1. Patchew
  2. linux
  3. View series

[PATCH net] veth: manage XDP program pointers during channel resize

Weiming Shi posted 1 patch 1 week ago 
drivers/net/veth.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
[PATCH net] veth: manage XDP program pointers during channel resize
Posted by Weiming Shi 1 week ago 
veth_set_channels() tears down XDP resources for removed RX queues
without clearing rq->xdp_prog.  If the program is then detached or
replaced, those queues keep the old pointer after bpf_prog_put().  A
later channel increase can re-enable NAPI and run the freed program.

Clear the program pointer after taking an RX queue offline, and publish
the current program only after bringing the queue back online succeeds.

  BUG: unable to handle page fault for address: ffffc90000256048
  Oops: Oops: 0000 [#1] SMP KASAN NOPTI
  RIP: veth_xdp_rcv_skb (include/linux/filter.h:779
                         include/net/xdp.h:696 drivers/net/veth.c:820)
  Call Trace:
   veth_xdp_rcv (drivers/net/veth.c:941)
   veth_poll (drivers/net/veth.c:986)
   __napi_poll (net/core/dev.c:7787)
   net_rx_action (net/core/dev.c:7850 net/core/dev.c:8007)
   handle_softirqs (kernel/softirq.c:645)
  Kernel panic - not syncing: Fatal exception in interrupt

Cc: stable@vger.kernel.org
Fixes: 4752eeb3d891 ("veth: implement support for set_channel ethtool op")
Reported-by: <co+65e5c76b187f08b2@bugs.sh>
Assisted-by: LLM
Signed-off-by: Weiming Shi <bestswngs@gmail.com>
---
 drivers/net/veth.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/drivers/net/veth.c b/drivers/net/veth.c
index 6ed3ee81153fb..ef7624bc2c0ec 100644
--- a/drivers/net/veth.c
+++ b/drivers/net/veth.c
@@ -1247,12 +1247,15 @@ static int veth_napi_enable(struct net_device *dev)
 static void veth_disable_range_safe(struct net_device *dev, int start, int end)
 {
 	struct veth_priv *priv = netdev_priv(dev);
+	int i;
 
 	if (start >= end)
 		return;
 
 	if (priv->_xdp_prog) {
 		veth_napi_del_range(dev, start, end);
+		for (i = start; i < end; i++)
+			rcu_assign_pointer(priv->rq[i].xdp_prog, NULL);
 		veth_disable_xdp_range(dev, start, end, false);
 	} else if (veth_gro_requested(dev)) {
 		veth_napi_del_range(dev, start, end);
@@ -1262,7 +1265,7 @@ static void veth_disable_range_safe(struct net_device *dev, int start, int end)
 static int veth_enable_range_safe(struct net_device *dev, int start, int end)
 {
 	struct veth_priv *priv = netdev_priv(dev);
-	int err;
+	int err, i;
 
