ihjnu2sPCug== X-CSE-MsgGUID: XQnBphauQpupyoljDthLNw== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.21,296,1763452800"; d="scan'208";a="213904633" Received: from irvmail002.ir.intel.com ([10.43.11.120]) by orviesa008.jf.intel.com with ESMTP; 17 Feb 2026 05:54:38 -0800 Received: from lincoln.igk.intel.com (lincoln.igk.intel.com [10.102.21.235]) by irvmail002.ir.intel.com (Postfix) with ESMTP id 93BB228794; Tue, 17 Feb 2026 13:54:34 +0000 (GMT) From: Larysa Zaremba To: bpf@vger.kernel.org Cc: Larysa Zaremba , Claudiu Manoil , Vladimir Oltean , Wei Fang , Clark Wang , Andrew Lunn , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Tony Nguyen , Przemek Kitszel , Alexei Starovoitov , Daniel Borkmann , Jesper Dangaard Brouer , John Fastabend , Stanislav Fomichev , Andrii Nakryiko , Martin KaFai Lau , Eduard Zingerman , Song Liu , Yonghong Song , KP Singh , Hao Luo , Jiri Olsa , Simon Horman , Shuah Khan , Alexander Lobakin , Maciej Fijalkowski , "Bastien Curutchet (eBPF Foundation)" , Tushar Vyavahare , Jason Xing , =?UTF-8?q?Ricardo=20B=2E=20Marli=C3=A8re?= , Eelco Chaudron , Lorenzo Bianconi , Toke Hoiland-Jorgensen , imx@lists.linux.dev, netdev@vger.kernel.org, linux-kernel@vger.kernel.org, intel-wired-lan@lists.osuosl.org, linux-kselftest@vger.kernel.org, Aleksandr Loktionov , Dragos Tatulea Subject: [PATCH bpf v3 4/9] ice: change XDP RxQ frag_size from DMA write length to xdp.frame_sz Date: Tue, 17 Feb 2026 14:24:42 +0100 Message-ID: <20260217132450.1936200-5-larysa.zaremba@intel.com> X-Mailer: git-send-email 2.52.0 In-Reply-To: <20260217132450.1936200-1-larysa.zaremba@intel.com> References: <20260217132450.1936200-1-larysa.zaremba@intel.com> Precedence: bulk X-Mailing-List: netdev@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit The only user of frag_size field in XDP RxQ info is bpf_xdp_frags_increase_tail(). It clearly expects whole buff size instead of DMA write size. Different assumptions in ice driver configuration lead to negative tailroom. This allows to trigger kernel panic, when using XDP_ADJUST_TAIL_GROW_MULTI_BUFF xskxceiver test and changing packet size to 6912 and the requested offset to a huge value, e.g. XSK_UMEM__MAX_FRAME_SIZE * 100. Due to other quirks of the ZC configuration in ice, panic is not observed in ZC mode, but tailroom growing still fails when it should not. Use fill queue buffer truesize instead of DMA write size in XDP RxQ info. Fix ZC mode too by using the new helper. Fixes: 2fba7dc5157b ("ice: Add support for XDP multi-buffer on Rx side") Reviewed-by: Aleksandr Loktionov Signed-off-by: Larysa Zaremba --- drivers/net/ethernet/intel/ice/ice_base.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/drivers/net/ethernet/intel/ice/ice_base.c b/drivers/net/ethernet/intel/ice/ice_base.c index 511d803cf0a4..27ab899a4052 100644 --- a/drivers/net/ethernet/intel/ice/ice_base.c +++ b/drivers/net/ethernet/intel/ice/ice_base.c @@ -659,7 +659,6 @@ static int ice_vsi_cfg_rxq(struct ice_rx_ring *ring) { struct device *dev = ice_pf_to_dev(ring->vsi->back); u32 num_bufs = ICE_DESC_UNUSED(ring); - u32 rx_buf_len; int err; if (ring->vsi->type == ICE_VSI_PF || ring->vsi->type == ICE_VSI_SF) { @@ -669,12 +668,12 @@ static int ice_vsi_cfg_rxq(struct ice_rx_ring *ring) return err; if (ring->xsk_pool) { - rx_buf_len = - xsk_pool_get_rx_frame_size(ring->xsk_pool); + u32 frag_size = + xsk_pool_get_rx_frag_step(ring->xsk_pool); err = __xdp_rxq_info_reg(&ring->xdp_rxq, ring->netdev, ring->q_index, ring->q_vector->napi.napi_id, - rx_buf_len); + frag_size); if (err) return err; err = xdp_rxq_info_reg_mem_model(&ring->xdp_rxq, @@ -694,7 +693,7 @@ static int ice_vsi_cfg_rxq(struct ice_rx_ring *ring) err = __xdp_rxq_info_reg(&ring->xdp_rxq, ring->netdev, ring->q_index, ring->q_vector->napi.napi_id, - ring->rx_buf_len); + ring->truesize); if (err) goto err_destroy_fq; -- 2.52.0