From nobody Mon Sep 28 23:55:25 2026 Received: from mail-pf1-f199.google.com (mail-pf1-f199.google.com [209.85.210.199]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A017A3BCD15 for ; Fri, 14 Aug 2026 23:49:14 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.199 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786751356; cv=none; b=sdYdZ/1L+rc0gSygMfSLN1XH8dPGU9lxYIjp25gOImTbUs7R373UN+OnA8x9WpXF6XOj+jrzN5IBO/GMiXjHO1HHotP4mlfPq/tZ/lJH9o16poq6pPb9CGR5kHKFhnGOfsa/tICqJF73TYGwy9IplPIfm5O22ODwDwgNMdMw8t8= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786751356; c=relaxed/simple; bh=Njo9Scw+cZ0axzyruRFtQV57OOW0xRQgQiMV2RmH80I=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=nIoLzT9qSs5GXN3X7QuC8Id6FKU6rh86XLwTIjfyHhA8jrbiwZBpAtngOOBl2fXlVbte9+b1hIiS3HlblAaslWWNQxlNPZWtxnASZOOGnOcWOwUB5QawrVRL6+qcay0dMLOQkLahrd9uIGOu6paMaGX5S8IWoFX8shx5pMJ9fZ0= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--joshwash.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=WXUGx4/2; arc=none smtp.client-ip=209.85.210.199 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--joshwash.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="WXUGx4/2" Received: by mail-pf1-f199.google.com with SMTP id d2e1a72fcca58-848544a8496so1372504b3a.0 for ; Fri, 14 Aug 2026 16:49:14 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1786751354; x=1787356154; darn=vger.kernel.org; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:from:to:cc:subject:date:message-id:reply-to :content-type; bh=61NmZboWuvt14l6xEsYMUiDHdyYvEJ2BGOPR7D4eCzM=; b=WXUGx4/2whMrd34of/rrP33tA103ZemTcCiOewHIBFOk5+YAA7iILJ3UtfY9+NjLrq ew21VqDPPtJk35oDeqi1s5wJ3lXUnKC6Qry6wRgq7koPns6CpacEdfoBwFiM1ofndif2 3OYZ+pjMKjTI8NkWDWw5E+3ws0Vd2sd2CNnzs1g4f54NumNVIHGkSqq3rTkEUR6wTP24 2U2YnqHJ67dWBX1QaABi6oFBr5tCBA0YSlHa5RXgBFViDD6UDwsYecvemorbYhtEZ/fD z4Vm0knuHR0TJyS7KNjNOMXmDIHRG6hKVbI5u2a+y9QZLyrAJ7YZi6DSibU6NQeBQNWZ WIRQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786751354; x=1787356154; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=61NmZboWuvt14l6xEsYMUiDHdyYvEJ2BGOPR7D4eCzM=; b=p/UhGZXjKylWA2jfAJkVgkyitYqZjdu1Ymz12TqWVzYjUDU87hZMxRZBBfpq2sI4qR eSTZF6sAktRAucSW/HlQKzQL7Iv8CiLTxDC7kP3g0ibdOnqoCIvFFunKMu3Xrn9oiAaO OVoOrWTIf+VBNiMGthHiEW5sqjjooAPYWAhiuQwbMPWsdfIAh9Qd/DnGDMUPE/Pe/Lmx BMhIqzCR/o0dnc5JBRPayn6X/pNnjqw5lxBNMQs3wv+P+xhZpShfRC/G6vi+h/Dyg9oA gREDlCZ1CseYLR7Nx8A4vQJcao5olXex8u2Iuw4SVeN6Hhr8fdTftHoIboZzNgP85hd+ +cyg== X-Forwarded-Encrypted: i=1; AHgh+RpUVBZtJRKcjx4QuZIxZdOck83xMdN0oJgAKPR4LmohfJqAjNEPMIyZmuqqTB5rsC2RrkHE1lBV6tQ10WE=@vger.kernel.org X-Gm-Message-State: AOJu0YxIgpo15SRm2wNoAtRXApV9batgYySCY3EowtX2KwDi1ZP25Pw+ wKZRpEY15WPhhGtAc/23qss6yUZutEBDCGZWSeQAO/0mrkndyxRnUd1kQBQuQi5qrS7lkFuUzFS mjQS7SqL3lAzWvA== X-Received: from pfbhj23.prod.google.com ([2002:a05:6a00:8717:b0:84c:23c5:6759]) (user=joshwash job=prod-delivery.src-stubby-dispatcher) by 2002:a05:6a00:1c9e:b0:845:ba94:a56 with SMTP id d2e1a72fcca58-84fddfbf1cbmr10357248b3a.5.1786751353818; Fri, 14 Aug 2026 16:49:13 -0700 (PDT) Date: Fri, 14 Aug 2026 16:48:40 -0700 In-Reply-To: <20260814234845.773189-1-joshwash@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20260814234845.773189-1-joshwash@google.com> X-Mailer: git-send-email 2.55.0.691.gc56d675ccc-goog Message-ID: <20260814234845.773189-2-joshwash@google.com> Subject: [PATCH net 1/6] gve: increment work_done for XDP and error packets From: Joshua Washington To: netdev@vger.kernel.org Cc: Joshua Washington , Harshitha Ramamurthy , Andrew Lunn , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Jordan Rhee , Willem de Bruijn , Ankit Garg , Tim Hostetler , Praveen Kaligineedi , Jeroen de Borst , Stanislav Fomichev , linux-kernel@vger.kernel.org, bpf@vger.kernel.org, stable@vger.kernel.org Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" The GVE RX NAPI will continue polling as long as 1) there are packets to be processed, and 2) less than NAPI budget SKBs (denoted in GVE by work_done) have been passed up to the kernel. However, GVE does not account for all of the packets that don't create SKBs, namely error packets and XDP packets. This can result in XDP programs that scarcely return XDP_PASS failing to exit the NAPI poll as long as the NIC is DMA'ing packets, possibly processing the entire RX ring before returning from the NAPI. This has 3 negative implications: 1) XDP RX path can run much longer than is desirable, hogging CPU resources. 