From nobody Thu Sep 24 15:10:14 2026 Received: from mail-pl1-f198.google.com (mail-pl1-f198.google.com [209.85.214.198]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2E0BE39E176 for ; Tue, 22 Sep 2026 19:45:40 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.198 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790106342; cv=none; b=baRtsXz9aHP+BxfArtqYVEcGzkvOLZLqwIwUfEpHx0GhcBJMx7oewyE/F+HXJiyL6lueK5geF4NvaeOGKWxE1CbkEg/CupNfQL9sPOXBjY57xDmA9ER2HUVMNGaq2L+06pHk2u6O8n7jVOxexlzdiZZ44AHFxy0pEzA8zyypBvo= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790106342; c=relaxed/simple; bh=bA/Yk356OkMO3nhLS6izNHoCFy29ZvudZLOrI0cm0F0=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=pagHOLVbS1051kYm2J4/k8pidVdwTf6XgbfgLwPZvG6K4MytVFfFFXGdPkW4yjMYfguGKpwsUljuhgaqFSoZh9NB2afNDj7nA94uHYBJEOAlnsowJDurCbXWjaaN2jsYHLzZlQdu9UKOgfIsuvaSoP9Mj6t6UqQ5+ijzY6+eeD4= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--joshwash.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=p7t+B667; arc=none smtp.client-ip=209.85.214.198 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--joshwash.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="p7t+B667" Received: by mail-pl1-f198.google.com with SMTP id d9443c01a7336-2db3b126c9fso2064865ad.0 for ; Tue, 22 Sep 2026 12:45:40 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1790106340; x=1790711140; darn=vger.kernel.org; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:from:to:cc:subject:date:message-id:reply-to :content-type; bh=eAmFjAn7BDIXidXFExZXN4J+D0t0bLYkykmd4bXpEf4=; b=p7t+B667tg4V1NJmp0lV4zvnu+2A6YuMLZZrqxjWKf26marScLxzjy+DJUPztfEP/V HvNMczO25pZKlT+YZq49v4jEAYB5MXm49vxYGzmgriMW5tgwq++0hKDasCCiAJ9T0Dw5 gYsEMl1YxYN1cHx0uS6BXFn03IMtMID9nKY1CMRkE5UZTw+tRlak+OLhXP6LYzYns2nT WjRgWF0V+ePv0SbPbmXQRr47DRmCIEwnas80nSWjBqiUwtGxB1095nxyriXLz1kmsEnN VXBub5a3HuGQRK/kmFAGYfEFrUIpLWOhiJDc4Bl138p3y5Khaa4DCBY1/x1akP42Jp1z TwZw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1790106340; x=1790711140; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=eAmFjAn7BDIXidXFExZXN4J+D0t0bLYkykmd4bXpEf4=; b=NfUOjluIavG0rZCV8IWdXomfOhYNBHMwxbsf4WRWAPs5IubKiDefYM+ERA4JN/hn/0 n9KUBP0eF8jhiXNpNiWl7Dzu6/07+0pPCJc5J8iRMsW+DFSqiJqX0S3VMV8CLbeldnvx ptQHsH5U/FmN2Ew104BZ5yMpbGST8vVCfbgI8iGvlTv3Md7kkmsnP1PswBIeGoL63Bcw CRY6WSAvPEPfSosAyz1xPMjKQZoLMu6xR1frBfZZ5+tcgslBhr6lzcJc3QJmbqCYMneP bh1DNwbXSt4f/2xglKSfh+AuicY80Gpk4UAB6HMwwtZD3bFwKzvEzq6suChRdWyhE7RB Id3w== X-Forwarded-Encrypted: i=1; AKwUvBxx2LEhQoClt97NAB0wEKPsM2eJ/MpgF5tXPftWDG18B9uckxsC6gR9c+6KmxaVeOEmSz7pWyYJSjmVgao=@vger.kernel.org X-Gm-Message-State: AFuF++nRl0xtR46vBWsw7QEx9EXQhc1byiYP8hQTf2rE2ZABP9JmXDIO OQLnBZjGDpOuBfwttR39xTuDMJ7Gu46L4VAvAbYEBwSo6wEe0s/U8AstwlkL+7HPBLQVDyHeE0P ddWW/rf99kJssgA== X-Received: from plhz4.prod.google.com ([2002:a17:902:d9c4:b0:2df:4c9e:a58d]) (user=joshwash job=prod-delivery.src-stubby-dispatcher) by 2002:a17:902:d984:b0:2da:e967:7953 with SMTP id d9443c01a7336-2df69d28612mr3587035ad.12.1790106340217; Tue, 22 Sep 2026 12:45:40 -0700 (PDT) Date: Tue, 22 Sep 2026 12:45:25 -0700 In-Reply-To: <20260922194533.631387-1-joshwash@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20260922194533.631387-1-joshwash@google.com> X-Mailer: git-send-email 2.55.0.1082.g2b9226bbc0-goog Message-ID: <20260922194533.631387-2-joshwash@google.com> Subject: [PATCH net v2 1/9] gve: increment work_done for XDP and error packets From: Joshua Washington To: netdev@vger.kernel.org Cc: Joshua Washington , Harshitha Ramamurthy , Andrew Lunn , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Alexei Starovoitov , Daniel Borkmann , Jesper Dangaard Brouer , John Fastabend , Stanislav Fomichev , Jordan Rhee , Willem de Bruijn , Tim Hostetler , Ankit Garg , Eddie Phillips , Praveen Kaligineedi , Jeroen de Borst , linux-kernel@vger.kernel.org, bpf@vger.kernel.org, stable@vger.kernel.org Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" The GVE RX NAPI will continue polling as long as 1) there are packets to be processed, and 2) less than NAPI budget SKBs (denoted in GVE by work_done) have been passed up to the kernel. However, GVE does not account for all of the packets that don't create SKBs, namely error packets and XDP packets. This can result in XDP programs that scarcely return XDP_PASS failing to exit the NAPI poll as long as the NIC is DMA'ing packets, possibly processing the entire RX ring before returning from the NAPI. This has 3 negative implications: 1) XDP RX path can run much longer than is desirable, hogging CPU resources. 2) If XDP_PASS is never returned, the work_done never increases beyond 0, which can lead to scheduling delays due to missed chances to reschedule the NAPI. 3) In AF_XDP zero-copy, XSK_TX occurs after the RX poll. If the RX poll takes a long time, it will delay TX, leading to degraded performance. Ensure every packet is accounted for in work_done by incrementing work_done before checking for the existence of a SKB. Fixes: 293b49361f91 ("gve: add XDP DROP and PASS support for DQ") Cc: stable@vger.kernel.org Reviewed-by: Tim Hostetler Reviewed-by: Jordan Rhee Signed-off-by: Joshua Washington --- v2: - corrected stat counting for packets relative to work_done --- drivers/net/ethernet/google/gve/gve_rx_dqo.c | 18 +++++++++++++----- 1 file changed, 13 insertions(+), 5 deletions(-) diff --git a/drivers/net/ethernet/google/gve/gve_rx_dqo.c b/drivers/net/eth= ernet/google/gve/gve_rx_dqo.c index 5cf242b28557..c3f4a76b0fac 100644 --- a/drivers/net/ethernet/google/gve/gve_rx_dqo.c +++ b/drivers/net/ethernet/google/gve/gve_rx_dqo.c @@ -932,6 +932,10 @@ static int gve_rx_dqo(struct napi_struct *napi, struct= gve_rx_ring *rx, if (xdp_act !