]> exis.tech > repos - linux.git/commit
net: mvpp2: limit XDP frame size to the RX buffer
authorTil Kaiser <mail@tk154.de>
Sun, 7 Jun 2026 13:49:41 +0000 (15:49 +0200)
committerPaolo Abeni <pabeni@redhat.com>
Thu, 11 Jun 2026 07:57:31 +0000 (09:57 +0200)
commitf3c6aa078927e6fe8121c9c591ddee8716c5305a
tree1c280e4029f2d969be34e95055b03c9791b4492e
parent180235600934bef6add3be637c296d6cf3272e67
net: mvpp2: limit XDP frame size to the RX buffer

mvpp2 has short and long BM pools, and short pool buffers can be smaller
than PAGE_SIZE. The XDP path nevertheless initializes every xdp_buff with
PAGE_SIZE as frame size.

XDP helpers use frame_sz to validate tail growth and to derive the hard
end of the data area. Advertising PAGE_SIZE for short buffers can let
bpf_xdp_adjust_tail() grow a packet past the real allocation, corrupting
memory or later tripping skb tailroom checks.

Initialize the XDP buffer with bm_pool->frag_size so XDP tailroom matches
the actual buffer backing the packet.

Fixes: 07dd0a7aae7f ("mvpp2: add basic XDP support")
Signed-off-by: Til Kaiser <mail@tk154.de>
Link: https://patch.msgid.link/20260607134943.21996-3-mail@tk154.de
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c