2) If XDP_PASS is never returned, the work_done never increases beyond 0, which can lead to scheduling delays due to missed chances to reschedule the NAPI. 3) In AF_XDP zero-copy, XSK_TX occurs after the RX poll. If the RX poll takes a long time, it will delay TX, leading to degraded performance. Ensure every packet is accounted for in work_done by incrementing work_done before checking for the existence of a SKB. Fixes: 293b49361f91 ("gve: add XDP DROP and PASS support for DQ") Cc: stable@vger.kernel.org Reviewed-by: Tim Hostetler Reviewed-by: Jordan Rhee Signed-off-by: Joshua Washington --- drivers/net/ethernet/google/gve/gve_rx_dqo.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/drivers/net/ethernet/google/gve/gve_rx_dqo.c b/drivers/net/eth= ernet/google/gve/gve_rx_dqo.c index 0ece2f6fdffb..db38bc645296 100644 --- a/drivers/net/ethernet/google/gve/gve_rx_dqo.c +++ b/drivers/net/ethernet/google/gve/gve_rx_dqo.c @@ -1145,13 +1145,14 @@ int gve_rx_poll_dqo(struct gve_notify_block *block,= int budget) /* Free running counter of completed descriptors */ rx->cnt++; =20 - if (!rx->ctx.skb_head) - continue; - if (!compl_desc->end_of_packet) continue; =20 work_done++; + + if (!rx->ctx.skb_head) + continue; + pkt_bytes =3D rx->ctx.skb_head->len; /* The ethernet header (first ETH_HLEN bytes) is snipped off * by eth_type_trans. --=20 2.55.0.691.gc56d675ccc-goog From nobody Mon Sep 28 23:55:25 2026 Received: from mail-pf1-f198.google.com (mail-pf1-f198.google.com [209.85.210.198]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8B5643F075E for ; Fri, 14 Aug 2026 23:49:16 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.198 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786751358; cv=none; b=q9JJ5TPqGSsJYyvI5tJTqMTgdYRHKPsvtXp2lEOwOupek7gdctvYBkQQS6o8TigNvRhvPynCwNauKlQQqQhxiiAjiAVzctM49xXj6UUucYsrfRYl/7fk3TRES0WYYeqlYbWZ44AK7Bd6mofZQtwN7MKKKko6BJI2rBe8mk/8hAo= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786751358; c=relaxed/simple; bh=Vrq8TFknVqZqc/8JOPgG7PDUWg3gpVhuozznIWgm30E=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=W7zm/yeADNXP6tyMTsONK4RQ7Z4eUNVY2b4D1sUYxogH0HG41lhBoUclavHq3wPqB0xFgeLlyRMse1he8DzhgpbcX0iz2tdG964ce/Uj+/4k8g3ga5DTbM6W4vNphZq3l24D+ofEqIVyWtMG8J8OiNHFjH6fEWdXsBlMewSs+dw= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--joshwash.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=GnTkp0nP; arc=none smtp.client-ip=209.85.210.198 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--joshwash.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="GnTkp0nP" Received: by mail-pf1-f198.google.com with SMTP id d2e1a72fcca58-84e4ef9a74aso2390547b3a.1 for ; Fri, 14 Aug 2026 16:49:16 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1786751356; x=1787356156; darn=vger.kernel.org; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:from:to:cc:subject:date:message-id:reply-to :content-type; bh=mrN2/9T5gE9eG4RGKPE/4WL0YOiYDGqFenhtgUxLKRo=; b=GnTkp0nPfxFYd7XT+TOl1JxkQZtAvFJbjy+LkqinG3KEWrfKxPcSeLUy5RuaY6uVNV oHfsgoLGNYYGtNc1754SnyobyjEXWIo74IDZLoXatblUCNJa32syuASyBi1L5jKg/fRU zxq8T5Ik2QCvPFZ4l7QNhAuoFxNwlIv1hxlj2LlGlrnLLGkmtJ46n6747aVFrizNBGdq gwZZ0JhXRDtkLDcaWp3aPiRiTddr0KTuXiENg4VKeO59InAw4dg5e9aqnLIt4LrAGdf/ HUfS4On6Pu5YYU4J4F0spaQ64voa+4j5DgyGogjKfRkZfIVjfMgV4R2WxTwlxuFcnH0u JFjg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786751356; x=1787356156; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=mrN2/9T5gE9eG4RGKPE/4WL0YOiYDGqFenhtgUxLKRo=; b=EeLt3VGx0xhn3j0LZR3dpQD7jRIqSzwoZ2al9COrzZKwgUF++YTzlGg7TMDm5K/tZY kvOhfZm9xUleg0rb1+8zQ9aKmhsqmXvyS8U1Z2C35KcabKdJQYXNBvo56f4Decg7VHv6 +gw1P8MIV23z8YTrLfZoPhTlRwG9oPwlIepo7oR+kPc39sodIdbytq1NGqt/fM9/LjFd gpMP9kyciqWGK93HnCPZXV/OMJZMaUAapSdCEkhtBFLtztODiocAGPn5Eic/5V+KtMw0 VZM4KcIb+PtJX354eTuW6miBff4Ykh9pSMKp1muOTqbrxLUDopdjkgRLGN+AVoZHk+ex Q7Zw== X-Forwarded-Encrypted: i=1; AHgh+RqZGVkrs8mG5JFJQJ8/tJ7x6pWUMEvY4MH97SYd5yEn7U6uPwrJ0oJl5tfhen6KSjZZlX16NHjF7DcocK4=@vger.kernel.org X-Gm-Message-State: AOJu0YzPhQyIEWNYEdK7joPJpFf1Dit6Kxj57iVmxKptYLTo8cs4B8vo jOiBw02c+rTOvA7+Vp4YEU4zEkmbkvuGnCX9zXp6NoZXaeaa2DW9xDjR6RIKTu/ET6SkTwL0xKQ 