From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mta0.migadu.com (out-30.mta0.migadu.com [91.218.175.30]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1FC09477987 for ; Fri, 11 Sep 2026 13:57:31 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=91.218.175.30 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789135055; cv=none; b=K6sZ67xSJ3VU7KHqw/0tFB2+L0D82i9H5AR39i9ZOSwKeK2JgBcp7AEHHwZr+sDL+qewPwpWLnwWspBzL48u68HXJW2mBDIh0aJ98JBjayej5uS0G/dfdsAJuzmsop9CcirZo6qAbHY3JnTZTMvpJRp9Cl+Zjy9b77Y7tjPW2Ac= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789135055; c=relaxed/simple; bh=ln7IoRA07Ilbawg/aAH2sc/zTgGho8RkMvmGvlw20T4=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=kYFLqxEnejRDGYaeNpAaIY6p+rOHCOgK92eF+YY7IX4KDmqz5Gg2YLXj+lG6RhWkoven8z+O0GYlLMvSy0jiq7+9FMJu3Xs8DFc90nh4I6TkYher3pxzoP4VVGWGKEMbpwmWcWYSThWtj57mEPPS4VtTxJzIe8F1VCDp33TT4g8= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=EQ6q6sgn; arc=none smtp.client-ip=91.218.175.30 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="EQ6q6sgn" X-Envelope-To: linux-kernel@vger.kernel.org DKIM-Signature: a=rsa-sha256; bh=ln7IoRA07Ilbawg/aAH2sc/zTgGho8RkMvmGvlw20T4=; c=simple/simple; d=linux.dev; h=from:to:subject:date:message-id:mime-version:content-type; s=key1; t=1789135049; v=1; x=1789739849; b=EQ6q6sgn88EZUtAPzdZnX52wRDt7DfpHmN1/AWc4yMxIcFx6FyBqHs87h8MEypt8P/xomnc/ BpDnVOSEIBuvKTN/4MmnVnoTIBQNZKpfMXdj5gdhec+LudvOSXwQRChazrb1IBohWn1y/6xgR8I Noag3xPCbbVMDOhzcp4wttRw= X-Envelope-To: linux-kernel@vger.kernel.org Received: by smtp.migadu.com with ESMTPS id e884e9b4b346d9e9; Fri, 11 Sep 2026 13:57:28 +0000 X-Mizu-Trace-ID: e884e9b4b346d9e9 X-Migadu-Flow: FLOW_OUT From: Jiayuan Chen To: bpf@vger.kernel.org Cc: Jiayuan Chen , Andrew Lunn , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Alexei Starovoitov , Daniel Borkmann , Jesper Dangaard Brouer , John Fastabend , Stanislav Fomichev , Simon Horman , Andrii Nakryiko , Eduard Zingerman , Kumar Kartikeya Dwivedi , Martin KaFai Lau , Song Liu , Yonghong Song , Jiri Olsa , Emil Tsalapatis , Ihor Solodrai , Shuah Khan , Kuniyuki Iwashima , Hangbin Liu , Martin Karsten , =?UTF-8?q?Toke=20H=C3=B8iland-J=C3=B8rgensen?= , Lorenzo Bianconi , Eelco Chaudron , linux-kernel@vger.kernel.org, netdev@vger.kernel.org, linux-kselftest@vger.kernel.org Subject: [PATCH bpf v3 0/2] net: xdp: fix bpf_xdp_shrink_data() page handling on generic XDP and veth Date: Fri, 11 Sep 2026 21:56:50 +0800 Message-ID: <20260911135711.109338-1-jiayuan.chen@linux.dev> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit I'm always confused which tree(net or bpf) should XDP target. bpf_xdp_shrink_data() frees a page_pool frag with the wrong memory type on skb-backed XDP, hitting "Bad page state ... page_pool leak". Both the generic XDP path and the veth path are affected. Patch 1 fixes it by tagging the xdp_buff, so it no longer depends on rxq->mem.type (which is shared on generic XDP and gets reset on veth). It is reported by syzbot. Patch 2 adds a selftest that reproduces the leak on both paths. v2 -> v3: handle some feedback from AI review. v2: https://lore.kernel.org/bpf/20260824030257.263179-1-jiayuan.chen@linux.dev/ v1 -> v2: AI found the fix was insufficient and we need a general way to fix them. v1: https://lore.kernel.org/bpf/20260816031245.268898-1-jiayuan.chen@linux.dev/ Jiayuan Chen (2): bpf, veth: xdp: fix page_pool page leak on skb-backed XDP selftests/bpf: add xdp_shrink_frags drivers/net/veth.c | 6 + include/net/xdp.h | 30 +- net/core/dev.c | 6 + net/core/filter.c | 7 + .../bpf/prog_tests/xdp_shrink_frags.c | 288 ++++++++++++++++++ .../selftests/bpf/progs/xdp_shrink_frags.c | 34 +++ 6 files changed, 370 insertions(+), 1 deletion(-) create mode 100644 tools/testing/selftests/bpf/prog_tests/xdp_shrink_frags.c create mode 100644 tools/testing/selftests/bpf/progs/xdp_shrink_frags.c -- 2.43.0