> -----Original Message-----
> From: Zaremba, Larysa <[email protected]>
> Sent: Thursday, February 12, 2026 7:33 PM
> To: [email protected]
> Cc: Zaremba, Larysa <[email protected]>; Claudiu Manoil
> <[email protected]>; Vladimir Oltean <[email protected]>;
> Wei Fang <[email protected]>; Clark Wang <[email protected]>;
> Andrew Lunn <[email protected]>; David S. Miller
> <[email protected]>; Eric Dumazet <[email protected]>; Jakub
> Kicinski <[email protected]>; Paolo Abeni <[email protected]>; Nguyen,
> Anthony L <[email protected]>; Kitszel, Przemyslaw
> <[email protected]>; Alexei Starovoitov <[email protected]>;
> Daniel Borkmann <[email protected]>; Jesper Dangaard Brouer
> <[email protected]>; John Fastabend <[email protected]>;
> Stanislav Fomichev <[email protected]>; Andrii Nakryiko
> <[email protected]>; Martin KaFai Lau <[email protected]>; Eduard
> Zingerman <[email protected]>; Song Liu <[email protected]>; Yonghong
> Song <[email protected]>; KP Singh <[email protected]>; Hao Luo
> <[email protected]>; Jiri Olsa <[email protected]>; Simon Horman
> <[email protected]>; Shuah Khan <[email protected]>; Lobakin, Aleksander
> <[email protected]>; Fijalkowski, Maciej
> <[email protected]>; Bastien Curutchet (eBPF Foundation)
> <[email protected]>; Vyavahare, Tushar
> <[email protected]>; Jason Xing <[email protected]>;
> Ricardo B. Marlière <[email protected]>; Eelco Chaudron
> <[email protected]>; Lorenzo Bianconi <[email protected]>; Toke
> Hoiland-Jorgensen <[email protected]>; [email protected];
> [email protected]; [email protected]; intel-wired-
> [email protected]; [email protected]; Loktionov,
> Aleksandr <[email protected]>; Dragos Tatulea
> <[email protected]>
> Subject: [PATCH bpf v2 4/9] ice: change XDP RxQ frag_size from DMA
> write length to xdp.frame_sz
>
> The only user of frag_size field in XDP RxQ info is
> bpf_xdp_frags_increase_tail(). It clearly expects whole buff size
> instead of DMA write size. Different assumptions in ice driver
> configuration lead to negative tailroom.
>
> This allows to trigger kernel panic, when using
> XDP_ADJUST_TAIL_GROW_MULTI_BUFF xskxceiver test and changing packet
> size to
> 6912 and the requisted offset to a huge value, e.g.
"requisted offset" -> "requested offset"
Reviewed-by: Aleksandr Loktionov <[email protected]>
> XSK_UMEM__MAX_FRAME_SIZE * 100.
>
> Due to other quirks of the ZC configuration in ice, panic is not
> observed in ZC mode, but tailroom growing still fails when it should
> not.
>
> Use fill queue buffer truesize instead of DMA write size in XDP RxQ
> info.
> Fix ZC mode too by using the new helper.
>
> Fixes: 2fba7dc5157b ("ice: Add support for XDP multi-buffer on Rx
> side")
> Reviewed-by: Aleksandr Loktionov <[email protected]>
> Signed-off-by: Larysa Zaremba <[email protected]>
> ---
...
> --
> 2.52.0
