Re: [PATCH iwl-net v2] ice: fix Rx byte accounting for dropped XDP frames

[Alexander Lobakin <aleksander.lobakin@intel.com>]

From: Dominik Dvořák Via B4 Relay
<devnull+Dominik.Dvorak.econ.muni.cz@kernel.org>
Date: Mon, 09 Nov 2026 09:24:10 +0100

> From: Dominik Dvořák <Dominik.Dvorak@econ.muni.cz>
> 
> Since the Rx path was converted to page pool and libeth, ice_run_xdp()
> returns the buffer itself via libeth_xdp_return_buff() on XDP_DROP,
> XDP_ABORTED and on a failed XDP_TX or XDP_REDIRECT. That helper also
> sets xdp->data to NULL. ice_clean_rx_irq() then calls xdp_get_buff_len()
> on the same buffer to update the Rx byte counter, which evaluates
> xdp->data_end - NULL and adds the low 32 bits of a kernel address to
> the ring's byte counter for every such frame. For multi-buffer frames
> it would also read skb_shared_info from a page that has already been
> returned to the page pool.
> 
> On an E810 with an XDP blocklist attached to an 802.3ad bond, this shows
> up as jumps of up to 4 GiB in the per-queue and netdev rx_bytes counters,
> one per dropped packet, while the packet counters and the hardware byte
> counter (rx_bytes.nic) stay correct. The bogus values are also exposed
> to unprivileged users through the netdev statistics.
> 
> Count the frame length once, before running the XDP program, and use it
> for the byte counter on every path; this also drops the duplicate
> skb->len accounting that the XDP_PASS path did afterwards. The frame
> length as received is counted, rather than the length after a possible
> bpf_xdp_adjust_head()/bpf_xdp_adjust_tail().
> 
> The problem was tracked down and this fix written with the help of
> Claude Opus 5.5 (Anthropic), working from netdev and ethtool counters
> collected on the affected system and from the driver source.
> 
> Tested on an E810-XXV (7.0.14 kernel, same code as current master) with
> an XDP blocklist attached to an 802.3ad bond: without the fix, each
> dropped packet added about 2.5 GB to rx_queue_N_bytes; with the fix, 40
> dropped packets produced no such jumps.
> 
> Fixes: 93f53db9f9dc ("ice: switch to Page Pool")
> Cc: stable@vger.kernel.org # 6.18.x
> Link: https://lore.kernel.org/netdev/DB7PR03MB460158B90A64D025962670E0D5772@DB7PR03MB4601.eurprd03.prod.outlook.com/
> Signed-off-by: Dominik Dvořák <Dominik.Dvorak@econ.muni.cz>

Reviewed-by: Alexander Lobakin <aleksander.lobakin@intel.com>

This looks elegant and even simplifies hotpath a bit. I don't think we
need to try counting post-XDP bytes as if the XDP program added some
bytes using grow tail, those weren't received by wire either way.

> ---
> Based on the stable v7.0.14 tree, which is what the affected box runs;
> the changed code is identical in current master. Tested on that box
> with the fixed module built against the 7.0.14-26-pve headers.
> ---
> Changes in v2:
> - Account for Rx bytes and packets once, before ice_run_xdp(), and drop
>   the separate skb->len accounting on the XDP_PASS path (Olek).
> - Add Cc: stable with the minimum affected version (Olek).
Thanks,
Olek