Re: [PATCH bpf v3 1/2] bpf, veth: xdp: fix page_pool page leak on skb-backed XDP

[Jakub Kicinski]

On Thu, 17 Sep 2026 18:31:28 -0700 Jakub Kicinski wrote:
> [Severity: High]
> The new flag only overrides mem_type in one direction (towards
> MEM_TYPE_PAGE_POOL), while mem_type is still initialized from the shared
> xdp->rxq->mem.type:
> 
> net/core/filter.c:bpf_xdp_shrink_data() {
>       enum xdp_mem_type mem_type = xdp->rxq->mem.type;
>       ...
> }
> 
> The commit message says veth's rq->xdp_rxq.mem "is shared per-queue state"
> that "can be clobbered under a packet still in flight". veth also writes a
> frame's memory type into it and never restores it:
> 
> drivers/net/veth.c:veth_xdp_rcv_one() {
>       case XDP_TX:
>               orig_frame = *frame;
>               xdp->rxq->mem.type = frame->mem_type;
>       ...
>       case XDP_REDIRECT:
>               orig_frame = *frame;
>               xdp->rxq->mem.type = frame->mem_type;
> }

I probably lost most of the context over the months, but for veth can't
we simply: 

diff --git a/drivers/net/veth.c b/drivers/net/veth.c
index a3fdf1959b76..14dac44487ba 100644
--- a/drivers/net/veth.c
+++ b/drivers/net/veth.c
@@ -653,6 +653,7 @@ static struct xdp_frame *veth_xdp_rcv_one(struct veth_rq 
*rq,
 
                xdp_convert_frame_to_buff(frame, xdp);
                xdp->rxq = &rq->xdp_rxq;
+               xdp->rxq->mem.type = frame->mem_type;
                vxbuf.skb = NULL;
 
                act = bpf_prog_run_xdp(xdp_prog, xdp);
@@ -664,7 +665,6 @@ static struct xdp_frame *veth_xdp_rcv_one(struct veth_rq 
*rq,
                        break;
                case XDP_TX:
                        orig_frame = *frame;
-                       xdp->rxq->mem.type = frame->mem_type;
                        if (unlikely(veth_xdp_tx(rq, xdp, bq) < 0)) {
                                trace_xdp_exception(rq->dev, xdp_prog, act);
                                frame = &orig_frame;
@@ -676,7 +676,6 @@ static struct xdp_frame *veth_xdp_rcv_one(struct veth_rq 
*rq,
                        goto xdp_xmit;
                case XDP_REDIRECT:
                        orig_frame = *frame;
-                       xdp->rxq->mem.type = frame->mem_type;
                        if (xdp_do_redirect(rq->dev, xdp, xdp_prog)) {
                                frame = &orig_frame;
                                stats->rx_drops++;

Local agent digging into the "concurrency" claim says the only
concurrency we can have is with the teardown path where we unregister
the rxq without stopping NAPI (probably deserves a patch in this series)