linux/net
Maciej Fijalkowski 72f2b4516f xsk: reclaim invalid Tx descriptors in ZC batch path
The zero-copy Tx batch parser stops when it encounters an invalid
descriptor. If this happens after one or more continuation descriptors,
the Tx consumer can be advanced past fragments that are neither submitted
to the driver nor returned to userspace through the completion ring.

A similar problem occurs when a packet exceeds xdp_zc_max_segs. The
descriptors consumed up to the limit are released without completion, and
the remaining continuation descriptors can subsequently be interpreted
as the beginning of another packet.

Parse Tx batches in packet units and distinguish descriptors belonging to
complete valid packets from descriptors consumed while draining an
invalid or oversized packet. Return the former to the driver and append
the latter to the CQ address area so userspace can reclaim their UMEM
frames.

Treat a standalone invalid descriptor as a one-descriptor reclaim-only
packet. Advancing the Tx-ring consumer releases the ring slot, but does
not by itself return ownership of the referenced UMEM frame to userspace.

Once draining starts, continue until the packet's end-of-packet
descriptor is consumed. Preserve the drain state on the socket when EOP
has not yet been supplied, so draining can continue during a later call.
Leave incomplete but otherwise valid packets on the Tx ring.

Shared-UMEM pools using multi-buffer Tx also need packet-framed parsing.
Walk their Tx sockets one packet at a time, preserving the existing
per-socket fairness scheme, instead of using the legacy one-descriptor
fallback. Keep that fallback for shared pools that do not use
multi-buffer Tx. Since the drain state is maintained per socket and both
the singular and shared paths can resume an interrupted drain, changing
the socket list from singular to shared requires no special bind-time
transition.

CQ entries are positional, and drivers may complete only part of the Tx
work returned by xsk_tx_peek_release_desc_batch(). Therefore, reclaim-only
entries cannot be published immediately when earlier driver-visible
descriptors are still outstanding.

Track the number of driver-visible CQ entries preceding the reclaim
entries. Let xsk_tx_completed() publish partial hardware Tx completions,
and publish the reclaim entries only after every earlier Tx descriptor
has completed. Complete a reclaim-only batch immediately when there is no
driver-visible work in front of it, and prevent another Tx batch from
being appended while reclaim entries remain pending.

Also cap batch processing by the size of the pool's temporary descriptor
array, as Tx rings belonging to sockets sharing a UMEM may have different
sizes.

This ensures that every invalid Tx descriptor consumed by the ZC batch
path is either submitted to the driver as part of a valid packet or
returned to userspace without violating CQ completion ordering.

