Re: [PATCH net v2 3/4] net: mvpp2: do not return retired RX buffers to BM

On Tue,  2 Jun 2026 18:46:34 +0200 Til Kaiser wrote:

The RX refill failure path jumps to err_drop_frame, which returns the
descriptor buffer to the hardware BM pool. That is only valid while the
driver still owns the buffer.

After a non-PASS XDP verdict, mvpp2_run_xdp() may already have recycled,
redirected, or queued the page for XDP_TX. After build_skb(), freeing the
skb on refill failure also retires the data buffer. Returning either of
those buffers to BM lets hardware DMA into memory that is no longer owned
by the RX ring.

Split the error handling so buffers are returned to BM only while still
owned by the driver. Once XDP or an skb owns the buffer, only account the
RX error. Mark page-pool skbs for recycle before they can be freed on the
refill failure path, and unmap non-page-pool buffers before freeing them.

As Gemini points out the driver seems to be following the "if I can't
allocate a new buffer I'll drop the packet and give the current buffer
back to the HW" flow. So after your change on allocation error we're
permanently leaking a slot on in the buffer pool. Leaking as in it will
never be filled, if it happens enough times the pool will be empty,
and no Rx can happen.
-- 
pw-bot: cr