Re: [PATCH net 1/2] octeon_ep: fix skb frags overflow in the RX path

[Maciej Fijalkowski <maciej.fijalkowski@intel.com>]

On Wed, Jul 01, 2026 at 07:28:24PM +0800, Maoyi Xie wrote:
> __octep_oq_process_rx() builds an skb for a multi-buffer packet by adding
> one fragment per buffer_size chunk:
> 
> 	data_len = buff_info->len - oq->max_single_buffer_size;
> 	while (data_len) {
> 		...
> 		skb_add_rx_frag(skb, shinfo->nr_frags, buff_info->page, 0,
> 				buff_info->len, buff_info->len);
> 		...
> 	}
> 
> buff_info->len comes from the device response header
> (be64_to_cpu(resp_hw->length)). Nothing bounds the fragment count against
> MAX_SKB_FRAGS. data_len can be close to 65535. buffer_size defaults to
> about 3776 on 4K pages, so a full packet yields about 18 fragments. That
> is one more than the default MAX_SKB_FRAGS of 17, so skb_add_rx_frag()
> writes past shinfo->frags[].
> 
> The driver now drops a packet that would need more fragments than the skb
> can hold. octep_oq_drop_rx() consumes its descriptors, as on the build_skb
> failure path. The same class was fixed in other RX paths, including
> commit 5ffcb7b890f6 ("net: atlantic: fix fragment overflow handling in RX
> path") and commit f0813bcd2d9d ("net: wwan: t7xx: fix potential skb->frags
> overflow in RX path").
> 
> Fixes: 37d79d059606 ("octeon_ep: add Tx/Rx processing and interrupt support")
> Co-developed-by: Kaixuan Li <kaixuan.li@ntu.edu.sg>
> Signed-off-by: Kaixuan Li <kaixuan.li@ntu.edu.sg>
> Signed-off-by: Maoyi Xie <maoyixie.tju@gmail.com>
> ---
>  drivers/net/ethernet/marvell/octeon_ep/octep_rx.c | 6 ++++++
>  1 file changed, 6 insertions(+)
> 
> diff --git a/drivers/net/ethernet/marvell/octeon_ep/octep_rx.c b/drivers/net/ethernet/marvell/octeon_ep/octep_rx.c
> index e6ebc7e44a00c..4ee911b6c0107 100644
> --- a/drivers/net/ethernet/marvell/octeon_ep/octep_rx.c
> +++ b/drivers/net/ethernet/marvell/octeon_ep/octep_rx.c
> @@ -476,6 +476,12 @@ static int __octep_oq_process_rx(struct octep_device *oct,
>  			skb_put(skb, oq->max_single_buffer_size);
>  			shinfo = skb_shinfo(skb);
>  			data_len = buff_info->len - oq->max_single_buffer_size;
> +			if (DIV_ROUND_UP(data_len, oq->buffer_size) > MAX_SKB_FRAGS) {
> +				dev_kfree_skb_any(skb);
> +				octep_oq_drop_rx(oq, buff_info,
> +						 &read_idx, &desc_used);

nit: would it make sense to pass data_len to octep_oq_drop_rx() to avoid
re-calculation here

But besides, wouldn't this be better to do even before build_skb() call ?

> +				continue;
> +			}
>  			while (data_len) {
>  				buff_info = (struct octep_rx_buffer *)
>  					    &oq->buff_info[read_idx];
> -- 
> 2.34.1
> 
>