[PATCH] net: mvpp2: fix skb not reflecting XDP modifications on XDP_PASS

[PATCH] net: mvpp2: fix skb not reflecting XDP modifications on XDP_PASS

[Til Kaiser]

When an XDP program uses bpf_xdp_adjust_head() or bpf_xdp_adjust_tail()
and then returns XDP_PASS, the driver ignores the updated xdp_buff
pointers and builds the skb from hardcoded offsets derived from the
original RX descriptor. This means any packet modifications made by the
XDP program are silently discarded before the skb reaches the network
stack.

Fix this by saving the post-XDP data pointer offset and length back into
rx_offset and rx_bytes when XDP_PASS is returned, so the subsequent
skb_reserve()/skb_put() calls use the actual packet geometry as seen by
the XDP program. When no XDP program is loaded the variables retain
their original descriptor-derived values and the non-XDP fast path is
unaffected.

Fixes: 07dd0a7aae7f ("mvpp2: add basic XDP support")
Signed-off-by: Til Kaiser <mail@tk154.de>
---
 drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
index f442b874bb59..27d4feebcb59 100644
--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
+++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
@@ -3920,7 +3920,7 @@ static int mvpp2_rx(struct mvpp2_port *port, struct napi_struct *napi,
 		unsigned int frag_size;
 		dma_addr_t dma_addr;
 		phys_addr_t phys_addr;
-		int pool, rx_bytes, err, ret;
+		int pool, rx_bytes, rx_offset, err, ret;
 		struct page *page;
 		void *data;
 
@@ -3933,6 +3933,7 @@ static int mvpp2_rx(struct mvpp2_port *port, struct napi_struct *napi,
 		rx_status = mvpp2_rxdesc_status_get(port, rx_desc);
 		rx_bytes = mvpp2_rxdesc_size_get(port, rx_desc);
 		rx_bytes -= MVPP2_MH_SIZE;
+		rx_offset = MVPP2_MH_SIZE + MVPP2_SKB_HEADROOM;
 		dma_addr = mvpp2_rxdesc_dma_addr_get(port, rx_desc);
 
 		pool = (rx_status & MVPP2_RXD_BM_POOL_ID_MASK) >>
@@ -3998,6 +3999,10 @@ static int mvpp2_rx(struct mvpp2_port *port, struct napi_struct *napi,
 				continue;
 			}
 
+			/* Update offset and length to reflect any XDP adjustments. */
+			rx_offset = xdp.data     - data;
+			rx_bytes  = xdp.data_end - xdp.data;
+
 			metasize = xdp.data - xdp.data_meta;
 		}
 
@@ -4036,7 +4041,7 @@ static int mvpp2_rx(struct mvpp2_port *port, struct napi_struct *napi,
 		ps.rx_packets++;
 		ps.rx_bytes += rx_bytes;
 
-		skb_reserve(skb, MVPP2_MH_SIZE + MVPP2_SKB_HEADROOM);
+		skb_reserve(skb, rx_offset);
 		skb_put(skb, rx_bytes);
 		if (metasize)
 			skb_metadata_set(skb, metasize);
-- 
2.54.0

Re: [PATCH] net: mvpp2: fix skb not reflecting XDP modifications on XDP_PASS

[Jakub Kicinski]

On Sun, 24 May 2026 14:23:34 +0200 Til Kaiser wrote:
> When an XDP program uses bpf_xdp_adjust_head() or bpf_xdp_adjust_tail()
> and then returns XDP_PASS, the driver ignores the updated xdp_buff
> pointers and builds the skb from hardcoded offsets derived from the
> original RX descriptor. This means any packet modifications made by the
> XDP program are silently discarded before the skb reaches the network
> stack.
> 
> Fix this by saving the post-XDP data pointer offset and length back into
> rx_offset and rx_bytes when XDP_PASS is returned, so the subsequent
> skb_reserve()/skb_put() calls use the actual packet geometry as seen by
> the XDP program. When no XDP program is loaded the variables retain
> their original descriptor-derived values and the non-XDP fast path is
> unaffected.
> 
> Fixes: 07dd0a7aae7f ("mvpp2: add basic XDP support")
> Signed-off-by: Til Kaiser <mail@tk154.de>

Other than the checksum complaint Sashiko review looks legit.
Please respin and try to fix more of this issues in one series.

Could you try to run:
tools/testing/selftests/drivers/net/xdp.py
it may surface other common driver bugs.
See: tools/testing/selftests/drivers/net/README.rst for instructions
-- 
pw-bot: cr