Since commit 88095728511e ("net: stmmac: fix rx Scatter-Gather support") moved the page_pool DMA window to offset 0, the sync range no longer starts at the XDP headroom. The XDP path still computed sync_len as data_end - data_hard_start - buf->page_offset so page_pool_dma_sync_for_device() synced [base, base + len) instead of [base + page_offset, base + page_offset + len). On a non-coherent platform an XDP program can write packet data, write metadata or grow the tail. If the program then returns XDP_DROP/ABORTED, or a redirect fails, the driver recycles the head page with an incomplete sync. Dirty cache lines in the tail of the frame can be written back after the device has DMA'd a new frame into that page. Include buf->page_offset in the sync length so the whole CPU-touched window is synced before the page is reused. Fixes: 88095728511e ("net: stmmac: fix rx Scatter-Gather support") Signed-off-by: Lorenzo Bianconi --- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c index 32b2c5834c34..c51358c51fae 100644 --- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c @@ -5980,8 +5980,7 @@ static int stmmac_rx(struct stmmac_priv *priv, int limit, u32 queue) xdp_prepare_buff(&ctx.xdp, page_address(buf->page), buf->page_offset, buf1_len, true); - pre_len = ctx.xdp.data_end - ctx.xdp.data_hard_start - - buf->page_offset; + pre_len = ctx.xdp.data_end - ctx.xdp.data_hard_start; ctx.priv = priv; ctx.desc = p; @@ -5991,8 +5990,7 @@ static int stmmac_rx(struct stmmac_priv *priv, int limit, u32 queue) /* Due xdp_adjust_tail: DMA sync for_device * cover max len CPU touch */ - sync_len = ctx.xdp.data_end - ctx.xdp.data_hard_start - - buf->page_offset; + sync_len = ctx.xdp.data_end - ctx.xdp.data_hard_start; sync_len = max(sync_len, pre_len); /* For Not XDP_PASS verdict */ -- 2.56.0