 	if (start >= end)
 		return 0;
@@ -1281,6 +1284,9 @@ static int veth_enable_range_safe(struct net_device *dev, int start, int end)
 			veth_disable_xdp_range(dev, start, end, true);
 			return err;
 		}
+		for (i = start; i < end; i++)
+			rcu_assign_pointer(priv->rq[i].xdp_prog,
+					   priv->_xdp_prog);
 	} else if (veth_gro_requested(dev)) {
 		return veth_napi_enable_range(dev, start, end);
 	}
-- 
2.55.0
Re: [PATCH net] veth: manage XDP program pointers during channel resize
Posted by Jakub Kicinski 3 days, 2 hours ago 
On Thu, 17 Sep 2026 23:39:25 +0800 Weiming Shi wrote:
> veth_set_channels() tears down XDP resources for removed RX queues
> without clearing rq->xdp_prog.  If the program is then detached or
> replaced, those queues keep the old pointer after bpf_prog_put().  A
> later channel increase can re-enable NAPI and run the freed program.
> 
> Clear the program pointer after taking an RX queue offline, and publish
> the current program only after bringing the queue back online succeeds.
> 
>   BUG: unable to handle page fault for address: ffffc90000256048
>   Oops: Oops: 0000 [#1] SMP KASAN NOPTI
>   RIP: veth_xdp_rcv_skb (include/linux/filter.h:779
>                          include/net/xdp.h:696 drivers/net/veth.c:820)
>   Call Trace:
>    veth_xdp_rcv (drivers/net/veth.c:941)
>    veth_poll (drivers/net/veth.c:986)
>    __napi_poll (net/core/dev.c:7787)
>    net_rx_action (net/core/dev.c:7850 net/core/dev.c:8007)
>    handle_softirqs (kernel/softirq.c:645)
>   Kernel panic - not syncing: Fatal exception in interrupt
> 
> Cc: stable@vger.kernel.org
> Fixes: 4752eeb3d891 ("veth: implement support for set_channel ethtool op")
> Reported-by: <co+65e5c76b187f08b2@bugs.sh>
> Assisted-by: LLM
> Signed-off-by: Weiming Shi <bestswngs@gmail.com>
> ---
>  drivers/net/veth.c | 8 +++++++-
>  1 file changed, 7 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/net/veth.c b/drivers/net/veth.c
> index 6ed3ee81153fb..ef7624bc2c0ec 100644
> --- a/drivers/net/veth.c
> +++ b/drivers/net/veth.c
> @@ -1247,12 +1247,15 @@ static int veth_napi_enable(struct net_device *dev)
>  static void veth_disable_range_safe(struct net_device *dev, int start, int end)
>  {
>  	struct veth_priv *priv = netdev_priv(dev);
> +	int i;
>  
>  	if (start >= end)
>  		return;
>  
>  	if (priv->_xdp_prog) {
>  		veth_napi_del_range(dev, start, end);
> +		for (i = start; i < end; i++)
> +			rcu_assign_pointer(priv->rq[i].xdp_prog, NULL);
>  		veth_disable_xdp_range(dev, start, end, false);
>  	} else if (veth_gro_requested(dev)) {
>  		veth_napi_del_range(dev, start, end);
> @@ -1262,7 +1265,7 @@ static void veth_disable_range_safe(struct net_device *dev, int start, int end)
>  static int veth_enable_range_safe(struct net_device *dev, int start, int end)
>  {
>  	struct veth_priv *priv = netdev_priv(dev);
> -	int err;
> +	int err, i;
>  
>  	if (start >= end)
>  		return 0;
> @@ -1281,6 +1284,9 @@ static int veth_enable_range_safe(struct net_device *dev, int start, int end)
>  			veth_disable_xdp_range(dev, start, end, true);
>  			return err;
>  		}
> +		for (i = start; i < end; i++)
> +			rcu_assign_pointer(priv->rq[i].xdp_prog,
> +					   priv->_xdp_prog);
>  	} else if (veth_gro_requested(dev)) {
>  		return veth_napi_enable_range(dev, start, end);
>  	}

This is pure slop, cramming loops into functions which have none.
Shameful, really.

Please test this and submit it if it passes the tests:

diff --git a/drivers/net/veth.c b/drivers/net/veth.c
index 6ed3ee81153f..5d5e8ebce65a 100644
--- a/drivers/net/veth.c
+++ b/drivers/net/veth.c
@@ -1054,6 +1054,8 @@ static int __veth_napi_enable_range(struct net_device *dev, int start, int end)
        for (i = start; i < end; i++) {
                struct veth_rq *rq = &priv->rq[i];
 
+               if (priv->_xdp_prog)
+                       rcu_assign_pointer(rq->xdp_prog, priv->_xdp_prog);
                napi_enable(&rq->xdp_napi);
                rcu_assign_pointer(priv->rq[i].napi, &priv->rq[i].xdp_napi);
        }
@@ -1088,6 +1090,7 @@ static void veth_napi_del_range(struct net_device *dev, int start, int end)
 
                rcu_assign_pointer(priv->rq[i].napi, NULL);
                napi_disable(&rq->xdp_napi);
+               rcu_assign_pointer(rq->xdp_prog, NULL);
                __netif_napi_del(&rq->xdp_napi);
        }
        synchronize_net();
Re: [PATCH net] veth: manage XDP program pointers during channel resize
Posted by Jakub Kicinski 3 days, 2 hours ago 
On Mon, 21 Sep 2026 15:41:47 -0700 Jakub Kicinski wrote:
> This is pure slop, cramming loops into functions which have none.
> Shameful, really.
> 
> Please test this and submit it if it passes the tests:

You know what, I'll just post it myself.
Re: [PATCH net] veth: manage XDP program pointers during channel resize
Posted by Weiming Shi 2 days, 23 hours ago 
Jakub Kicinski <kuba@kernel.org> 于2026年9月22日周二 06:58写道：
>
> On Mon, 21 Sep 2026 15:41:47 -0700 Jakub Kicinski wrote:
> > This is pure slop, cramming loops into functions which have none.
> > Shameful, really.
> >
> > Please test this and submit it if it passes the tests:
>
> You know what, I'll just post it myself.

