Re: [PATCH net] virtio_net: Fix resize of the RX ring

On 26/08/10 02:07PM, Vadim Fedorenko wrote:

On 10/08/2026 13:07, Anton Protopopov wrote:

quoted

When a AF_XDP socket is attached, the virtnet_rx_resize
should resize the rq->xsk_buffs XSK buffer array. Otherwise,
when the size grows, the virtnet_rx_resume() causes a write
past the end of the array. This is easily reproducable with

     ethtool -G ens3 rx 32
     ./xdpsock -i eth0 -q 0 -r -z &
     ethtool -G eth0 rx 256

Fixes: e9f3962441c0 ("virtio_net: xsk: rx: support fill with xsk buffer")
Signed-off-by: Anton Protopopov <redacted>
---
  drivers/net/virtio_net.c | 14 ++++++++++++++
  1 file changed, 14 insertions(+)

diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index 3e2a5876c6c8..e34c52d059d3 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c

@@ -3444,17 +3444,31 @@ static void virtnet_rx_resume_all(struct virtnet_info *vi)
  static int virtnet_rx_resize(struct virtnet_info *vi,
  			     struct receive_queue *rq, u32 ring_num)
  {
+	unsigned int old_ring_num = virtqueue_get_vring_size(rq->vq);
+	struct xdp_buff **tmp_xsk_buffs = NULL;
  	int err, qindex;
  	qindex = rq - vi->rq;
+	if (rq->xsk_pool && ring_num > old_ring_num) {

why do you cover only the case for growing buffer? Don't we expect to
free some memory in case of shrinking? Should be fine given you are
swapping buffers completely...

Isn't this common for "realloc[s]" to just return the same ptr, when
shrinking (to avoid extra actual allocations)?  But I do not have
any strong feelings about this, can switch to "shrink/grow", if this
looks better.

quoted

+		tmp_xsk_buffs = kvzalloc_objs(*tmp_xsk_buffs, ring_num);
+		if (!tmp_xsk_buffs)
+			return -ENOMEM;
+	}
+
  	virtnet_rx_pause(vi, rq);
  	err = virtqueue_resize(rq->vq, ring_num, virtnet_rq_unmap_free_buf, NULL);
+
+	/* virtqueue_resize may have changed the size even if err != 0 */
+	if (tmp_xsk_buffs && virtqueue_get_vring_size(rq->vq) > old_ring_num)
+		swap(rq->xsk_buffs, tmp_xsk_buffs);
+
  	if (err)
  		netdev_err(vi->dev, "resize rx fail: rx queue index: %d err: %d\n", qindex, err);
  	virtnet_rx_resume(vi, rq, true);
+	kvfree(tmp_xsk_buffs);
  	return err;
  }