Re: [PATCH net v2] veth: manage XDP program pointers during channel resize

veth_set_channels() tears down XDP resources for removed RX queues
without clearing rq->xdp_prog.  If the program is then detached or
replaced, those queues keep the old pointer after bpf_prog_put().
A later channel increase can re-enable NAPI and run the freed program.

   BUG: unable to handle page fault for address: ffffc90000256048
   Oops: Oops: 0000 [#1] SMP KASAN NOPTI
   RIP: veth_xdp_rcv_skb (include/linux/filter.h:779
                          include/net/xdp.h:696 drivers/net/veth.c:820)
   Call Trace:
    veth_xdp_rcv (drivers/net/veth.c:941)
    veth_poll (drivers/net/veth.c:986)
    __napi_poll (net/core/dev.c:7787)
    net_rx_action (net/core/dev.c:7850 net/core/dev.c:8007)
    handle_softirqs (kernel/softirq.c:645)
   Kernel panic - not syncing: Fatal exception in interrupt

Fixes: 4752eeb3d891 ("veth: implement support for set_channel ethtool op")
Signed-off-by: Weiming Shi <redacted>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
---
v2:
  - different placement to avoid extra loops
v1: https://lore.kernel.org/20260917153923.904124-3-bestswngs@gmail.com (local)
---
  drivers/net/veth.c | 2 ++
  1 file changed, 2 insertions(+)

diff --git a/drivers/net/veth.c b/drivers/net/veth.c
index 6ed3ee81153f..71227d0389aa 100644
--- a/drivers/net/veth.c
+++ b/drivers/net/veth.c

@@ -1054,6 +1054,7 @@ static int __veth_napi_enable_range(struct net_device *dev, int start, int end)
  	for (i = start; i < end; i++) {
  		struct veth_rq *rq = &priv->rq[i];
  
+		rcu_assign_pointer(rq->xdp_prog, priv->_xdp_prog);
  		napi_enable(&rq->xdp_napi);
  		rcu_assign_pointer(priv->rq[i].napi, &priv->rq[i].xdp_napi);
  	}

@@ -1088,6 +1089,7 @@ static void veth_napi_del_range(struct net_device *dev, int start, int end)
  
  		rcu_assign_pointer(priv->rq[i].napi, NULL);
  		napi_disable(&rq->xdp_napi);
+		rcu_assign_pointer(rq->xdp_prog, NULL);
  		__netif_napi_del(&rq->xdp_napi);
  	}
  	synchronize_net();