xdp: fix page_pool leaks

[kernel-patches-daemon-bpf-rc]

Pull request for series with
subject: xdp: fix page_pool leaks
version: 1
url: https://patchwork.kernel.org/project/netdevbpf/list/?series=1008291

[kernel-patches-daemon-bpf-rc]

Upstream branch: 63d2247
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=1008291
version: 1

[kernel-patches-daemon-bpf-rc]

Upstream branch: cbf33b8
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=1008291
version: 1

[kernel-patches-daemon-bpf-rc]

Upstream branch: de73422
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=1008291
version: 1

[kernel-patches-daemon-bpf-rc]

Upstream branch: 4d920ed
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=1008291
version: 1

[kernel-patches-daemon-bpf-rc]

Upstream branch: 23f3770
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=1008291
version: 1

[theihor]

This is a test comment

Inline review:

commit 4f6760e900345301a522286541a7d45a686b94cd
Author: Maciej Fijalkowski <[email protected]>

veth: update mem type in xdp_buff

Veth calls skb_pp_cow_data() which converts memory to page_pool backed
storage. The patch adds xdp_update_mem_type() to fix page_pool leaks when
bpf_xdp_adjust_tail() is used.

Fixes: 0ebab78cbcbf ("net: veth: add page_pool for page recycling")
Reported-by: Alexei Starovoitov <[email protected]>
Closes: https://lore.kernel.org/bpf/CAADnVQ+bBofJDfieyOYzSmSujSfJwDTQhiz3aJw7hE+4E2_iPA@mail.gmail.com/

> diff --git a/drivers/net/veth.c b/drivers/net/veth.c
> index a3046142c..2ccc40e57 100644
> --- a/drivers/net/veth.c
> +++ b/drivers/net/veth.c
> @@ -814,6 +814,8 @@ static struct sk_buff *veth_xdp_rcv_skb(struct veth_rq *rq,
>  	orig_data = xdp->data;
>  	orig_data_end = xdp->data_end;
>
> +	xdp_update_mem_type(xdp);
> +
>  	act = bpf_prog_run_xdp(xdp_prog, xdp);
>
>  	switch (act) {

Does the xdp_update_mem_type() call work correctly with XDP_TX and
XDP_REDIRECT actions?

After veth_convert_skb_to_xdp_buff() calls skb_pp_cow_data(), the
memory backing xdp_buff originates from page_pool. The new
xdp_update_mem_type() call correctly updates xdp->rxq->mem.type to
MEM_TYPE_PAGE_POOL. This fixes the leak for XDP_PASS when
bpf_xdp_adjust_tail() is used, which was the reported bug.

However, for XDP_TX and XDP_REDIRECT actions, the existing code
restores xdp->rxq->mem to rq->xdp_mem (which is MEM_TYPE_PAGE_SHARED):

  case XDP_TX:
      veth_xdp_get(xdp);
      consume_skb(skb);
      xdp->rxq->mem = rq->xdp_mem;  /* <-- restores to PAGE_SHARED */
      if (unlikely(veth_xdp_tx(rq, xdp, bq) < 0)) {
          ...

The veth_xdp_tx() function calls xdp_convert_buff_to_frame(), which
copies xdp->rxq->mem.type to xdp_frame->mem_type. After the
restoration, this will be MEM_TYPE_PAGE_SHARED even though the actual
memory is page_pool backed.

When the frame is eventually freed, won't the cleanup use the wrong
path based on the incorrect mem_type? The memory came from page_pool
via skb_pp_cow_data() but will be freed as if it came from
MEM_TYPE_PAGE_SHARED allocation.

The same issue appears in the XDP_REDIRECT case at line 839.

--

This review is generated by an AI bot. It may be wrong.
AI review job summary: https://github.com/kernel-patches/bpf/actions/runs/18018331618
In-Reply-To-Subject: veth: update mem type in xdp_buff

[kernel-patches-daemon-bpf-rc]

Forwarding comment 3379055639 via email
In-Reply-To: [email protected]
Patch: https://patchwork.kernel.org/project/netdevbpf/patch/[email protected]/

[theihor]

This is a test comment

commit 4f6760e900345301a522286541a7d45a686b94cd

[...]

> diff --git a/drivers/net/veth.c b/drivers/net/veth.c
> index a3046142c..2ccc40e57 100644
> --- a/drivers/net/veth.c
> +++ b/drivers/net/veth.c
> @@ -814,6 +814,8 @@ static struct sk_buff *veth_xdp_rcv_skb(struct veth_rq *rq,
>  	orig_data = xdp->data;
>  	orig_data_end = xdp->data_end;
>
> +	xdp_update_mem_type(xdp);
> +
>  	act = bpf_prog_run_xdp(xdp_prog, xdp);
>
>  	switch (act) {

Insightful review here.

---

This review is generated by an AI bot. It may be wrong.
CI run: https://github.com/kernel-patches/bpf/actions/runs/18018331618
In-Reply-To-Subject: xdp: update xdp_rxq_info's mem type in XDP generic hook

[kernel-patches-daemon-bpf-rc]

Forwarding comment 3382889039 via email
In-Reply-To: [email protected]
Patch: https://patchwork.kernel.org/project/netdevbpf/patch/[email protected]/

[kernel-patches-daemon-bpf-rc]

Upstream branch: 23f3770
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=1008291
version: 1