7.3-stable review patch. If anyone has any objections, please let me know. ------------------ From: Paul Moses [ Upstream commit b88b826ec54a06f48a42580c609ba81293ebec8e ] xp_assign_dev() sets XDP_UMEM_SG_FLAG before checking whether the device supports multibuffer zero-copy. If assignment fails, xsk_bind() destroys the pool but retains the registered UMEM. A subsequent bind without XDP_USE_SG inherits the stale flag. The flag also changes RX buffer sizing after DMA mapping. On igc, a failed SG bind followed by a non-SG retry with 4096-byte chunks and 1792 bytes of headroom passes admission with 2048 bytes, but programs a 1024-byte RX buffer. On I225-V hardware, an ordinary 1514-byte frame is truncated to 1024 bytes or 1008 with RX timestamps enabled. Restoring the original flags eliminates the truncation in both cases. Save the UMEM flags before assignment and restore them on failure. Discovered during development of AF_XDP changes for igc. Fixes: d609f3d228a8 ("xsk: add multi-buffer support for sockets sharing umem") Cc: stable@vger.kernel.org Signed-off-by: Paul Moses Acked-by: Maciej Fijalkowski Link: https://patch.msgid.link/20261021224705.2078753-1-p@1g4.org Signed-off-by: Jakub Kicinski Signed-off-by: Sasha Levin --- net/xdp/xsk_buff_pool.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/xdp/xsk_buff_pool.c b/net/xdp/xsk_buff_pool.c index 9d2d94f1fb759..e836eca469b0b 100644 --- a/net/xdp/xsk_buff_pool.c +++ b/net/xdp/xsk_buff_pool.c @@ -166,6 +166,7 @@ int xp_assign_dev(struct xsk_buff_pool *pool, { u32 needed = netdev->mtu + ETH_PAD_LEN; u32 segs = netdev->xdp_zc_max_segs; + u8 umem_flags = pool->umem->flags; bool mbuf = flags & XDP_USE_SG; bool force_zc, force_copy; struct netdev_bpf bpf; @@ -264,6 +265,7 @@ int xp_assign_dev(struct xsk_buff_pool *pool, if (!force_zc) err = 0; /* fallback to copy mode */ if (err) { + pool->umem->flags = umem_flags; xsk_clear_pool_at_qid(netdev, queue_id); dev_put(netdev); } -- 2.53.0