Commit 364b88b54fc2 for kernel

commit 364b88b54fc260d22ee318bae862c2d7d8c31dc6
Author: Jakub Kicinski <kuba@kernel.org>
Date:   Tue Oct 27 16:49:40 2026 -0700

    eth: bnxt: hand XDP frags over to the copybreak skb

    With a multi-buffer XDP program attached, a packet only has agg
    buffers if it filled its head buffer, which in page mode holds most
    of a page. The program can still move the start of the packet forward
    with bpf_xdp_adjust_head() and leave at most rx_copybreak bytes in the
    head. bnxt_rx_pkt() then copies the head into a new skb, puts the head
    page back on the ring, and calls bnxt_xdp_build_skb() on the copy.
    bnxt_xdp_build_skb() only sets nr_frags and the skb's length
    accounting, because it expects an skb built around the head page,
    sharing its shinfo with the xdp_buff. The copy ends up with nr_frags
    set but no frag descriptors, and the stack later reads and releases
    whatever its frags array happens to contain. The real frags leak.

    Copy the frag descriptors to the new skb in bnxt_copy_xdp(), so that
    bnxt_xdp_build_skb() finds the frags where it expects them. The frags
    now belong to the skb, and the head page goes back on the ring as
    before.

    Pointed out in LLM review of the first patch of the series.
    Confirmed by reading the code, the unfixed kernel was not run with
    the reproducer below.
    Tested on a BCM57504 at MTU 9000 with rx-copybreak raised to 1024
    and a frags-capable XDP program moving the start of multi-buffer
    frames 3000B forward with bpf_xdp_adjust_head(), receiving 8000B
    ICMPv6 echo requests (a head and two agg buffers each). All 60k
    frames took the copybreak path with frags attached, the sampled skbs
    reached GRO with len=4998 data_len=4492 nr_frags=2, and were freed by
    the stack with the page pools' inflight count staying flat, no KASAN
    or DEBUG_PAGEALLOC splats.

    Fixes: 1dc4c557bfed ("bnxt: adding bnxt_xdp_build_skb to build skb from multibuffer xdp_buff")
    Reviewed-by: Michael Chan <michael.chan@broadcom.com>
    Link: https://patch.msgid.link/20261027234940.1267225-6-kuba@kernel.org
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>

diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
index 4607c31eedf8..757c7266ce15 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
@@ -1511,6 +1511,14 @@ static struct sk_buff *bnxt_copy_xdp(struct bnxt_napi *bnapi,
 		__skb_pull(skb, metasize);
 	}

+	if (unlikely(xdp_buff_has_frags(xdp))) {
+		struct skb_shared_info *sinfo;
+
+		sinfo = xdp_get_shared_info_from_buff(xdp);
+		memcpy(skb_shinfo(skb)->frags, sinfo->frags,
+		       sinfo->nr_frags * sizeof(skb_frag_t));
+	}
+
 	return skb;
 }