=3D XDP_PASS) { gve_xdp_done_dqo(priv, rx, &gve_xdp.xdp, xprog, xdp_act, buf_state); + u64_stats_update_begin(&rx->statss); + rx->rpackets++; + rx->rbytes +=3D compl_desc->packet_len; + u64_stats_update_end(&rx->statss); return 0; } =20 @@ -1090,6 +1094,7 @@ int gve_rx_poll_dqo(struct gve_notify_block *block, i= nt budget) struct gve_rx_ring *rx; struct gve_priv *priv; u64 xdp_redirects; + u32 rx_packets =3D 0; u32 work_done =3D 0; u64 bytes =3D 0; u64 xdp_txs; @@ -1150,13 +1155,14 @@ int gve_rx_poll_dqo(struct gve_notify_block *block,= int budget) /* Free running counter of completed descriptors */ rx->cnt++; =20 - if (!rx->ctx.skb_head) - continue; - if (!compl_desc->end_of_packet) continue; =20 work_done++; + + if (!rx->ctx.skb_head) + continue; + pkt_bytes =3D rx->ctx.skb_head->len; /* The ethernet header (first ETH_HLEN bytes) is snipped off * by eth_type_trans. @@ -1164,6 +1170,9 @@ int gve_rx_poll_dqo(struct gve_notify_block *block, i= nt budget) if (skb_headlen(rx->ctx.skb_head)) pkt_bytes +=3D ETH_HLEN; =20 + rx_packets++; + bytes +=3D pkt_bytes; + /* gve_rx_complete_skb() will consume skb if successful */ if (gve_rx_complete_skb(rx, napi, compl_desc, feat) !=3D 0) { gve_rx_free_skb(napi, rx); @@ -1173,7 +1182,6 @@ int gve_rx_poll_dqo(struct gve_notify_block *block, i= nt budget) continue; } =20 - bytes +=3D pkt_bytes; rx->ctx.skb_head =3D NULL; rx->ctx.skb_tail =3D NULL; } @@ -1187,7 +1195,7 @@ int gve_rx_poll_dqo(struct gve_notify_block *block, i= nt budget) gve_rx_post_buffers_dqo(rx); =20 u64_stats_update_begin(&rx->statss); - rx->rpackets +=3D work_done; + rx->rpackets +=3D rx_packets; rx->rbytes +=3D bytes; u64_stats_update_end(&rx->statss); =20 --=20 2.55.0.1082.g2b9226bbc0-goog From nobody Thu Sep 24 15:10:14 2026 Received: from mail-pj1-f70.google.com (mail-pj1-f70.google.com [209.85.216.70]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D13734A6892 for ; Tue, 22 Sep 2026 19:45:42 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.70 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790106344; cv=none; b=kU4K36EAeS1YyheaZAbBaUONyI26gdqGoaObnTwsI8qEtcRJ52k1XpKU2oOastKWPgld+8SUSHRxDoVDnqwLWjivUp01KHEgH/nTz+U3knjcXfXJdp5b9qsLlFaSpJB0tz+8mROBBdwZ82Eg2lwwfR369eiswN4hmpcfa5tJyLE= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790106344; c=relaxed/simple; bh=UljtQ9XO6rbJkLCDeJXSzP2hU8m8OSu/SUn/z/6iVUc=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=Akf2yDfHlLjvjkTj/sqwZTflQHOwNT09R+3ZQblBx7Mcdsybg5z/8U0YFv50uE1xwdrTrOUVmARhRFfckCcVpdQ63hbq3ulKLS/edy/Q3pyCTpVgceSQtzwujl954yPwt0rf2zxp1c7QWcT7OJwLR3rAFnLYitSkoSnKyEeRrDw= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--joshwash.