Re: [PATCH net] veth: manage XDP program pointers during channel resize
From: Jakub Kicinski <kuba@kernel.org>
Date: 2026-09-21 22:41:49
Also in:
lkml, netdev, stable
Subsystem:
networking drivers, the rest · Maintainers:
Andrew Lunn, "David S. Miller", Eric Dumazet, Jakub Kicinski, Paolo Abeni, Linus Torvalds
On Thu, 17 Sep 2026 23:39:25 +0800 Weiming Shi wrote:
quoted hunk ↗ jump to hunk
veth_set_channels() tears down XDP resources for removed RX queues without clearing rq->xdp_prog. If the program is then detached or replaced, those queues keep the old pointer after bpf_prog_put(). A later channel increase can re-enable NAPI and run the freed program. Clear the program pointer after taking an RX queue offline, and publish the current program only after bringing the queue back online succeeds. BUG: unable to handle page fault for address: ffffc90000256048 Oops: Oops: 0000 [#1] SMP KASAN NOPTI RIP: veth_xdp_rcv_skb (include/linux/filter.h:779 include/net/xdp.h:696 drivers/net/veth.c:820) Call Trace: veth_xdp_rcv (drivers/net/veth.c:941) veth_poll (drivers/net/veth.c:986) __napi_poll (net/core/dev.c:7787) net_rx_action (net/core/dev.c:7850 net/core/dev.c:8007) handle_softirqs (kernel/softirq.c:645) Kernel panic - not syncing: Fatal exception in interrupt Cc: stable@vger.kernel.org Fixes: 4752eeb3d891 ("veth: implement support for set_channel ethtool op") Reported-by: <redacted> Assisted-by: LLM Signed-off-by: Weiming Shi <redacted> --- drivers/net/veth.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)diff --git a/drivers/net/veth.c b/drivers/net/veth.c index 6ed3ee81153fb..ef7624bc2c0ec 100644 --- a/drivers/net/veth.c +++ b/drivers/net/veth.c@@ -1247,12 +1247,15 @@ static int veth_napi_enable(struct net_device *dev) static void veth_disable_range_safe(struct net_device *dev, int start, int end) { struct veth_priv *priv = netdev_priv(dev); + int i; if (start >= end) return; if (priv->_xdp_prog) { veth_napi_del_range(dev, start, end); + for (i = start; i < end; i++) + rcu_assign_pointer(priv->rq[i].xdp_prog, NULL); veth_disable_xdp_range(dev, start, end, false); } else if (veth_gro_requested(dev)) { veth_napi_del_range(dev, start, end);@@ -1262,7 +1265,7 @@ static void veth_disable_range_safe(struct net_device *dev, int start, int end) static int veth_enable_range_safe(struct net_device *dev, int start, int end) { struct veth_priv *priv = netdev_priv(dev); - int err; + int err, i; if (start >= end) return 0;@@ -1281,6 +1284,9 @@ static int veth_enable_range_safe(struct net_device *dev, int start, int end) veth_disable_xdp_range(dev, start, end, true); return err; } + for (i = start; i < end; i++) + rcu_assign_pointer(priv->rq[i].xdp_prog, + priv->_xdp_prog); } else if (veth_gro_requested(dev)) { return veth_napi_enable_range(dev, start, end); }
This is pure slop, cramming loops into functions which have none. Shameful, really. Please test this and submit it if it passes the tests:
diff --git a/drivers/net/veth.c b/drivers/net/veth.c
index 6ed3ee81153f..5d5e8ebce65a 100644
--- a/drivers/net/veth.c
+++ b/drivers/net/veth.c@@ -1054,6 +1054,8 @@ static int __veth_napi_enable_range(struct net_device *dev, int start, int end) for (i = start; i < end; i++) { struct veth_rq *rq = &priv->rq[i]; + if (priv->_xdp_prog) + rcu_assign_pointer(rq->xdp_prog, priv->_xdp_prog); napi_enable(&rq->xdp_napi); rcu_assign_pointer(priv->rq[i].napi, &priv->rq[i].xdp_napi); }
@@ -1088,6 +1090,7 @@ static void veth_napi_del_range(struct net_device *dev, int start, int end) rcu_assign_pointer(priv->rq[i].napi, NULL); napi_disable(&rq->xdp_napi); + rcu_assign_pointer(rq->xdp_prog, NULL); __netif_napi_del(&rq->xdp_napi); } synchronize_net();