tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

net: stmmac: fix the crash issue for zero copy XDP_TX action

There is a crash issue when running zero copy XDP_TX action, the crash
log is shown below.

[ 216.122464] Unable to handle kernel paging request at virtual address fffeffff80000000
[ 216.187524] Internal error: Oops: 0000000096000144 [#1] SMP
[ 216.301694] Call trace:
[ 216.304130] dcache_clean_poc+0x20/0x38 (P)
[ 216.308308] __dma_sync_single_for_device+0x1bc/0x1e0
[ 216.313351] stmmac_xdp_xmit_xdpf+0x354/0x400
[ 216.317701] __stmmac_xdp_run_prog+0x164/0x368
[ 216.322139] stmmac_napi_poll_rxtx+0xba8/0xf00
[ 216.326576] __napi_poll+0x40/0x218
[ 216.408054] Kernel panic - not syncing: Oops: Fatal exception in interrupt

For XDP_TX action, the xdp_buff is converted to xdp_frame by
xdp_convert_buff_to_frame(). The memory type of the resulting xdp_frame
depends on the memory type of the xdp_buff. For page pool based xdp_buff
it produces xdp_frame with memory type MEM_TYPE_PAGE_POOL. For zero copy
XSK pool based xdp_buff it produces xdp_frame with memory type
MEM_TYPE_PAGE_ORDER0. However, stmmac_xdp_xmit_back() does not check the
memory type and always uses the page pool type, this leads to invalid
mappings and causes the crash. Therefore, check the xdp_buff memory type
in stmmac_xdp_xmit_back() to fix this issue.

Fixes: bba2556efad6 ("net: stmmac: Enable RX via AF_XDP zero-copy")
Signed-off-by: Wei Fang <wei.fang@nxp.com>
Reviewed-by: Hariprasad Kelam <hkelam@marvell.com>
Link: https://patch.msgid.link/20251204071332.1907111-1-wei.fang@nxp.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>

authored by

Wei Fang and committed by
Paolo Abeni a48e2322 a6694b7e

+15 -2
+15 -2
drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
··· 89 89 #define STMMAC_XDP_CONSUMED BIT(0) 90 90 #define STMMAC_XDP_TX BIT(1) 91 91 #define STMMAC_XDP_REDIRECT BIT(2) 92 + #define STMMAC_XSK_CONSUMED BIT(3) 92 93 93 94 static int flow_ctrl = 0xdead; 94 95 module_param(flow_ctrl, int, 0644); ··· 5127 5126 static int stmmac_xdp_xmit_back(struct stmmac_priv *priv, 5128 5127 struct xdp_buff *xdp) 5129 5128 { 5129 + bool zc = !!(xdp->rxq->mem.type == MEM_TYPE_XSK_BUFF_POOL); 5130 5130 struct xdp_frame *xdpf = xdp_convert_buff_to_frame(xdp); 5131 5131 int cpu = smp_processor_id(); 5132 5132 struct netdev_queue *nq; ··· 5144 5142 /* Avoids TX time-out as we are sharing with slow path */ 5145 5143 txq_trans_cond_update(nq); 5146 5144 5147 - res = stmmac_xdp_xmit_xdpf(priv, queue, xdpf, false); 5148 - if (res == STMMAC_XDP_TX) 5145 + /* For zero copy XDP_TX action, dma_map is true */ 5146 + res = stmmac_xdp_xmit_xdpf(priv, queue, xdpf, zc); 5147 + if (res == STMMAC_XDP_TX) { 5149 5148 stmmac_flush_tx_descriptors(priv, queue); 5149 + } else if (res == STMMAC_XDP_CONSUMED && zc) { 5150 + /* xdp has been freed by xdp_convert_buff_to_frame(), 5151 + * no need to call xsk_buff_free() again, so return 5152 + * STMMAC_XSK_CONSUMED. 5153 + */ 5154 + res = STMMAC_XSK_CONSUMED; 5155 + xdp_return_frame(xdpf); 5156 + } 5150 5157 5151 5158 __netif_tx_unlock(nq); 5152 5159 ··· 5505 5494 break; 5506 5495 case STMMAC_XDP_CONSUMED: 5507 5496 xsk_buff_free(buf->xdp); 5497 + fallthrough; 5498 + case STMMAC_XSK_CONSUMED: 5508 5499 rx_dropped++; 5509 5500 break; 5510 5501 case STMMAC_XDP_TX: