On Thu, Jun 26, 2025 at 12:10 AM Bui Quang Minh <minhquangbu...@gmail.com> wrote: > > The truesize is guaranteed not to exceed PAGE_SIZE in > get_mergeable_buf_len(). It is saved in mergeable context, which is not > changeable by the host side,
This really depends on the security model. > so the check in receive path is quite > redundant. > > Signed-off-by: Bui Quang Minh <minhquangbu...@gmail.com> > --- > drivers/net/virtio_net.c | 7 +++---- > 1 file changed, 3 insertions(+), 4 deletions(-) > > diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c > index 2a130a3e50ac..6f9fedad4a5e 100644 > --- a/drivers/net/virtio_net.c > +++ b/drivers/net/virtio_net.c > @@ -2144,9 +2144,9 @@ static int virtnet_build_xdp_buff_mrg(struct net_device > *dev, > { > struct virtio_net_hdr_mrg_rxbuf *hdr = buf; > unsigned int headroom, tailroom, room; > - unsigned int truesize, cur_frag_size; > struct skb_shared_info *shinfo; > unsigned int xdp_frags_truesz = 0; > + unsigned int truesize; > struct page *page; > skb_frag_t *frag; > int offset; > @@ -2194,9 +2194,8 @@ static int virtnet_build_xdp_buff_mrg(struct net_device > *dev, > tailroom = headroom ? sizeof(struct skb_shared_info) : 0; > room = SKB_DATA_ALIGN(headroom + tailroom); > > - cur_frag_size = truesize; > - xdp_frags_truesz += cur_frag_size; > - if (unlikely(len > truesize - room || cur_frag_size > > PAGE_SIZE)) { > + xdp_frags_truesz += truesize; > + if (unlikely(len > truesize - room)) { > put_page(page); > pr_debug("%s: rx error: len %u exceeds truesize > %lu\n", > dev->name, len, (unsigned long)(truesize - > room)); > -- > 2.43.0 > Acked-by: Jason Wang <jasow...@redhat.com> Thanks