Patch "tsnep: Fix mapping for zero copy XDP_TX action" has been added to the 6.7-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    tsnep: Fix mapping for zero copy XDP_TX action

to the 6.7-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     tsnep-fix-mapping-for-zero-copy-xdp_tx-action.patch
and it can be found in the queue-6.7 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 26dae36131d894f8d7caf34f77cb68ea9a377325
Author: Gerhard Engleder <gerhard@xxxxxxxxxxxxxxxxxxxxx>
Date:   Wed Jan 31 21:14:13 2024 +0100

    tsnep: Fix mapping for zero copy XDP_TX action
    
    [ Upstream commit d7f5fb33cf77247b7bf9a871aaeea72ca4f51ad7 ]
    
    For XDP_TX action xdp_buff is converted to xdp_frame. The conversion is
    done by xdp_convert_buff_to_frame(). The memory type of the resulting
    xdp_frame depends on the memory type of the xdp_buff. For page pool
    based xdp_buff it produces xdp_frame with memory type
    MEM_TYPE_PAGE_POOL. For zero copy XSK pool based xdp_buff it produces
    xdp_frame with memory type MEM_TYPE_PAGE_ORDER0.
    
    tsnep_xdp_xmit_back() is not prepared for that and uses always the page
    pool buffer type TSNEP_TX_TYPE_XDP_TX. This leads to invalid mappings
    and the transmission of undefined data.
    
    Improve tsnep_xdp_xmit_back() to use the generic buffer type
    TSNEP_TX_TYPE_XDP_NDO for zero copy XDP_TX.
    
    Fixes: 3fc2333933fd ("tsnep: Add XDP socket zero-copy RX support")
    Signed-off-by: Gerhard Engleder <gerhard@xxxxxxxxxxxxxxxxxxxxx>
    Signed-off-by: David S. Miller <davem@xxxxxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/net/ethernet/engleder/tsnep_main.c b/drivers/net/ethernet/engleder/tsnep_main.c
index 9aeff2b37a61..64eadd320798 100644
--- a/drivers/net/ethernet/engleder/tsnep_main.c
+++ b/drivers/net/ethernet/engleder/tsnep_main.c
@@ -719,17 +719,25 @@ static void tsnep_xdp_xmit_flush(struct tsnep_tx *tx)
 
 static bool tsnep_xdp_xmit_back(struct tsnep_adapter *adapter,
 				struct xdp_buff *xdp,
-				struct netdev_queue *tx_nq, struct tsnep_tx *tx)
+				struct netdev_queue *tx_nq, struct tsnep_tx *tx,
+				bool zc)
 {
 	struct xdp_frame *xdpf = xdp_convert_buff_to_frame(xdp);
 	bool xmit;
+	u32 type;
 
 	if (unlikely(!xdpf))
 		return false;
 
+	/* no page pool for zero copy */
+	if (zc)
+		type = TSNEP_TX_TYPE_XDP_NDO;
+	else
+		type = TSNEP_TX_TYPE_XDP_TX;
+
 	__netif_tx_lock(tx_nq, smp_processor_id());
 
-	xmit = tsnep_xdp_xmit_frame_ring(xdpf, tx, TSNEP_TX_TYPE_XDP_TX);
+	xmit = tsnep_xdp_xmit_frame_ring(xdpf, tx, type);
 
 	/* Avoid transmit queue timeout since we share it with the slow path */
 	if (xmit)
@@ -1273,7 +1281,7 @@ static bool tsnep_xdp_run_prog(struct tsnep_rx *rx, struct bpf_prog *prog,
 	case XDP_PASS:
 		return false;
 	case XDP_TX:
-		if (!tsnep_xdp_xmit_back(rx->adapter, xdp, tx_nq, tx))
+		if (!tsnep_xdp_xmit_back(rx->adapter, xdp, tx_nq, tx, false))
 			goto out_failure;
 		*status |= TSNEP_XDP_TX;
 		return true;
@@ -1323,7 +1331,7 @@ static bool tsnep_xdp_run_prog_zc(struct tsnep_rx *rx, struct bpf_prog *prog,
 	case XDP_PASS:
 		return false;
 	case XDP_TX:
-		if (!tsnep_xdp_xmit_back(rx->adapter, xdp, tx_nq, tx))
+		if (!tsnep_xdp_xmit_back(rx->adapter, xdp, tx_nq, tx, true))
 			goto out_failure;
 		*status |= TSNEP_XDP_TX;
 		return true;