stmmac_rx() runs the XDP program once per descriptor buffer and uses skb == NULL as the only marker for the start of a frame. A frame larger than one buffer is split by the hardware across several descriptors; GMAC4 enables jumbo frames unconditionally (GMAC_CONFIG_JE in GMAC_CORE_INIT), so an on-link peer can deliver such a frame even when the interface MTU is left at 1500. When an XDP verdict ends a non-last descriptor, skb is cleared and the next descriptor of the same hardware frame is parsed as a new frame. For XDP_CONSUMED this happens via read_again with len preserved, so stmmac_rx_buf1_len() then returns min(dma_buf_sz, plen - len) for the last descriptor, which can be as small as 0-3 bytes. buf1_len -= ETH_FCS_LEN underflows and xdp_prepare_buff() puts data_end far past data; on XDP_PASS this produces an skb whose length is close to 4G that reaches the network stack (skb->tail and skb->len are 32-bit and wrap below skb->end, so skb_over_panic() does not fire). A 4+ byte tail is instead offered to the XDP program and delivered as a standalone mid-payload Ethernet frame on XDP_PASS. XDP_TX/XDP_REDIRECT instead falls through to the next iteration, resetting the running length, so the tail is re-parsed as a full-size new frame. XDP does not support scatter-gather frames until the multi-buffer rework, so drop the whole frame instead: mark it as errored as soon as a non-last descriptor is seen while an XDP program is attached, drain and release every descriptor - including the last - and account the frame once in rx_dropped. Removing the re-parse lets both XDP verdict branches simply complete the packet via next. Note: the subsequent "net: stmmac: rework stmmac_rx to support XDP rx multi-buff" accumulates the whole frame into a single xdp_buff and supersedes this patch; the fix is kept so the net portion of the series stands on its own. Fixes: 5fabb01207a2 ("net: stmmac: Add initial XDP support") Signed-off-by: Lorenzo Bianconi --- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 28 ++++++++++------------- 1 file changed, 12 insertions(+), 16 deletions(-) diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c index 426bb68c9bbc..8c08d44fdbd3 100644 --- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c @@ -5893,18 +5893,24 @@ static int stmmac_rx(struct stmmac_priv *priv, int limit, u32 queue) if (priv->extend_desc) stmmac_rx_extended_status(priv, &priv->xstats, rx_q->dma_erx + entry); - if (unlikely(status == discard_frame)) { - page_pool_put_page(rx_q->page_pool, buf->page, 0, true); - buf->page = NULL; + + if (unlikely(!error && status == discard_frame)) { error = 1; if (!priv->hwts_rx_en) rx_errors++; } - if (unlikely(error && (status & rx_not_ls))) - goto read_again; + /* We do not support SG in XDP mode */ + if (unlikely(!error && (status & rx_not_ls) && + stmmac_xdp_is_enabled(priv))) { + rx_dropped++; + error = 1; + } if (unlikely(error)) { + if (status & rx_not_ls) + goto read_again; + dev_kfree_skb(skb); goto next; } @@ -5965,17 +5971,7 @@ static int stmmac_rx(struct stmmac_priv *priv, int limit, u32 queue) sync_len, true); buf->page = NULL; rx_dropped++; - - /* Clear skb as it was set as - * status by XDP program. - */ - skb = NULL; - - if (unlikely((status & rx_not_ls))) - goto read_again; - - count++; - continue; + goto next; } else if (xdp_res & (STMMAC_XDP_TX | STMMAC_XDP_REDIRECT)) { xdp_status |= xdp_res; -- 2.56.0