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=vDKzk+Jz; arc=none smtp.client-ip=209.85.216.70 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--joshwash.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="vDKzk+Jz" Received: by mail-pj1-f70.google.com with SMTP id 98e67ed59e1d1-39aee9b4cf2so402137a91.0 for ; Tue, 22 Sep 2026 12:45:42 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1790106342; x=1790711142; darn=vger.kernel.org; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:from:to:cc:subject:date:message-id:reply-to :content-type; bh=eWYEebvN53sOkHrhhlwZSz3/5d2DYKttJmC/W8rasEc=; b=vDKzk+JzBBTn6rAfjEqBMyPU2CXYQYNh/ugXqd8cMGmLPm1jN30z9cZYqEM9IJcpo8 Hu8D7nZ3GFr85WwKsQXfhIBDDfr02V3PqsXNM2xnqbJzJcq6EsO5SOfLOjclN3dRO0Gi 7morU4+CIzeCDD++Ned6Oj19jkgZQCYAX2JmICR/KjYYQFtskRSyjGIUbqh9Q00TypkD +pbPYJr52TPfLqP08nwLIWflBMDl2rECoIxmMbCH7tLq53NMvs0xKjdO1xIhArLftL/m wUQQUKwcAqQgN3KaIWzWKR33FZjfXECy6w8/f6JfrFwHQB3ofm7Z5PMtncbC6lphsT0U jOCA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1790106342; x=1790711142; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=eWYEebvN53sOkHrhhlwZSz3/5d2DYKttJmC/W8rasEc=; b=nJPRpzVQ++xB4yKmtxFZfk3abdOEPzuCbNMIRWcgZ6DeQPk9SDE0bb23RkL7XRaoDl qg7Oq1j9D8YwYmm8R5RA3dawTvLYw6ytxQvOul6UHqnDOj/tyqSl/VstXnAelOjzTGco 7Q2pEYZy8QfXpCZeeaC3ro7kaN2nXOatG2MNvbybAfgR9/C7EBJrFQC8AApHu7N2b7eU QpRNUrfgY9U3OI572f4qlK3FWOwBsupSDNhm0HwBhrcvSt4XjerGFVyWeLexU0dE4+fK irIyGst2wxDxRIgr+y+WjFwiyFxLkAqiAWMJ/T3U3J7hN7s+AVyRxWLXrgyvHf/Xe91h 36yg== X-Forwarded-Encrypted: i=1; AKwUvBx2ykhNBD2F6/cKeCqllWKLa81WS7ngN4SXF9cE1z/qjdZ6jDOwMCnR2wMi7Zc5PtZXRQVd7P4lr1StmZ4=@vger.kernel.org X-Gm-Message-State: AFuF++nC9p2MrU9Bo8sRU/UL6/OaNrCCxzmbV9PnjbpCkTB7k2zgtir6 cJXT9f63LKXFHeX/KZvYTQDFUfphOSzwDNsT0yijTD7i80fxzo2yndh19g83+k0F+4xuyiBLkjO ZAjHcYOwgWX1aDA== X-Received: from pgde21.prod.google.com ([2002:a05:6a02:315:b0:cc2:1a89:e586]) (user=joshwash job=prod-delivery.src-stubby-dispatcher) by 2002:a17:90b:2fce:b0:39e:6c68:c77b with SMTP id 98e67ed59e1d1-3a07e6b5895mr430876a91.49.1790106342068; Tue, 22 Sep 2026 12:45:42 -0700 (PDT) Date: Tue, 22 Sep 2026 12:45:26 -0700 In-Reply-To: <20260922194533.631387-1-joshwash@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20260922194533.631387-1-joshwash@google.com> X-Mailer: git-send-email 2.55.0.1082.g2b9226bbc0-goog Message-ID: <20260922194533.631387-3-joshwash@google.com> Subject: [PATCH net v2 2/9] gve: fix XSK buffer leak when rings are stopped From: Joshua Washington To: netdev@vger.kernel.org Cc: Joshua Washington , Harshitha Ramamurthy , Andrew Lunn , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Alexei Starovoitov , Daniel Borkmann , Jesper Dangaard Brouer , John Fastabend , Stanislav Fomichev , Jordan Rhee , Willem de Bruijn , Tim Hostetler , Ankit Garg , Eddie Phillips , Praveen Kaligineedi , Jeroen de Borst , linux-kernel@vger.kernel.org, bpf@vger.kernel.org, stable@vger.kernel.org Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" GVE does not free XSK buffers when resetting ring state as a part of stopping queues. This causes all XSK buffers which are posted to the NIC to be leaked. Free XSK buffers attached to an allocated buf_state when stopping rings. Fixes: c1fffc5d66a7 ("gve: implement DQO RX datapath and control path for A= F_XDP zero-copy") Cc: stable@vger.kernel.org Reviewed-by: Tim Hostetler Reviewed-by: Jordan Rhee Signed-off-by: Joshua Washington --- drivers/net/ethernet/google/gve/gve_rx_dqo.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/net/ethernet/google/gve/gve_rx_dqo.c b/drivers/net/eth= ernet/google/gve/gve_rx_dqo.c index c3f4a76b0fac..3a88b7e98b16 100644 --- a/drivers/net/ethernet/google/gve/gve_rx_dqo.c +++ b/drivers/net/ethernet/google/gve/gve_rx_dqo.c @@ -113,6 +113,12 @@ static void gve_rx_reset_ring_dqo(struct gve_priv *pri= v, int idx) gve_free_to_page_pool(rx, bs, false); else gve_free_qpl_page_dqo(bs); + + if (gve_buf_state_is_allocated(rx, bs) && + bs->xsk_buff) { + xsk_buff_free(bs->xsk_buff); + bs->xsk_buff =3D NULL; + } } } =20 --=20 2.55.0.1082.g2b9226bbc0-goog From nobody Thu Sep 24 15:10:14 2026 Received: from mail-pg1-f197.google.com (mail-pg1-f197.google.com [209.85.215.197]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8765B4A7C81 for ; Tue, 22 Sep 2026 19:45:44 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.215.197 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790106349; cv=none; b=GeEiu3+daaG3Hml1HLLMkhcBg/AvgnQ5J7RclVhQXxOC+/adi6a0GSmJD9JQV+gXnUfUe81l0g9oPYhXB9py4Iy/77C8x1ReuiqPYLUkBai19yPJv44t3FSU1vyNm6C9la6rxPRGTlX2bxLoL2GMqUBliuk+gNff0PKrQCrYgt4= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790106349; c=relaxed/simple; bh=phK9UGM82Su0/Yft5H1gsYRLHi1zGw1yM7fKl/AmyEw=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=n/2OrJhMYwwT4ijMjIR/j0sc7+laBXNkk2DVgJiucVwmdDvyK/kzJE78TInbpIqlQ2Kf7TEWXD89/vsRY0S7iyecq46kO/6xdz5C7bDqsLURKmxGKlJNxBc/oFyXJ5ihvszouVANEuu2adIcUd01UPbVeQjGvo5tnLPqPj+N3AA= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--joshwash.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=gXCwaLJK; arc=none smtp.client-ip=209.85.215.197 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--joshwash.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="gXCwaLJK" Received: by mail-pg1-f197.google.com with SMTP id 41be03b00d2f7-cc42a07d04aso197369a12.1 for ; Tue, 22 Sep 2026 12:45:44 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1790106344; x=1790711144; darn=vger.kernel.org; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:from:to:cc:subject:date:message-id:reply-to :content-type; bh=EcTqMP1GOUb8ln7imudpJQ6C9nwPlePs3BJaEQbnd4o=; b=gXCwaLJKDI0BJ/rH10BhZzCHomuw0AG71/rrOZ8UJk1OwYuBq8Fm/JcFvEIE88LYDn