When a AF_XDP socket is attached, the virtnet_rx_resize
should resize the rq->xsk_buffs XSK buffer array. Otherwise,
when the size grows, the virtnet_rx_resume() causes a write
past the end of the array. This is easily reproducable with

    ethtool -G ens3 rx 32
    ./xdpsock -i eth0 -q 0 -r -z &
    ethtool -G eth0 rx 256

Fixes: e9f3962441c0 ("virtio_net: xsk: rx: support fill with xsk buffer")
Signed-off-by: Anton Protopopov <a.s.protopopov@gmail.com>
---
 drivers/net/virtio_net.c | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index 3e2a5876c6c8..e34c52d059d3 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -3444,17 +3444,31 @@ static void virtnet_rx_resume_all(struct virtnet_info *vi)
 static int virtnet_rx_resize(struct virtnet_info *vi,
 			     struct receive_queue *rq, u32 ring_num)
 {
+	unsigned int old_ring_num = virtqueue_get_vring_size(rq->vq);
+	struct xdp_buff **tmp_xsk_buffs = NULL;
 	int err, qindex;
 
 	qindex = rq - vi->rq;
 
+	if (rq->xsk_pool && ring_num > old_ring_num) {
+		tmp_xsk_buffs = kvzalloc_objs(*tmp_xsk_buffs, ring_num);
+		if (!tmp_xsk_buffs)
+			return -ENOMEM;
+	}
+
 	virtnet_rx_pause(vi, rq);
 
 	err = virtqueue_resize(rq->vq, ring_num, virtnet_rq_unmap_free_buf, NULL);
+
+	/* virtqueue_resize may have changed the size even if err != 0 */
+	if (tmp_xsk_buffs && virtqueue_get_vring_size(rq->vq) > old_ring_num)
+		swap(rq->xsk_buffs, tmp_xsk_buffs);
+
 	if (err)
 		netdev_err(vi->dev, "resize rx fail: rx queue index: %d err: %d\n", qindex, err);
 
 	virtnet_rx_resume(vi, rq, true);
+	kvfree(tmp_xsk_buffs);
 	return err;
 }
 
-- 
2.43.0

On 10/08/2026 13:07, Anton Protopopov wrote:
> When a AF_XDP socket is attached, the virtnet_rx_resize
> should resize the rq->xsk_buffs XSK buffer array. Otherwise,
> when the size grows, the virtnet_rx_resume() causes a write
> past the end of the array. This is easily reproducable with
> 
>      ethtool -G ens3 rx 32
>      ./xdpsock -i eth0 -q 0 -r -z &
>      ethtool -G eth0 rx 256
> 
> Fixes: e9f3962441c0 ("virtio_net: xsk: rx: support fill with xsk buffer")
> Signed-off-by: Anton Protopopov <a.s.protopopov@gmail.com>
> ---
>   drivers/net/virtio_net.c | 14 ++++++++++++++
>   1 file changed, 14 insertions(+)
> 
> diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
> index 3e2a5876c6c8..e34c52d059d3 100644
> --- a/drivers/net/virtio_net.c
> +++ b/drivers/net/virtio_net.c
> @@ -3444,17 +3444,31 @@ static void virtnet_rx_resume_all(struct virtnet_info *vi)
>   static int virtnet_rx_resize(struct virtnet_info *vi,
>   			     struct receive_queue *rq, u32 ring_num)
>   {
> +	unsigned int old_ring_num = virtqueue_get_vring_size(rq->vq);
> +	struct xdp_buff **tmp_xsk_buffs = NULL;
>   	int err, qindex;
>   
>   	qindex = rq - vi->rq;
>   
> +	if (rq->xsk_pool && ring_num > old_ring_num) {

why do you cover only the case for growing buffer? Don't we expect to
free some memory in case of shrinking? Should be fine given you are
swapping buffers completely...

