From c10f3420d59859df107838aa97b49357616d9b47 Mon Sep 17 00:00:00 2001 From: Jakub Kicinski Date: Tue, 27 Oct 2026 16:49:39 -0700 Subject: [PATCH] eth: bnxt: free XDP frags when xdp_do_redirect() fails When xdp_do_redirect() fails bnxt_rx_xdp() recycles the head page but not the frags of a multi-buffer frame. Their agg ring slots have already been refilled, so the pages leak, and the page pool can't be destroyed until they are returned, which will never happen. Redirect to an AF_XDP socket in copy mode fails this way with -ENOMEM whenever the socket's fill ring runs out of buffers. A socket bound without XDP_USE_SG also fails with -ENOSPC for every frame that doesn't fit in a single chunk. All the other drop paths in this function free the frags. Pointed out in LLM review of the first patch of the series. Tested on a BCM57504 at MTU 9000 by redirecting 60k 8000B ICMPv6 echo requests (a head and two agg buffers each) to lo, which can't transmit XDP frames. The page pools' inflight count stayed flat rather than growing by two pages per frame. Fixes: a7559bc8c17c ("bnxt: support transmit and free of aggregation buffers") Reviewed-by: Michael Chan Link: https://patch.msgid.link/20261027234940.1267225-5-kuba@kernel.org Signed-off-by: Jakub Kicinski --- drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c index 96845c8646e0..161e0dd62be6 100644 --- a/drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c +++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c @@ -307,6 +307,7 @@ bool bnxt_rx_xdp(struct bnxt *bp, struct bnxt_rx_ring_info *rxr, u16 cons, if (xdp_do_redirect(bp->dev, xdp, xdp_prog)) { trace_xdp_exception(bp->dev, xdp_prog, act); + bnxt_xdp_buff_frags_free(rxr, xdp); page_pool_recycle_direct(rxr->page_pool, page); return true; }