LN/rYMycTfW4U9X1UF0+amzqlpgifPto6qSF1NXiLOsGn1gt1UgIDZT/3WqBG0l6nUoB A9LkVT/m0ayb/llsObTBluxWuckZwpm/i/oBkqdnuSIXeEpBrxRJIrueRUAgh2CVpHCB 1dIz+gpMIuAxvmvYsixt2oAzhsQCGjOlR8S7iqMwYIUl1tu68BRLZBIg3hDZsozPhTuH tOlaA2Kj8lR7UjqDa5kFNmKic/XV4POFIdMDrSlZRv1oWvjOmAvLh96CCZUKD5Ou9AQR mX+A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1790106344; x=1790711144; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=EcTqMP1GOUb8ln7imudpJQ6C9nwPlePs3BJaEQbnd4o=; b=x8WhxE+foeMiHZQJUmcmVJNGjdvs30aKGGE8a6bGZsZ0UIhnF6aMU/GI9aYId8DzB8 /v3aAht4eAB0jgZbLAzjw/usN2eczjdtZV4wILoc9MQFxyg7pgbOznkkUzHbdwHmrVVJ ORLUkM3ASGvEKMMu++KtnWkp+fefCz9b5uN9zCjDZN0JYfDLLEfP0ixQVeSzImQV311Z 0Hv83mjdcirzhomW3fGA4G2hvFDrU+g7XAKYIkawygfMQSgqpUe21nEuPBGO2+aYpVlD z39nBYMf4YqVP+5nTqkG9d8945ghnZxJjP4M80y8ltkhQWjvBo1MYfZTnMgQiuJgWGc8 tXAQ== X-Forwarded-Encrypted: i=1; AKwUvBxX+tHyT5OsVGy9jJ1ORdpy+DWqYG/PFP/hDjSoo/XZAhyoh5Ff1bUUn+7yt1aCv9VNDZ3VydTWjx4h+eo=@vger.kernel.org X-Gm-Message-State: AFuF++kxtlE4YRrEqApGhtUFeUrWf1oDQ+Kj41nZZba8bvjDZXFMlSjY PMiKVoPnmkzX/2EGm+QxKiUGsGOskFIkoDNBia4WyHYX1tA8MZOvS1tDlOR5kEzcZrshjqo0fKw AKDG0bt/SK6t7eg== X-Received: from pgvi12.prod.google.com ([2002:a65:61ac:0:b0:cc5:1183:79da]) (user=joshwash job=prod-delivery.src-stubby-dispatcher) by 2002:a05:6a21:8217:b0:3dd:a197:7359 with SMTP id adf61e73a8af0-3ddf8287ef8mr500782637.50.1790106343974; Tue, 22 Sep 2026 12:45:43 -0700 (PDT) Date: Tue, 22 Sep 2026 12:45:27 -0700 In-Reply-To: <20260922194533.631387-1-joshwash@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20260922194533.631387-1-joshwash@google.com> X-Mailer: git-send-email 2.55.0.1082.g2b9226bbc0-goog Message-ID: <20260922194533.631387-4-joshwash@google.com> Subject: [PATCH net v2 3/9] gve: fix XSK buffer leak on error descriptor From: Joshua Washington To: netdev@vger.kernel.org Cc: Joshua Washington , Harshitha Ramamurthy , Andrew Lunn , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Alexei Starovoitov , Daniel Borkmann , Jesper Dangaard Brouer , John Fastabend , Stanislav Fomichev , Jordan Rhee , Willem de Bruijn , Tim Hostetler , Ankit Garg , Eddie Phillips , Praveen Kaligineedi , Jeroen de Borst , linux-kernel@vger.kernel.org, bpf@vger.kernel.org, stable@vger.kernel.org Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" When the error bit is set in the RX completion descriptor, the buf_state and its attached buffer should be freed. In the case of AF_XDP ZC, the XSK buffer was not freed, leading to a leak. Fixes: c1fffc5d66a7 ("gve: implement DQO RX datapath and control path for A= F_XDP zero-copy") Cc: stable@vger.kernel.org Reviewed-by: Jordan Rhee Reviewed-by: Tim Hostetler Signed-off-by: Joshua Washington --- drivers/net/ethernet/google/gve/gve_rx_dqo.