6iCJHLGcvbhG3YQ== X-Received: from pfuu5.prod.google.com ([2002:a05:6a00:6f85:b0:848:4e44:7f19]) (user=joshwash job=prod-delivery.src-stubby-dispatcher) by 2002:a05:6a00:850:b0:84e:5e4:b9a2 with SMTP id d2e1a72fcca58-84fde31a0bdmr8848385b3a.36.1786751355562; Fri, 14 Aug 2026 16:49:15 -0700 (PDT) Date: Fri, 14 Aug 2026 16:48:41 -0700 In-Reply-To: <20260814234845.773189-1-joshwash@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20260814234845.773189-1-joshwash@google.com> X-Mailer: git-send-email 2.55.0.691.gc56d675ccc-goog Message-ID: <20260814234845.773189-3-joshwash@google.com> Subject: [PATCH net 2/6] gve: fix XSK buffer leak when rings are stopped From: Joshua Washington To: netdev@vger.kernel.org Cc: Joshua Washington , Harshitha Ramamurthy , Andrew Lunn , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Jordan Rhee , Willem de Bruijn , Ankit Garg , Tim Hostetler , Praveen Kaligineedi , Jeroen de Borst , Stanislav Fomichev , linux-kernel@vger.kernel.org, bpf@vger.kernel.org, stable@vger.kernel.org Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" GVE does not free XSK buffers when resetting ring state as a part of stopping queues. This causes all XSK buffers which are posted to the NIC to be leaked. Free XSK buffers attached to an allocated buf_state when stopping rings. Fixes: c1fffc5d66a7 ("gve: implement DQO RX datapath and control path for A= F_XDP zero-copy") Cc: stable@vger.kernel.org Reviewed-by: Tim Hostetler Reviewed-by: Jordan Rhee Signed-off-by: Joshua Washington --- drivers/net/ethernet/google/gve/gve_rx_dqo.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/net/ethernet/google/gve/gve_rx_dqo.c b/drivers/net/eth= ernet/google/gve/gve_rx_dqo.c index db38bc645296..2c1ce23d1550 100644 --- a/drivers/net/ethernet/google/gve/gve_rx_dqo.c +++ b/drivers/net/ethernet/google/gve/gve_rx_dqo.c @@ -113,6 +113,12 @@ static void gve_rx_reset_ring_dqo(struct gve_priv *pri= v, int idx) gve_free_to_page_pool(rx, bs, false); else gve_free_qpl_page_dqo(bs); + + if (gve_buf_state_is_allocated(rx, bs) && + bs->xsk_buff) { + xsk_buff_free(bs->xsk_buff); + bs->xsk_buff =3D NULL; + } } } =20 --=20 2.55.0.691.gc56d675ccc-goog From nobody Mon Sep 28 23:55:25 2026 Received: from mail-pl1-f199.google.com (mail-pl1-f199.google.com [209.85.214.199]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 515CA35E1D5 for ; Fri, 14 Aug 2026 23:49:18 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.199 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786751363; cv=none; b=BvfwkgGacDDw5mNEx0pkC1puYoe2uy+mndvOBrdzefMLe9bcgvSEg8fO9YIcNuVCGmLkaDafLlyZ+BeUFK5y+kM2eUkZq6W/1eu6whYAPGbKNzcdwwK7MXmHuWW2U6KB5mGphsbxJ1/i17Nt1Yu/wkR/Ttxf8XVLwiV/VVbK/hA= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786751363; c=relaxed/simple; bh=i5raLJ/viRB4jfYcj0wFvVQznmGjwyiH+SUbX8pRp8k=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=G+9L7Axeb3riJpEtMYE66IrP6vqJBArGS1BeGN7DVRfZuDHvK9kZaYkxmTM7ouUwmqAd7bn6GWSv5AlKgzQRBA6//gKGpD2AaCU3fTlbsJ/imdY16tgxCgXMZ/8+FvkzayvsFbD3G7oZxGf2n7zPJqnHqXbe0g94UVMd4JatAgs= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--joshwash.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=p6mrx4fn; arc=none smtp.client-ip=209.85.214.199 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--joshwash.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="p6mrx4fn" Received: by mail-pl1-f199.google.com with SMTP id d9443c01a7336-2d001671a54so31666435ad.2 for ; Fri, 14 Aug 2026 16:49:18 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1786751358; x=1787356158; darn=vger.kernel.org; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:from:to:cc:subject:date:message-id:reply-to :content-type; bh=7djAafJOLBuE+bXbQTtDxXCPhwnYez80KiMRMTkFHt4=; b=p6mrx4fnHojiNdphcYhOL1pN3SK3a2BR+qXr+ynr9+jIS+E/5Lhp1IVi67MNm2AzE+ unPSkS+O5JbFV536ggTX0fFNDsceiaGM57CD8+qsH3BOitfPPHzF/zIS+Oe//JKWHYGZ tgIlS8aRhAx6D+1+PmIE+pj/+mG+hyOawuWRkXlQTjCcTbeR7JwzmfNBGN5oemaKp8nB FFArPu+nCYHZ4i9ZbOkgdawHVtfcCf22yiTjd1zU+EitSAQrY23TEpJ+cTiiuXjkkFZO SnoTLO29VqgWx0v4Y8oPSQeG4s8bG93En7UdgwssXSg1wsvQqZ5s9UZ+n5u/h/Tw/7JS dqkA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786751358; x=1787356158; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=7djAafJOLBuE+bXbQTtDxXCPhwnYez80KiMRMTkFHt4=; b=nCP6mlVebU3SQEoNROc6iqFmhEcZe35L27TN7icVamre9N1G6t0otAMqPbVdZwOfmT