The octeon_ep and octeon_ep_vf RX paths add one skb fragment per buffer
with no bound against MAX_SKB_FRAGS. buff_info->len comes from the device
response header. A long packet needs about 18 fragments. That is one past
the default MAX_SKB_FRAGS of 17, so skb_add_rx_frag() writes past
shinfo->frags[]. Patch 1 bounds octeon_ep. Patch 3 bounds octeon_ep_vf.

Patch 2 is Guangshuo Li's fix for an octeon_ep_vf RX page leak on the
napi_build_skb() failure path. It touches the same drop code as patch 3.
I carry it here so the series applies without conflict, per Maciej. Patch 3
moves that drain loop into a helper. The helper carries the page frees from
patch 2, so the overflow drop path frees its pages too.

octeon_ep has the same leak on its drop path. A separate patch will fix it
once this series lands.

v5:
 - octeon_ep, octeon_ep_vf: widen data_len to u32, per Simon Horman.
   buff_info->len is a u64, a u16 could truncate a long length.
 - octeon_ep: dropped Maciej Fijalkowski's Reviewed-by, the check changed.
 - octeon_ep_vf: the drop helper drains the length in a u32 too.

v1: https://lore.kernel.org/r/20260701112825.1653044-1-maoyixie.tju@gmail.com (local)
v2: https://lore.kernel.org/r/20260702180518.2013324-1-maoyixie.tju@gmail.com (local)
v3: https://lore.kernel.org/r/20260704061511.2350737-1-maoyixie.tju@gmail.com (local)
v4: https://lore.kernel.org/r/20260706150208.2944898-1-maoyixie.tju@gmail.com (local)

Guangshuo Li (1):
  octeon_ep_vf: Fix RX page leak on napi_build_skb() failure

Maoyi Xie (2):
  octeon_ep: fix skb frags overflow in the RX path
  octeon_ep_vf: fix skb frags overflow in the RX path

 .../net/ethernet/marvell/octeon_ep/octep_rx.c |  9 ++++
 .../marvell/octeon_ep_vf/octep_vf_rx.c        | 51 ++++++++++++-------
 2 files changed, 43 insertions(+), 17 deletions(-)

--
2.34.1