Reviewed-by: Jason Xing <kernelxing@tencent.com>
Signed-off-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com>
Acked-by: Stanislav Fomichev <sdf@fomichev.me>
Fixes: cf24f5a5fe ("xsk: add support for AF_XDP multi-buffer on Tx path")
Link: https://patch.msgid.link/20260719135609.147823-5-maciej.fijalkowski@intel.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-24 15:12:14 -07:00
..
6lowpan 6lowpan: fix NHC entry use-after-free on error path 2026-06-11 15:27:07 -07:00
9p 9p: Add missing read barrier in virtio zero-copy path 2026-06-21 05:22:57 +00:00
802 appletalk: move the protocol out of tree 2026-06-16 14:37:06 -07:00
8021q vlan: defer real device state propagation to netdev_work 2026-06-25 10:18:40 -07:00
atm Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2026-06-16 14:59:58 -07:00
batman-adv batman-adv: dat: fix tie-break for candidate selection 2026-07-06 07:18:59 +02:00
bluetooth Bluetooth: RFCOMM: Fix session UAF in set_termios 2026-07-20 17:41:07 -04:00
bpf bpf: Fix partial copy of non-linear test_run output 2026-06-21 17:55:06 -07:00
bridge net: bridge: vlan: fix vlan range dumps starting with pvid 2026-07-22 10:23:18 -07:00
can can: isotp: serialize TX state transitions under so->rx_lock 2026-07-16 10:11:12 +02:00
ceph libceph: Fix potential null-ptr-deref in decode_choose_args() 2026-05-12 21:00:59 +02:00
core Lots of fixes, double the count even for the "new normal". 2026-07-23 12:58:08 -07:00
dcb Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
devlink devlink: Fix parent ref leak on tc-bw failure 2026-06-18 18:02:29 -07:00
dns_resolver net/dns_resolver: use kasprintf + kmemdup_nul to simplify dns_query 2026-06-04 18:39:29 -07:00
dsa net: dsa: Fix skb ownership in taggers 2026-06-27 15:44:12 -07:00
ethernet bonding: prevent potential infinite loop in bond_header_parse() 2026-03-16 19:29:45 -07:00
ethtool ethtool: rss: Fix hfunc and input_xfrm parsing on big endian 2026-07-09 11:38:30 +02:00
handshake handshake: Require admin permission for DONE command 2026-06-12 15:45:44 -07:00
hsr net: hsr: fix memory leak on slave unregistration by removing synced VLANs 2026-07-22 10:24:44 -07:00
ieee802154 ieee802154: allow legacy LLSEC ADD/DEL ops to pass strict validation 2026-06-19 23:02:42 +02:00
ife net: ife: require ETH_HLEN to be pullable in ife_decode() 2026-06-13 17:34:39 -07:00
ipv4 nexthop: avoid unlocked f6i_list walk in nh_rt_cache_flush 2026-07-24 15:00:56 -07:00
ipv6 ipv6: Change allocation flags to match rcu_read_lock section requirements 2026-07-23 09:13:13 -07:00
iucv net/af_iucv: fix NULL deref in afiucv_hs_callback_syn() 2026-07-21 13:36:35 -07:00
kcm Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2026-06-16 14:59:58 -07:00
key ipsec-2026-06-22 2026-06-23 16:22:24 -07:00
l2tp Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2026-06-04 15:29:04 -07:00
l3mdev net: fib_rules: Fix iif / oif matching on L3 master device 2025-04-15 17:54:56 -07:00
lapb treewide: Replace kmalloc with kmalloc_obj for non-scalar types 2026-02-21 01:02:28 -08:00
llc llc: fix SAP refcount leak when creating incoming sockets 2026-07-17 13:17:46 +02:00
mac80211 wifi: mac80211: recalculate TIM when a station enters power save 2026-07-21 13:35:22 +02:00
mac802154 mac802154: hold an interface reference across the scan worker 2026-07-23 10:37:46 -07:00
mctp mctp: check register_netdevice_notifier() error in mctp_device_init() 2026-07-23 09:17:36 -07:00
mpls mpls: Set rt->rt_nhn just before returning from mpls_nh_build_multi(). 2026-07-23 13:36:46 +02:00
mptcp mptcp: fix BUILD_BUG_ON on legacy ARM config 2026-07-23 10:50:38 -07:00
ncsi net: ncsi: fix skb leak in error paths 2026-03-06 17:34:48 -08:00
netfilter netfilter: xt_physdev: masks are not c-strings 2026-07-10 16:28:47 +02:00
netlabel Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2026-06-11 14:33:35 -07:00
netlink Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2026-05-28 14:02:21 -07:00
nfc nfc: nci: uart: Constify struct tty_ldisc_ops 2026-06-11 20:21:32 +02:00
nsh
openvswitch openvswitch: fix GSO userspace truncation underflow 2026-07-21 10:25:25 +02:00
packet net/packet: avoid fanout hook re-registration after unregister 2026-07-20 18:15:20 -07:00
phonet phonet: check register_netdevice_notifier() error in phonet_device_init() 2026-07-23 10:28:50 -07:00
psample net: psample: fix info leak in PSAMPLE_ATTR_DATA 2026-06-17 16:35:50 -07:00
psp psp: add a new netdev event for dev unregister 2026-06-12 18:31:32 -07:00
qrtr net: qrtr: restrict socket creation to the initial network namespace 2026-07-23 07:44:00 -07:00
rds rds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check() 2026-07-23 14:11:37 -07:00
rfkill Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
rxrpc rxrpc: fix io_thread race in rxrpc_wake_up_io_thread() 2026-07-21 11:52:29 +02:00
sched net/sched: serialize qdisc_rtab_list against concurrent get/put 2026-07-22 15:07:53 -07:00
sctp sctp: don't free the ASCONF's own transport in DEL-IP processing 2026-07-23 10:30:31 -07:00
shaper net: shaper: add a note that we expect cap dumps to be tiny 2026-06-11 12:55:23 +02:00
smc net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket 2026-07-06 12:58:12 +02:00
strparser net: strparser: fix skb_head leak in strp_abort_strp() 2026-04-14 12:37:00 +02:00
sunrpc SUNRPC: pin upper rpc_clnt across the TLS connect_worker 2026-07-08 14:07:19 -04:00
switchdev bridge: No DEV_PATH_BR_VLAN_UNTAG_HW for dsa foreign 2026-03-19 13:14:00 +01:00
tipc tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream() 2026-07-23 10:11:48 -07:00
tls tls: device: push pending open record on splice EOF 2026-07-21 14:50:50 -07:00
unix af_unix: fix listen() succeeding on sockets in the wrong state 2026-07-24 15:10:05 -07:00
vmw_vsock vsock/virtio: collapse receive queue under memory pressure 2026-07-21 12:11:06 +02:00
wireless wifi: cfg80211: guard optional PMSR nominal time 2026-07-21 14:12:24 +02:00
x25 net/x25: fix use-after-free in x25_kill_by_neigh() 2026-07-23 11:58:20 +02:00
xdp xsk: reclaim invalid Tx descriptors in ZC batch path 2026-07-24 15:12:14 -07:00
xfrm xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert 2026-07-06 08:30:02 +02:00
compat.c net: Remove support for AIO on sockets 2026-05-29 14:05:30 +08:00
devres.c
Kconfig appletalk: move the protocol out of tree 2026-06-16 14:37:06 -07:00
Kconfig.debug
Makefile appletalk: move the protocol out of tree 2026-06-16 14:37:06 -07:00
socket.c Networking changes for 7.2. 2026-06-17 08:17:00 +01:00
sysctl_net.c