I'm always confused which tree(net or bpf) should XDP target. bpf_xdp_shrink_data() frees a page_pool frag with the wrong memory type on skb-backed XDP, hitting "Bad page state ... page_pool leak". Both the generic XDP path and the veth path are affected.
Patch 1 fixes it by tagging the xdp_buff, so it no longer depends on rxq->mem.type (which is shared on generic XDP and gets reset on veth). It is reported by syzbot. Patch 2 adds a selftest that reproduces the leak on both paths. v2 -> v3: handle some feedback from AI review. v2: https://lore.kernel.org/bpf/[email protected]/ v1 -> v2: AI found the fix was insufficient and we need a general way to fix them. v1: https://lore.kernel.org/bpf/[email protected]/ Jiayuan Chen (2): bpf, veth: xdp: fix page_pool page leak on skb-backed XDP selftests/bpf: add xdp_shrink_frags drivers/net/veth.c | 6 + include/net/xdp.h | 30 +- net/core/dev.c | 6 + net/core/filter.c | 7 + .../bpf/prog_tests/xdp_shrink_frags.c | 288 ++++++++++++++++++ .../selftests/bpf/progs/xdp_shrink_frags.c | 34 +++ 6 files changed, 370 insertions(+), 1 deletion(-) create mode 100644 tools/testing/selftests/bpf/prog_tests/xdp_shrink_frags.c create mode 100644 tools/testing/selftests/bpf/progs/xdp_shrink_frags.c -- 2.43.0
