Both octeon_ep and octeon_ep_vf build an skb for a multi-buffer RX packet
by adding one fragment per buffer_size chunk of a device-reported length.
Neither bounds the count against MAX_SKB_FRAGS. A long packet yields about
18 fragments, one past the default MAX_SKB_FRAGS of 17, so
skb_add_rx_frag() writes past shinfo->frags[].

Each driver now checks the fragment count before it builds the skb and
drops a packet that would not fit.

v3:
 - octeon_ep_vf: pull the drop drain into octep_vf_oq_drop_rx().
   The overflow drop and the napi_build_skb failure path both use it.
   Suggested by Maciej Fijalkowski.
 - octeon_ep: add Maciej's Reviewed-by.

v1: https://lore.kernel.org/r/20260701112825.1653044-1-maoyixie.tju@gmail.com (local)
v2: https://lore.kernel.org/r/20260702180518.2013324-1-maoyixie.tju@gmail.com (local)


Maoyi Xie (2):
  octeon_ep: fix skb frags overflow in the RX path
  octeon_ep_vf: fix skb frags overflow in the RX path

 .../net/ethernet/marvell/octeon_ep/octep_rx.c |  9 ++++
 .../marvell/octeon_ep_vf/octep_vf_rx.c        | 46 ++++++++++++-------
 2 files changed, 39 insertions(+), 16 deletions(-)

-- 
2.34.1