Rm0xGAz8Th+H2lD5tbe3AMJ4tsvomP3RvfoMLn4os/8DVN3QpQF5N+uAvQ5ev6oRZL4x q6B78nrexaUc6sjzZzZaRqqqyUekagwmIzYpT2Yz1MNmJzePByN5/9wnFrpUuIS7WP/u 0mzwaVush9FgNOsFGuSs7q07dGGAWGoQxkmjnImsWMEZcI1R9AZnRfkvfgPV7qnJj06v EKw+tZ39D/cgG8n0YBfw4qJzH03dBOGnDFkB65vJkHZNo+GsEn+OW+3AhRUeOgyGlxSd C40A== X-Forwarded-Encrypted: i=1; AHgh+RrXIivN/AAu3QseQT1dCsSZ0joV/wlgOJiO6QZvnOIHuDL8S2xzcmyrtkvxYA6jmkmbOUpsvSOvjkT0S04=@vger.kernel.org X-Gm-Message-State: AOJu0YxJBOksTuJ4QlLY6ahYj+DI23ICXiIWZVZ60+BE7ThGZb1G7xUI P4wQZFb1e71vcL5OJl0ngQ3jlvSbO9IMpKiUfo7/HmKpYPzghfmQdr//+0szf+K4FXoN5QdhQG1 HOpAWvptoJcaYTg== X-Received: from plnt11.prod.google.com ([2002:a17:903:196b:b0:2c9:a5a0:a677]) (user=joshwash job=prod-delivery.src-stubby-dispatcher) by 2002:a17:902:f689:b0:2c9:fa31:84f9 with SMTP id d9443c01a7336-2d3b0cdc256mr101631195ad.5.1786751357477; Fri, 14 Aug 2026 16:49:17 -0700 (PDT) Date: Fri, 14 Aug 2026 16:48:42 -0700 In-Reply-To: <20260814234845.773189-1-joshwash@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20260814234845.773189-1-joshwash@google.com> X-Mailer: git-send-email 2.55.0.691.gc56d675ccc-goog Message-ID: <20260814234845.773189-4-joshwash@google.com> Subject: [PATCH net 3/6] gve: fix XSK buffer leak on error descriptor From: Joshua Washington To: netdev@vger.kernel.org Cc: Joshua Washington , Harshitha Ramamurthy , Andrew Lunn , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Jordan Rhee , Willem de Bruijn , Ankit Garg , Tim Hostetler , Praveen Kaligineedi , Jeroen de Borst , Stanislav Fomichev , linux-kernel@vger.kernel.org, bpf@vger.kernel.org, stable@vger.kernel.org Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" When the error bit is set in the RX completion descriptor, the buf_state and its attached buffer should be freed. In the case of AF_XDP ZC, the XSK buffer was not freed, leading to a leak. Fixes: c1fffc5d66a7 ("gve: implement DQO RX datapath and control path for A= F_XDP zero-copy") Cc: stable@vger.kernel.org Reviewed-by: Jordan Rhee Reviewed-by: Tim Hostetler Signed-off-by: Joshua Washington --- drivers/net/ethernet/google/gve/gve_rx_dqo.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/net/ethernet/google/gve/gve_rx_dqo.c b/drivers/net/eth= ernet/google/gve/gve_rx_dqo.c index 2c1ce23d1550..811db42d05c6 100644 --- a/drivers/net/ethernet/google/gve/gve_rx_dqo.c +++ b/drivers/net/ethernet/google/gve/gve_rx_dqo.c @@ -845,7 +845,12 @@ static int gve_rx_dqo(struct napi_struct *napi, struct= gve_rx_ring *rx, } =20 if (unlikely(compl_desc->rx_error)) { - gve_free_buffer(rx, buf_state); + if (buf_state->xsk_buff) { + xsk_buff_free(buf_state->xsk_buff); + gve_free_buf_state(rx, buf_state); + } else { + gve_free_buffer(rx, buf_state); + } return -EINVAL; } =20 --=20 2.55.0.691.gc56d675ccc-goog From nobody Mon Sep 28 23:55:25 2026 Received: from mail-pf1-f200.google.com (mail-pf1-f200.google.com [209.85.210.200]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id CD7863DC4D3 for ; Fri, 14 Aug 2026 23:49:19 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.200 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786751367; cv=none; b=VBnXPxhYNDQ98OUd6B5G8/f7rwnWnEPWpQHIxifwbLO0V3kt+CD1na/QYMr9VuVSFXC8Jx7/e398f9nLCUqActZIcG9i/0WguEwJ4n7ifwZhRxXrngjH10Pf0qUpk7AqMBoq4BPCgvcj6OjN7REmqYtT9akjiYAmmuF9tOitQ34= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786751367; c=relaxed/simple; bh=/ECkwXTcbS/nrl8o0PNyBOTEnaTt4kJMaOMMUVKH7IE=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=HCAKCwLVSdSrpQZGVTJaTAOpwN36KW4iNXPAYT3fuo6fHlHAiN8arkIcK/zpwPFnUvVbJmAZ6dY6rcoWJiRImVYN7WCFxZGdl2J83AOZOTKGX7dc0Mty00aPno0RCo3eYpVSXvdlUbWJMwHd3xYbLoV8PELORxW90LRyzEatEpU= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--joshwash.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=tgDEd7KH; arc=none smtp.client-ip=209.85.210.200 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--joshwash.