Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider: - [High] xsk: missing xsk_buff_free() on redirect error in gve and octeontx2 --
commit 2859b3e778dcb29dabcd4c998977aac223d207b7 Author: Marcin Knap <[email protected]> xsk: Do not free ZC Rx buffer when the Rx ring is full This commit stops xsk_rcv_zc() from calling xsk_buff_free() when the XSK Rx ring is full (-ENOBUFS) so that callers of xdp_do_redirect() do not double-free the zero-copy buffer. It also updates i40e and ice to free the buffer on their XDP_EXIT paths. > diff --git a/net/xdp/xsk.c b/net/xdp/xsk.c > index 33475b180ea6f..0edc160c660fd 100644 > --- a/net/xdp/xsk.c > +++ b/net/xdp/xsk.c > @@ -224,21 +224,15 @@ static int xsk_rcv_zc(struct xdp_sock *xs, struct > xdp_buff *xdp, u32 len) > struct list_head *xskb_list; > u32 contd = 0; > u32 num_desc; > - int err; > > - if (likely(!frags)) { > - err = __xsk_rcv_zc(xs, xskb, len, contd); > - if (err) > - goto err; > - return 0; > - } > + if (likely(!frags)) > + return __xsk_rcv_zc(xs, xskb, len, contd); > > contd = XDP_PKT_CONTD; > num_desc = xdp_get_shared_info_from_buff(xdp)->nr_frags + 1; > if (xskq_prod_nb_free(xs->rx, num_desc) < num_desc) { > xs->rx_queue_full++; > - err = -ENOBUFS; > - goto err; > + return -ENOBUFS; > } > > __xsk_rcv_zc_safe(xs, xskb, len, contd); > @@ -252,9 +246,6 @@ static int xsk_rcv_zc(struct xdp_sock *xs, struct > xdp_buff *xdp, u32 len) > } > > return 0; > -err: > - xsk_buff_free(xdp); > - return err; > } [Severity: High] Does removing xsk_buff_free(xdp) here leak xdp_buffs in gve and octeontx2 when xdp_do_redirect() fails with -ENOBUFS? In drivers/net/ethernet/google/gve/gve_rx_dqo.c, the call chain gve_rx_poll_dqo() -> gve_rx_dqo() -> gve_rx_xsk_dqo() -> gve_xsk_done_dqo() handles XDP_REDIRECT on zero-copy buffers without freeing xdp on error: case XDP_REDIRECT: if (unlikely(xdp_do_redirect(priv->dev, xdp, xprog))) goto err; break; } ... err: u64_stats_update_begin(&rx->statss); if (xdp_act == XDP_TX) rx->xdp_tx_errors++; if (xdp_act == XDP_REDIRECT) rx->xdp_redirect_errors++; u64_stats_update_end(&rx->statss); Its caller gve_rx_xsk_dqo() then releases buf_state via gve_free_buf_state(rx, buf_state) without freeing xdp, leaking it from rx->xsk_pool. Similarly, in drivers/net/ethernet/marvell/octeontx2/nic/otx2_txrx.c, the call chain otx2_napi_handler() -> otx2_rx_napi_handler() -> otx2_rcv_pkt_handler() -> otx2_xdp_rcv_pkt_handler() pops xsk_buff from pool->xdp[--cq->rbpool->xdp_top] and does not free it if xdp_do_redirect() fails: case XDP_REDIRECT: cq->pool_ptrs++; if (xsk_buff) { err = xdp_do_redirect(pfvf->netdev, xsk_buff, prog); if (!err) { *need_xdp_flush = true; return true; } return false; } Should gve_xsk_done_dqo() and otx2_xdp_rcv_pkt_handler() also be updated to free the zero-copy buffer when xdp_do_redirect() fails? > static void *xsk_copy_xdp_start(struct xdp_buff *from) [ ... ] -- Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=1