> +		tmp_xsk_buffs = kvzalloc_objs(*tmp_xsk_buffs, ring_num);
> +		if (!tmp_xsk_buffs)
> +			return -ENOMEM;
> +	}
> +
>   	virtnet_rx_pause(vi, rq);
>   
>   	err = virtqueue_resize(rq->vq, ring_num, virtnet_rq_unmap_free_buf, NULL);
> +
> +	/* virtqueue_resize may have changed the size even if err != 0 */
> +	if (tmp_xsk_buffs && virtqueue_get_vring_size(rq->vq) > old_ring_num)
> +		swap(rq->xsk_buffs, tmp_xsk_buffs);
> +
>   	if (err)
>   		netdev_err(vi->dev, "resize rx fail: rx queue index: %d err: %d\n", qindex, err);
>   
>   	virtnet_rx_resume(vi, rq, true);
> +	kvfree(tmp_xsk_buffs);
>   	return err;
>   }
>

On 26/08/10 02:07PM, Vadim Fedorenko wrote:
> On 10/08/2026 13:07, Anton Protopopov wrote:
> > When a AF_XDP socket is attached, the virtnet_rx_resize
> > should resize the rq->xsk_buffs XSK buffer array. Otherwise,
> > when the size grows, the virtnet_rx_resume() causes a write
> > past the end of the array. This is easily reproducable with
> > 
> >      ethtool -G ens3 rx 32
> >      ./xdpsock -i eth0 -q 0 -r -z &
> >      ethtool -G eth0 rx 256
> > 
> > Fixes: e9f3962441c0 ("virtio_net: xsk: rx: support fill with xsk buffer")
> > Signed-off-by: Anton Protopopov <a.s.protopopov@gmail.com>
> > ---
> >   drivers/net/virtio_net.c | 14 ++++++++++++++
> >   1 file changed, 14 insertions(+)
> > 
> > diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
> > index 3e2a5876c6c8..e34c52d059d3 100644
> > --- a/drivers/net/virtio_net.c
> > +++ b/drivers/net/virtio_net.c
> > @@ -3444,17 +3444,31 @@ static void virtnet_rx_resume_all(struct virtnet_info *vi)
> >   static int virtnet_rx_resize(struct virtnet_info *vi,
> >   			     struct receive_queue *rq, u32 ring_num)
> >   {
> > +	unsigned int old_ring_num = virtqueue_get_vring_size(rq->vq);
> > +	struct xdp_buff **tmp_xsk_buffs = NULL;
> >   	int err, qindex;
> >   	qindex = rq - vi->rq;
> > +	if (rq->xsk_pool && ring_num > old_ring_num) {
> 
> why do you cover only the case for growing buffer? Don't we expect to
> free some memory in case of shrinking? Should be fine given you are
> swapping buffers completely...

Isn't this common for "realloc[s]" to just return the same ptr, when
shrinking (to avoid extra actual allocations)?  But I do not have
any strong feelings about this, can switch to "shrink/grow", if this
looks better.

> > +		tmp_xsk_buffs = kvzalloc_objs(*tmp_xsk_buffs, ring_num);
> > +		if (!tmp_xsk_buffs)
> > +			return -ENOMEM;
> > +	}
> > +
> >   	virtnet_rx_pause(vi, rq);
> >   	err = virtqueue_resize(rq->vq, ring_num, virtnet_rq_unmap_free_buf, NULL);
> > +
> > +	/* virtqueue_resize may have changed the size even if err != 0 */
> > +	if (tmp_xsk_buffs && virtqueue_get_vring_size(rq->vq) > old_ring_num)
> > +		swap(rq->xsk_buffs, tmp_xsk_buffs);
> > +
> >   	if (err)
> >   		netdev_err(vi->dev, "resize rx fail: rx queue index: %d err: %d\n", qindex, err);
> >   	virtnet_rx_resume(vi, rq, true);
> > +	kvfree(tmp_xsk_buffs);
> >   	return err;
> >   }
>