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="tgDEd7KH" Received: by mail-pf1-f200.google.com with SMTP id d2e1a72fcca58-848d21bbb55so2060768b3a.0 for ; Fri, 14 Aug 2026 16:49:19 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1786751359; x=1787356159; darn=vger.kernel.org; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:from:to:cc:subject:date:message-id:reply-to :content-type; bh=Nj+GAK80Vf0LtjqMeVaepRws/HUe3sjBCweZwIjqkZ0=; b=tgDEd7KHYjeQu+VsJLq06dlX9H1wiZaOhcJChoNHiN+02KEUdrayjaa12rNbt2erZm gY5hbxKLmkdcKoS813c+PjztaccHq6biPGAlx/jNtKzmABLDE8c7WcNOXQZC/ni7hBPO pU3u/pgQOipyU79vhH/I8fQntF8ZYYc7+/C3QCG9juag2Uz7kyp3rXRy55QNjW2hQQZt rxDNA3miGierylYJeiCRsSmXdXzQSmCsh6mKzZifprkqliPkTBDwnv8Upc88axtHDyVY KKEEJfWU81MzHJ7JJPu4+XuJRWdSRPHPUeI9UuTn9MDiIPQ9bUNKvgGp2i62SLKmSoiq ZZVg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786751359; x=1787356159; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=Nj+GAK80Vf0LtjqMeVaepRws/HUe3sjBCweZwIjqkZ0=; b=F9hP8mo9GCt5Nns0pVaPxwJph/i96UA+znI2E2iik+HZI4UjdG+Kkif2BlYheh9iSi b5SkWwtGyFNjXIHZMAi+RD/8fxWZRXpgWot8el3F71yCPz0ocJ4rk7hDQZY78LxZ3N/g oduzIv5ZjNHOidFCcn27DzA1PBmZI+Qq6AQTfCaQHKz7E8/Zp2kBNUUQgiAp0q/4NrdH nzdSH/28y167UVfeO7T3wZc3uBD1ip1wVAyPG5qAocZHlH/OP2OIf5UiLoy1MwHwDij1 HXftGTbb+aHNSXRDNPcazSkNYYplpo3Ncq/6OeJIMkohwutMaTnRkI7sUa4zE7B+IZHm 6A9g== X-Forwarded-Encrypted: i=1; AHgh+RqWGMoEI+tGunf2RDRLkAWZYNqU0dLiewEMQTh4Bqq0GzCrtJ8Ew2DVyb0VU+R64ehNroWlxEfcDzuyPzg=@vger.kernel.org X-Gm-Message-State: AOJu0YwrEcvX8W2z0q0IK2MFHVwviFmQSmwqzqUvr8d71UmaTfJRUwdS QAzlNiQhvGhgLfK2blea8lG8RPGv/re6k9RtAorEKpHfbM4TEyija32NBLue//d/PgOz8hGHyap OE5i86Yvkob4ucQ== X-Received: from pfes10.prod.google.com ([2002:aa7:8d4a:0:b0:848:4642:f1d3]) (user=joshwash job=prod-delivery.src-stubby-dispatcher) by 2002:a05:6a00:3ccf:b0:845:40d1:87fa with SMTP id d2e1a72fcca58-84fde20e2a4mr9752920b3a.25.1786751359066; Fri, 14 Aug 2026 16:49:19 -0700 (PDT) Date: Fri, 14 Aug 2026 16:48:43 -0700 In-Reply-To: <20260814234845.773189-1-joshwash@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20260814234845.773189-1-joshwash@google.com> X-Mailer: git-send-email 2.55.0.691.gc56d675ccc-goog Message-ID: <20260814234845.773189-5-joshwash@google.com> Subject: [PATCH net 4/6] gve: don't register xsk pool on pre-existing queues in RDA mode From: Joshua Washington To: netdev@vger.kernel.org Cc: Joshua Washington , Harshitha Ramamurthy , Andrew Lunn , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Jordan Rhee , Willem de Bruijn , Ankit Garg , Tim Hostetler , Praveen Kaligineedi , Jeroen de Borst , Stanislav Fomichev , linux-kernel@vger.kernel.org, bpf@vger.kernel.org, stable@vger.kernel.org Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" When XSK pools are enabled after an XDP program has already been loaded, XSK pools are registered on pre-existing queues before queues are re-created with the XSK pool fully registered in DQ RDA mode. This can lead to a race condition between the RX NAPI and the control plane thread wherein a pre-existing queue sees the live XSK pool and attempts to use recycled buffers not backed by XSK buffs for AF_XDP ZC traffic. This causes the following kernel panic to occur when attempting to DMA map a NULL XSK buffer: BUG: kernel NULL pointer dereference, address: 0000000000000050 ... RIP: 0010:gve_rx_post_buffers_dqo+0x99/0x190 [gve] ... Call Trace: gve_rx_poll_dqo+0x4d9/0xf10 [gve] gve_napi_poll_dqo+0x76/0x170 [gve] __napi_poll+0x28/0x160 net_rx_action+0x2a0/0x350 handle_softirqs+0xd4/0x280 ? sort_range+0x20/0x20 run_ksoftirqd+0x2d/0x40 smpboot_thread_fn+0xd5/0x1d0 kthread+0xd7/0x100 ? kthread_complete_and_exit+0x20/0x20 ret_from_fork+0x1f/0x30 The XSK pool should only be registered with current queues if XSK buffers are allocated on-the-fly, as is the case in QPL mode. Fixes: c1fffc5d66a7 ("gve: implement DQO RX datapath and control path for A= F_XDP zero-copy") Cc: stable@vger.kernel.org Reviewed-by: Jordan Rhee Reviewed-by: Tim Hostetler Signed-off-by: Joshua Washington --- drivers/net/ethernet/google/gve/gve_main.c | 16 +++++++--------- 1 file changed, 7 insertions(+), 9 deletions(-) diff --git a/drivers/net/ethernet/google/gve/gve_main.c b/drivers/net/ether= net/google/gve/gve_main.c index e4d78ae52daf..453b304016b6 100644 --- a/drivers/net/ethernet/google/gve/gve_main.c +++ b/drivers/net/ethernet/google/gve/gve_main.c @@ -1654,20 +1654,18 @@ static int gve_xsk_pool_enable(struct net_device *d= ev, if (!priv->xdp_prog || !netif_running(dev)) return 0; =20 - err =3D gve_reg_xsk_pool(priv, dev, pool, qid); - if (err) - goto