-----Original Message-----
From: Zaremba, Larysa <redacted>
Sent: Tuesday, February 17, 2026 2:25 PM
To: bpf@vger.kernel.org
Cc: Zaremba, Larysa <redacted>; Claudiu Manoil
[off-list ref]; Vladimir Oltean [off-list ref];
Wei Fang [off-list ref]; Clark Wang [off-list ref];
Andrew Lunn [off-list ref]; David S. Miller
[off-list ref]; Eric Dumazet [off-list ref]; Jakub
Kicinski [off-list ref]; Paolo Abeni [off-list ref]; Nguyen,
Anthony L [off-list ref]; Kitszel, Przemyslaw
[off-list ref]; Alexei Starovoitov [off-list ref];
Daniel Borkmann [off-list ref]; Jesper Dangaard Brouer
[off-list ref]; John Fastabend [off-list ref];
Stanislav Fomichev [off-list ref]; Andrii Nakryiko
[off-list ref]; Martin KaFai Lau [off-list ref]; Eduard
Zingerman [off-list ref]; Song Liu [off-list ref]; Yonghong
Song [off-list ref]; KP Singh [off-list ref]; Hao Luo
[off-list ref]; Jiri Olsa [off-list ref]; Simon Horman
[off-list ref]; Shuah Khan [off-list ref]; Lobakin, Aleksander
[off-list ref]; Fijalkowski, Maciej
[off-list ref]; Bastien Curutchet (eBPF Foundation)
[off-list ref]; Vyavahare, Tushar
[off-list ref]; Jason Xing [off-list ref];
Ricardo B. Marlière [off-list ref]; Eelco Chaudron
[off-list ref]; Lorenzo Bianconi [off-list ref]; Toke
Hoiland-Jorgensen [off-list ref]; imx@lists.linux.dev;
netdev@vger.kernel.org; linux-kernel@vger.kernel.org; intel-wired-
lan@lists.osuosl.org; linux-kselftest@vger.kernel.org; Loktionov,
Aleksandr [off-list ref]; Dragos Tatulea
[off-list ref]
Subject: [PATCH bpf v3 1/9] xdp: use modulo operation to calculate XDP
frag tailroom

The current formula for calculating XDP tailroom in mbuf packets works
only if each frag has its own page (if rxq->frag_size is PAGE_SIZE),
this defeats the purpose of the parameter overall and without any
indication leads to negative calculated tailroom on at least half of
frags, if shared pages are used.

There are not many drivers that set rxq->frag_size. Among them:
* i40e and enetc always split page uniformly between frags, use shared
  pages
* ice uses page_pool frags via libeth, those are power-of-2 and
uniformly
  distributed across page
* idpf has variable frag_size with XDP on, so current API is not
applicable
* mlx5, mtk and mvneta use PAGE_SIZE or 0 as frag_size for page_pool

As for AF_XDP ZC, only ice, i40e and idpf declare frag_size for it.
Modulo operation yields good results for aligned chunks, they are all
power-of-2, between 2K and PAGE_SIZE. Formula without modulo fails
when chunk_size is 2K. Buffers in unaligned mode are not distributed
uniformly, so modulo operation would not work.

To accommodate unaligned buffers, we could define frag_size as data +
tailroom, and hence do not subtract offset when calculating tailroom,
but this would necessitate more changes in the drivers.

Define rxq->frag_size as an even portion of a page that fully belongs
to a single frag. When calculating tailroom, locate the data start
within such portion by performing a modulo operation on page offset.

Fixes: bf25146a5595 ("bpf: add frags support to the
bpf_xdp_adjust_tail() API")
Acked-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Larysa Zaremba <redacted>
---
 net/core/filter.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/core/filter.c b/net/core/filter.c index

ba019ded773d..5f5489665c58 100644

--- a/net/core/filter.c
+++ b/net/core/filter.c

@@ -4156,7 +4156,8 @@ static int bpf_xdp_frags_increase_tail(struct

xdp_buff *xdp, int offset)
 	if (!rxq->frag_size || rxq->frag_size > xdp->frame_sz)
 		return -EOPNOTSUPP;

-	tailroom = rxq->frag_size - skb_frag_size(frag) -
skb_frag_off(frag);
+	tailroom = rxq->frag_size - skb_frag_size(frag) -
+		   skb_frag_off(frag) % rxq->frag_size;
 	if (unlikely(offset > tailroom))
 		return -EINVAL;

--
2.52.0