[PATCH net] net: stmmac: clear stale buf->page after recycling on skb build failure

[Maxime Chevallier]

Hi,

On 9/21/26 16:46, Lorenzo Bianconi wrote:
> In stmmac_rx(), when napi_build_skb() fails the descriptor page is
> recycled back to the page pool with page_pool_recycle_direct(), but
> buf->page is left pointing at the recycled page, unlike every other
> consumption site in the function which clears the pointer after handing
> the page away.
> 
> With the stale pointer stmmac_rx_refill() skips the replacement
> allocation and programs the already-recycled page back into the RX
> descriptor.
> 
> Clear buf->page on the napi_build_skb() failure path to keep the buffer
> lifecycle consistent with the other consumption sites.
> 
> Fixes: df542f669307 ("net: stmmac: Switch to zero-copy in non-XDP RX path")
> Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi at oss.qualcomm.com>
> ---
>  drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
> index 1fb5f804ea23..11035b7d944e 100644
> --- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
> +++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
> @@ -5887,6 +5887,7 @@ static int stmmac_rx(struct stmmac_priv *priv, int limit, u32 queue)
>  			if (!skb) {
>  				page_pool_recycle_direct(rx_q->page_pool,
>  							 buf->page);
> +				buf->page = NULL;
>  				rx_dropped++;
>  				count++;
>  				goto drain_data;

I'm not expert in the page_pool API, but this seems correct to me, the
doc says :

page_pool_recycle_direct() - release a reference on a page pool page

Seems to make sense to cleare the ref from buf->then ?

Reviewed-by: Maxime Chevallier <maxime.chevallier at bootlin.com>

Maxime

> 
> ---
> base-commit: 1e24c4f2ee44be0eee94092b5d13cbdb4bdf0d60
> change-id: 20260921-stmmac-fix-napi-build-skb-error-a02a3e839bd9
> 
> Best regards,