err_xsk_pool_dma_mapped; - - /* Stop and start RDA queues to repost buffers. */ - if (!gve_is_qpl(priv)) { + if (gve_is_qpl(priv)) { + err =3D gve_reg_xsk_pool(priv, dev, pool, qid); + if (err) + goto err_xsk_pool_dma_mapped; + } else { + /* Stop and start RDA queues to repost buffers. */ err =3D gve_configure_rings_xdp(priv, priv->rx_cfg.num_queues); if (err) - goto err_xsk_pool_registered; + goto err_xsk_pool_dma_mapped; } return 0; =20 -err_xsk_pool_registered: - gve_unreg_xsk_pool(priv, qid); err_xsk_pool_dma_mapped: clear_bit(qid, priv->xsk_pools); xsk_pool_dma_unmap(pool, --=20 2.55.0.691.gc56d675ccc-goog From nobody Mon Sep 28 23:55:25 2026 Received: from mail-pg1-f197.google.com (mail-pg1-f197.google.com [209.85.215.197]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 953FA3E8C78 for ; Fri, 14 Aug 2026 23:49:23 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.215.197 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786751366; cv=none; b=OAF3ZGfHrLvuk8kyuLzqap5wMnLgyqM7TYvlc5ZGX0f2ADYG8u5uMBltY21P5ueDH9Ty4pL8NoBOXp/WqhxVtWMzUQv1pRzxBb9w00U4nsnmCW90jdGfs0MZBchMqXPuQdm5m8Z3u1wwZd9mQ7kt2Nj8Lh0o4ZLR3Ealb9/gZDQ= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786751366; c=relaxed/simple; bh=KmaIFs7Rsf1wuaaVKDkIGKBAJHwoNkoAEaDWZtWjD3U=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=DBwWDbuH/pueV3YsKzPo/UXOtqqLHG8rw3o6nEWsSVcfak9SOOdtCruBjPWlOys1d6cN3PDgpV46lTGxfzxkc3cWCoJAqjppTvjEgpbPMHwaR7WyAe7tkjzhiF7qjo0cTYFvNYp1dHPnL3GLQOrFnia1xPFNjAl+AKqMkPq9aRY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--joshwash.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=UVaaoPbs; arc=none smtp.client-ip=209.85.215.197 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--joshwash.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="UVaaoPbs" Received: by mail-pg1-f197.google.com with SMTP id 41be03b00d2f7-cbe77d6864dso2296703a12.2 for ; Fri, 14 Aug 2026 16:49:23 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1786751361; x=1787356161; darn=vger.kernel.org; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:from:to:cc:subject:date:message-id:reply-to :content-type; bh=QlrIN2FE+vOMvXseiBIppZAdIzkDPz9iddK1/8i1Wos=; b=UVaaoPbsqrV5ch0ZVmXBRc+6nwn8OWS97VXQgVgCHyRF1es8O5mvIp80nCjIhUXpi2 Kjo77kNN0L+w8iz1WjyR7lxcYokrQtEgj3R4R1n6Hr4DE4XCrqGzfKCLkwZB+xQwWuH1 9+HMJlKuRW4fPc2DxC+EnpnBGrrrRlGrxCuOtXzjlqSchzQn3iGdMWcONKg/xV9XxNs/ ePccmBWTFjwkNA8ydXi2gV9IxgXapuS8WwolD4FV3EU/3xVuJXPGauTVFzjipmQ6gLuf kphBUOPAmr1ayp55feEGIlSylEO5xN8pZbfTDXGBgrrD6fDlm43tmFEs+zk+osPhpw+z 2otA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786751361; x=1787356161; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=QlrIN2FE+vOMvXseiBIppZAdIzkDPz9iddK1/8i1Wos=; b=K7vcRRThTIIh9G23P61hZ35sd7ZhZYlC08ba0Zuls97w92NKHOxX6SoIP8wPCHsid0 kksUiES9Xevhpg+j9LbMfia1XhboMNSOaQX4TlswH+PFbd1O33hxcaZySyQ5ZFjrWcuH GfRrQKp5GS2cQUR/ELdaNUvljO5nWDekRdj/5DCBsnAt1IuD3S+FJlNTmn6ClKEUxd7n pS3W4rs89pOgumn5A353poXUq10XITDhml0u5vEDWBpdhqe1uSCsIfhmcBJ61USioXqY ITRw+dHNz5LDqIHmV1qOTIzRlLHLlkrkMomSZhWI6f95r6ZEl1YalbFRxYrF4jm7nVB7 /qsQ== X-Forwarded-Encrypted: i=1; AHgh+Rr7Ft2GOVYq4t3BJYWZRhYNQrPUZJrD3YF+f2lgXXVEYSvEK9HRJ9UVBRwG/Akx9Q0jkgtp+beL4wgARkY=@vger.kernel.org X-Gm-Message-State: AOJu0Yw6XQh1ctIRK3Sm8Ty0mM5AJW9cFXPDzRRd7WLpvrJTev9UK2oU PqSMU9u2R8MBrJC9QWA4k218yUUKlWbtUBe3TqE1bgg1mXBLXW6YsZp1OZ4IMc5wTHxprhZ7pEt 7Q5i39w7h9LaQFA== X-Received: from pgcm29.prod.google.com ([2002:a63:711d:0:b0:cbe:ddc9:c670]) (user=joshwash job=prod-delivery.src-stubby-dispatcher) by 2002:a05:6a21:350f:b0:3c3:724d:ae7a with SMTP id adf61e73a8af0-3cc71a2975amr12638942637.9.1786751360785; Fri, 14 Aug 2026 16:49:20 -0700 (PDT) Date: Fri, 14 Aug 2026 16:48:44 -0700 In-Reply-To: <20260814234845.773189-1-joshwash@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20260814234845.773189-1-joshwash@google.com> X-Mailer: git-send-email 2.55.0.691.gc56d675ccc-goog Message-ID: <20260814234845.773189-6-joshwash@google.com> Subject: [PATCH net 5/6] gve: fix napi_disable deadlock when attempting to disable XSK pools From: Joshua Washington To: netdev@vger.kernel.org Cc: Joshua Washington , Harshitha Ramamurthy , Andrew Lunn , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Jordan Rhee , Willem de Bruijn , Ankit Garg , Tim Hostetler , Praveen Kaligineedi , Jeroen de Borst , Stanislav Fomichev , linux-kernel@vger.kernel.org, bpf@vger.kernel.org, stable@vger.kernel.org Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" When disabling XSK pools, GVE calls the unlocked versions of napi_disable and napi_enable. However, the netdev lock has already been acquired before ndo_bpf is called because GVE supports queue management ops. Calling the unlocked versions of napi_disable/enable results in a deadlock when attempting to disable XSK pools, as the thread attempts to re-acquire a lock it already holds. Update the NAPI calls to use the locked versions. Fixes: 606048cbd834 ("net: designate XSK pool pointers in queues as "ops pr= otected"") Cc: stable@vger.kernel.org Reviewed-by: Harshitha Ramamurthy Reviewed-by: Jordan Rhee Signed-off-by: Joshua Washington --- drivers/net/ethernet/google/gve/gve_main.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/net/ethernet/google/gve/gve_main.c b/drivers/net/ether= net/google/gve/gve_main.c index 453b304016b6..e084b367a92d 100644 --- a/drivers/net/ethernet/google/gve/gve_main.c +++ b/drivers/net/ethernet/google/gve/gve_main.c @@ -1706,17 +1706,17 @@ static int gve_xsk_pool_disable(struct net_device *= dev, } =20 napi_rx =3D &priv->ntfy_blocks[priv->rx[qid].ntfy_id].napi; - napi_disable(napi_rx); /* make sure current rx poll is done */ + napi_disable_locked(napi_rx); /* make sure current rx poll is done */ =20 tx_qid =3D gve_xdp_tx_queue_id(priv, qid); napi_tx =3D &priv->ntfy_blocks[priv->tx[tx_qid].ntfy_id].napi; - napi_disable(napi_tx); /* make sure current tx poll is done */ + napi_disable_locked(napi_tx); /* make sure current tx poll is done */ =20 gve_unreg_xsk_pool(priv, qid); smp_mb(); /* Make sure it is visible to the workers on datapath */ =20 - napi_enable(napi_rx); - napi_enable(napi_tx); + napi_enable_locked(napi_rx); + napi_enable_locked(napi_tx); if (gve_is_gqi(priv)) { if (gve_rx_work_pending(&priv->rx[qid])) napi_schedule(napi_rx); --=20 2.55.0.691.gc56d675ccc-goog From nobody Mon Sep 28 23:55:25 2026 Received: from mail-pf1-f200.google.com (mail-pf1-f200.google.com [209.85.210.200]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 681F83E3C74 for ; Fri, 14 Aug 2026 23:49:23 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.200 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786751367; cv=none; b=K0IH+MIJ5zGUvtWaEqDW778AR3cA/a6tr3JT6rw7kbVyPTn6nbug+DaOPNeyDv1qt1bFv+FicFtjOHF/si9cIdkplkp5qpJ9DcPxHtK6FYydXURr6ZxatTdVhQ+ekbJYUID3zHfw1KcNSsnDmMGRuyG2LJckPF2Nn/kMgU7vrAY= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786751367; c=relaxed/simple; bh=bkqjE8H5yLsZzATIYsHOfEIXGXzmrV039SYCCUNAerQ=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=Jq5CDirCtwygjK0UZI9eDA3AxtgYN4FaY/fN1IpMkfpAC8DRdirzVB/TBEkieqyM5qsSLnXM1DqZXagq+GdRYgBmJ8MEOsd3v6paQ0L+MepzUoUiWyVKD5nDfFX9/FCBlYRM6Qr/tLXCqbWQrB30pFTyqIMTTiWrneAgJ1BN0Zk= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--joshwash.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=bHCdyhQW; arc=none smtp.client-ip=209.85.210.200 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--joshwash.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="bHCdyhQW" Received: by mail-pf1-f200.google.com with SMTP id d2e1a72fcca58-848d21bbb55so2060798b3a.0 for ; Fri, 14 Aug 2026 16:49:23 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1786751363; x=1787356163; darn=vger.kernel.org; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:from:to:cc:subject:date:message-id:reply-to :content-type; bh=QIhn3gnxRLM65UuEQqpJlwUN/Y3dZ7RL7buNA7bnsTY=; b=bHCdyhQWUHNaZY9a4NHf1W+9G4LZ9K1zlVlUQ69CxObm+rBVovJAhrkGgxUVPjp4g8 0wxFcvrIDdt4xYdBTUxUOlHtQATM6EGBtLSkmi3FfQ29wY2H330eDl3UPqYdspOX31HW xi3tSxYqI1tKwZniUI1f6OuieboWS52NdUPZLpUwt6CMt/nyu6zC0thUdHiMUqC4t4UK b2EEUiOFY01J7XoQbHGn8yuauXrD2mJt5PhJ0DQJ+idibY93rGJm+K+MRlh5t5ncajuE 37DPaoJIOBlS83R8wPPnQhiKWBMNtKeVgqyE+1pIVQwQWKA0Rb8wyBtgipk6trlfuDLJ ILrw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786751363; x=1787356163; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=QIhn3gnxRLM65UuEQqpJlwUN/Y3dZ7RL7buNA7bnsTY=; b=cz8PSH9AZ95jZiLcCa+ECsQTTDFW9qVfuhe/rnyiiqNwSSXlEXCP+Suuw8vZpThX1m LshqxYC/xXZGsL0qszyzddYGrC7qSsFTHAOalHlOyBqIVJYQ6EPQFPeYto3OLIVfLT5M