Hi Jakub,

Sorry about the poor implementation.
Thank you for pointing out the issue and taking over the fix.
Best,
Weiming Shi
Re: [PATCH net] veth: manage XDP program pointers during channel resize
Posted by Jason Xing 3 days, 10 hours ago 
On Fri, Sep 18, 2026 at 2:50 AM Weiming Shi <bestswngs@gmail.com> wrote:
>
> veth_set_channels() tears down XDP resources for removed RX queues
> without clearing rq->xdp_prog.  If the program is then detached or
> replaced, those queues keep the old pointer after bpf_prog_put().  A
> later channel increase can re-enable NAPI and run the freed program.
>
> Clear the program pointer after taking an RX queue offline, and publish
> the current program only after bringing the queue back online succeeds.
>
>   BUG: unable to handle page fault for address: ffffc90000256048
>   Oops: Oops: 0000 [#1] SMP KASAN NOPTI
>   RIP: veth_xdp_rcv_skb (include/linux/filter.h:779
>                          include/net/xdp.h:696 drivers/net/veth.c:820)
>   Call Trace:
>    veth_xdp_rcv (drivers/net/veth.c:941)
>    veth_poll (drivers/net/veth.c:986)
>    __napi_poll (net/core/dev.c:7787)
>    net_rx_action (net/core/dev.c:7850 net/core/dev.c:8007)
>    handle_softirqs (kernel/softirq.c:645)
>   Kernel panic - not syncing: Fatal exception in interrupt
>
> Cc: stable@vger.kernel.org
> Fixes: 4752eeb3d891 ("veth: implement support for set_channel ethtool op")
> Reported-by: <co+65e5c76b187f08b2@bugs.sh>
> Assisted-by: LLM
> Signed-off-by: Weiming Shi <bestswngs@gmail.com>

Reviewed-by: Jason Xing <kerneljasonxing@gmail.com>

Thanks!
Re: [PATCH net] veth: manage XDP program pointers during channel resize
Posted by Simon Horman 3 days, 12 hours ago 
On Thu, Sep 17, 2026 at 11:39:25PM +0800, Weiming Shi wrote:
> veth_set_channels() tears down XDP resources for removed RX queues
> without clearing rq->xdp_prog.  If the program is then detached or
> replaced, those queues keep the old pointer after bpf_prog_put().  A
> later channel increase can re-enable NAPI and run the freed program.
> 
> Clear the program pointer after taking an RX queue offline, and publish
> the current program only after bringing the queue back online succeeds.
> 
>   BUG: unable to handle page fault for address: ffffc90000256048
>   Oops: Oops: 0000 [#1] SMP KASAN NOPTI
>   RIP: veth_xdp_rcv_skb (include/linux/filter.h:779
>                          include/net/xdp.h:696 drivers/net/veth.c:820)
>   Call Trace:
>    veth_xdp_rcv (drivers/net/veth.c:941)
>    veth_poll (drivers/net/veth.c:986)
>    __napi_poll (net/core/dev.c:7787)
>    net_rx_action (net/core/dev.c:7850 net/core/dev.c:8007)
>    handle_softirqs (kernel/softirq.c:645)
>   Kernel panic - not syncing: Fatal exception in interrupt
> 
> Cc: stable@vger.kernel.org
> Fixes: 4752eeb3d891 ("veth: implement support for set_channel ethtool op")
> Reported-by: <co+65e5c76b187f08b2@bugs.sh>
> Assisted-by: LLM
> Signed-off-by: Weiming Shi <bestswngs@gmail.com>

Reviewed-by: Simon Horman <horms@kernel.org>

Patchew 2.1-devel-ea86937

© 2016 - 2026 Red Hat, Inc.