fbnic_add_rx_frag() takes a page reference through fbnic_page_pool_get_data(), which decrements the buffer's pagecnt_bias, before handing the page to xdp_buff_add_frag(). xdp_buff_add_frag() fails when the buffer already holds MAX_SKB_FRAGS fragments, and on that path the reference is lost: add_frag_failed is set and the frame is dropped, but the bias is not restored and fbnic_put_pkt_buff() only returns the fragments that were actually attached. The page is then never returned to the page pool. A device that keeps sending payload completions for one packet past MAX_SKB_FRAGS leaks a page for every completion beyond the limit. Restore pagecnt_bias on the failure path, the exact inverse of the get, so fbnic_page_pool_drain() reclaims the page. Fixes: 61f9a066c309 ("eth: fbnic: Use shinfo to track frags state on Rx") Cc: stable@vger.kernel.org Signed-off-by: Yehyeong Lee --- drivers/net/ethernet/meta/fbnic/fbnic_txrx.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/net/ethernet/meta/fbnic/fbnic_txrx.c b/drivers/net/ethernet/meta/fbnic/fbnic_txrx.c index 47ded7a9e0a81..7a9bd91bcc41c 100644 --- a/drivers/net/ethernet/meta/fbnic/fbnic_txrx.c +++ b/drivers/net/ethernet/meta/fbnic/fbnic_txrx.c @@ -1171,6 +1171,8 @@ static void fbnic_add_rx_frag(struct fbnic_napi_vector *nv, u64 rcd, added = xdp_buff_add_frag(&pkt->buff, netmem, pg_off, len, truesize); if (unlikely(!added)) { + /* Give back the reference fbnic_page_pool_get_data() took */ + qt->sub1.rx_buf[pg_idx].pagecnt_bias++; pkt->add_frag_failed = true; netdev_err_once(nv->napi.dev, "Failed to add fragment to xdp_buff\n"); -- 2.43.0