GnEJMK1ctDEb5D8splLu5K9DE/1Mj4gBS4LGrFC0L8JtSlRQrAe1v6DbN7AVXlk8Imnt Jaq7XTW2qEahq1foXE56yexSMkPxoJDMJkgVYZINSNrMCTACi/a8YewwaSKz3I8OhjHH 77sXxOsOPh6TyJ6m8O42RT5MdXIKv1FpXUVWub2T98DAe5ooCY6qLZLBY1cGJYDLgTvE A5NA== X-Forwarded-Encrypted: i=1; AHgh+RpP0cdFeWW9/jJVIpJ9x26hU3Jj9rFX5/2ISyMen7W9QNL76Q9s3TmHE4Zmbns0alr4z6tcRmC327ErYHU=@vger.kernel.org X-Gm-Message-State: AOJu0YwyXU79wA8GmQJuH5YVRe0Ds9QXvqPQA0MzwTNekUZbe0VF4hfo qX521rLBrY6rAYrAk065dyDEVhHYnnEl+cgZsJiGvJe34u9wB0J7nzSA2E2nXs6a2/3wfEy/dC7 m3z2qCMcxKdWpxA== X-Received: from pfbfq10.prod.google.com ([2002:a05:6a00:60ca:b0:84a:3bc9:3bcd]) (user=joshwash job=prod-delivery.src-stubby-dispatcher) by 2002:a05:6a00:2d86:b0:848:2c6c:dfe3 with SMTP id d2e1a72fcca58-84fde00dea1mr8295276b3a.17.1786751362579; Fri, 14 Aug 2026 16:49:22 -0700 (PDT) Date: Fri, 14 Aug 2026 16:48:45 -0700 In-Reply-To: <20260814234845.773189-1-joshwash@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20260814234845.773189-1-joshwash@google.com> X-Mailer: git-send-email 2.55.0.691.gc56d675ccc-goog Message-ID: <20260814234845.773189-7-joshwash@google.com> Subject: [PATCH net 6/6] gve: fix NULL dereference from premature XSK pool DMA unmap From: Joshua Washington To: netdev@vger.kernel.org Cc: Joshua Washington , Harshitha Ramamurthy , Andrew Lunn , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Jordan Rhee , Willem de Bruijn , Ankit Garg , Tim Hostetler , Praveen Kaligineedi , Jeroen de Borst , Stanislav Fomichev , linux-kernel@vger.kernel.org, bpf@vger.kernel.org, stable@vger.kernel.org Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" To ensure that XSK pools are DMA unmapped in all scenarios, GVE performs the unmapping before validating if the interface is up and early returning. However, if rings are up, this introduces a race between the RX NAPI and the control plane. As part of DMA unmapping the XSK pool, the kernel sets pool->dev to NULL. Because xsk_buff_dma_sync_for_cpu() relies on pool->dev, this results in a kernel panic: BUG: kernel NULL pointer dereference, address: 000000000000030c ... RIP: 0010:gve_rx_poll_dqo+0x2e2/0x13b0 [gve] ... Call Trace: gve_napi_poll_dqo+0x88/0x170 [gve] __napi_poll+0x30/0x210 net_rx_action+0x210/0x410 ? dst_destroy_rcu+0x12/0x20 handle_softirqs+0xe4/0x310 __irq_exit_rcu+0x10e/0x130 irq_exit_rcu+0xe/0x20 common_interrupt+0xb6/0xe0 Leave the XSK pool DMA mapped until after rings are guaranteed to no longer rely on the pool. Fixes: d57ae093c887 ("gve: deduplicate xdp info and xsk pool registration l= ogic") Cc: stable@vger.kernel.org Reviewed-by: Jordan Rhee Signed-off-by: Joshua Washington --- drivers/net/ethernet/google/gve/gve_main.c | 27 ++++++++++++---------- 1 file changed, 15 insertions(+), 12 deletions(-) diff --git a/drivers/net/ethernet/google/gve/gve_main.c b/drivers/net/ether= net/google/gve/gve_main.c index e084b367a92d..ccaf5f86a1e6 100644 --- a/drivers/net/ethernet/google/gve/gve_main.c +++ b/drivers/net/ethernet/google/gve/gve_main.c @@ -1681,28 +1681,24 @@ static int gve_xsk_pool_disable(struct net_device *= dev, struct napi_struct *napi_rx; struct napi_struct *napi_tx; struct xsk_buff_pool *pool; + int err =3D 0; int tx_qid; - int err; =20 - if (qid >=3D priv->rx_cfg.num_queues) - return -EINVAL; + if (qid >=3D priv->rx_cfg.num_queues) { + err =3D -EINVAL; + goto unmap_and_return; + } =20 clear_bit(qid, priv->xsk_pools); =20 - pool =3D xsk_get_pool_from_qid(dev, qid); - if (pool) - xsk_pool_dma_unmap(pool, - DMA_ATTR_SKIP_CPU_SYNC | - DMA_ATTR_WEAK_ORDERING); - if (!netif_running(dev) || !priv->tx_cfg.num_xdp_queues) - return 0; + goto unmap_and_return; =20 /* Stop and start RDA queues to repost buffers. */ if (!gve_is_qpl(priv) && priv->xdp_prog) { err =3D gve_configure_rings_xdp(priv, priv->rx_cfg.num_queues); if (err) - return err; + goto unmap_and_return; } =20 napi_rx =3D &priv->ntfy_blocks[priv->rx[qid].ntfy_id].napi; @@ -1725,7 +1721,14 @@ static int gve_xsk_pool_disable(struct net_device *d= ev, napi_schedule(napi_tx); } =20 - return 0; +unmap_and_return: + pool =3D xsk_get_pool_from_qid(dev, qid); + if (pool) + xsk_pool_dma_unmap(pool, + DMA_ATTR_SKIP_CPU_SYNC | + DMA_ATTR_WEAK_ORDERING); + + return err; } =20 static int gve_xsk_wakeup(struct net_device *dev, u32 queue_id, u32 flags) --=20 2.55.0.691.gc56d675ccc-goog