netvsc_remove() lets the VF go, taking the XDP program back from it,
takes the program off the channels, then frees the channels and clears
nvdev, and only then unregisters the netdev. dev_xdp_uninstall() still
finds the program in netvsc's xdp_state[] at that point and asks
netvsc_bpf() to remove it, which fails with -ENODEV for the lack of
nvdev. That trips the WARN_ON() in dev_xdp_uninstall() on every unbind
or hot-remove of a netvsc device running native XDP, and
dev_xdp_install() returns before it drops the program from the XDP
dispatcher, which then holds on to it for good. The WARN came with
commit 7f0a838254bd ("bpf, xdp: Maintain info on attached XDP BPF
programs in net_device"): the core used to ask netvsc for its program
first, and netvsc reported none once nvdev was gone, which left the
program with the dispatcher all the same.
Accept the removal once there are no channels and no VF left to take the
program off. If suspend parked the program for netvsc_resume() to put
back, drop it from there, or resume would bring back a program the core
no longer knows about. This also lets the program be removed from a
netvsc device without a VF which lost its channels to a failed
reconfiguration, rather than fail. The core is about to record the
programs uppers propagate as well, which would bring the same to a
netvsc device enslaved to a bond running XDP.
Spotted by AI while reviewing the XDP propagation series. Untested.
Cc: stable+noautosel@kernel.org # LLM report + LLM fix, untested
Fixes: 7f0a838254bd ("bpf, xdp: Maintain info on attached XDP BPF programs in net_device")
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
---
v2:
- drop the program suspend parked for resume rather than refuse the
removal, which still tripped the WARN with the config a failed
suspend leaves behind (Sashiko)
- commit msg: the dispatcher kept the program before 7f0a838254bd too,
name the function which skips the dispatcher, and mention devices
which lost their channels to a failed reconfiguration
- Tested-by tags from v1 not carried over, the code changed
v1: https://lore.kernel.org/20261001014131.310771-6-kuba@kernel.org (local)
---
drivers/net/hyperv/netvsc_bpf.c | 16 +++++++++++++++-
1 file changed, 15 insertions(+), 1 deletion(-)
diff --git a/drivers/net/hyperv/netvsc_bpf.c b/drivers/net/hyperv/netvsc_bpf.c
index 143fc0c12841..14bb520b44ed 100644
--- a/drivers/net/hyperv/netvsc_bpf.c
+++ b/drivers/net/hyperv/netvsc_bpf.c
@@ -206,7 +206,21 @@ int netvsc_bpf(struct net_device *dev, struct netdev_bpf *bpf)
int ret;
if (!nvdev || nvdev->destroy) {
- return -ENODEV;
+ struct netvsc_device_info *saved;
+
+ if (bpf->command != XDP_SETUP_PROG || bpf->prog || vf_netdev)
+ return -ENODEV;
+
+ /* The channels and the VF are gone, and so is the program,
+ * except for the reference netvsc_suspend() keeps for
+ * netvsc_resume().
+ */
+ saved = ndevctx->saved_netvsc_dev_info;
+ if (saved && saved->bprog) {
+ bpf_prog_put(saved->bprog);
+ saved->bprog = NULL;
+ }
+ return 0;
}
switch (bpf->command) {--
2.56.0