I'm always confused which tree(net or bpf) should XDP target.
bpf_xdp_shrink_data() frees a page_pool frag with the wrong memory type on
skb-backed XDP, hitting "Bad page state ... page_pool leak". Both the
generic XDP path and the veth path are affected.
Patch 1 fixes it by carrying the memory type in the xdp_buff itself, so it
no longer depends on rxq->mem.type (which is shared on generic XDP and gets
reset on veth). It is reported by syzbot.
Patch 2 adds a selftest that reproduces the leak on both paths.
v1 -> v2: AI found the fix was insufficient and we need a general way
to fix them.
v1: https://lore.kernel.org/bpf/[email protected]/
Jiayuan Chen (2):
bpf, veth: xdp: fix page_pool page leak on skb-backed XDP
selftests/bpf: add xdp_shrink_frags
drivers/net/veth.c | 5 +
include/net/xdp.h | 14 ++
net/core/dev.c | 5 +
net/core/filter.c | 7 +
.../bpf/prog_tests/xdp_shrink_frags.c | 163 ++++++++++++++++++
.../selftests/bpf/progs/xdp_shrink_frags.c | 23 +++
6 files changed, 217 insertions(+)
create mode 100644 tools/testing/selftests/bpf/prog_tests/xdp_shrink_frags.c
create mode 100644 tools/testing/selftests/bpf/progs/xdp_shrink_frags.c
--
2.43.0