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/net/ethernet/google/gve/gve_rx_dqo.c b/drivers/net/eth= ernet/google/gve/gve_rx_dqo.c index 3a88b7e98b16..c1e97e11ff35 100644 --- a/drivers/net/ethernet/google/gve/gve_rx_dqo.c +++ b/drivers/net/ethernet/google/gve/gve_rx_dqo.c @@ -842,7 +842,12 @@ static int gve_rx_dqo(struct napi_struct *napi, struct= gve_rx_ring *rx, } =20 if (unlikely(compl_desc->rx_error)) { - gve_free_buffer(rx, buf_state); + if (buf_state->xsk_buff) { + xsk_buff_free(buf_state->xsk_buff); + gve_free_buf_state(rx, buf_state); + } else { + gve_free_buffer(rx, buf_state); + } return -EINVAL; } =20 --=20 2.55.0.1082.g2b9226bbc0-goog From nobody Thu Sep 24 15:10:14 2026 Received: from mail-pf1-f200.google.com (mail-pf1-f200.google.com [209.85.210.200]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B4957457E61 for ; Tue, 22 Sep 2026 19:45:46 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.200 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790106350; cv=none; b=WeDWIK7VP1t1VTD4/195Q8clETQlPBxtcqWtoUhlPgs67Z80n3yFJmt7RLa8IJnfrWqAIHeQ9EUBblThebEgUyql/NCgapNKirKTT5frJ3P4Y6n2tCW0YN2O+lv+nfcsATJVQ2LQCQQ0cSXLnwLhO+FzjfY5r5gd4hdPODhq/Mc= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790106350; c=relaxed/simple; bh=wRLASX/97yU9zKBfZV8vy5gzmtHXRvnvGYUyP0j3LM0=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=Wc82ZRHrUXyqY0I1elLgdAL7MG2J06pUNxs7CSGDmZFIJEz/7Bai225zmmuG07o1Vpr6FKFzV9N0yiIy15G4MEMmJLzs5PVfcu7PR785HSiHTqVA0bvmBFO3yAczHXagY/d1RYorcnM+msDwjl0UhhojdUzQtMCNkPfUp9AUvMI= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--joshwash.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=ijWuoUaj; arc=none smtp.client-ip=209.85.210.200 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--joshwash.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="ijWuoUaj" Received: by mail-pf1-f200.google.com with SMTP id d2e1a72fcca58-86261e66700so198364b3a.3 for ; Tue, 22 Sep 2026 12:45:46 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1790106346; x=1790711146; darn=vger.kernel.org; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:from:to:cc:subject:date:message-id:reply-to :content-type; bh=suMSGTXypfIdrYAcS87e+4uWOy37tQcyCih/ffX9UDg=; b=ijWuoUajYq5qsBoxzCYhs4T0TIDziDy9fJI7ZpKf4RQhogTx2Msw7Bc+/mdhn+C2RI GG2iEwC9gfSNuN7UHZumTIcdYOwkcL/A9mGgyKs2mA15sfvOL3rVD2LWF+58wx0ua245 3eA5b7MtiEQJM1Qckh7xJoExx0orI0lYxfTo3XlGXwBUe2NtYmoJh9yKJPKECJDItE+U J/ZpeKWn/XLsBIuhzr2RsIwEEZtWoZdxbVdVByH/qwELVi3LYYTpbK1+RkyvLLqvhof5 ZIynH45jCR2RFxyno7RHzYzQxwO6SfcxzVEgtMLQMfNEDRY8uBoc/dav/pHiSFhsZbJB qqbA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1790106346; x=1790711146; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=suMSGTXypfIdrYAcS87e+4uWOy37tQcyCih/ffX9UDg=; b=pKmKnjAmzniPzsvWTzCjAINSfyZ+sp3EC5c9lqAFfAVY5X0mXvByMVoYmzGMvVmZ9O cZjqQraoTq89BFIBfE6ZLL7UhbLmC6xB4sdczpeiiZikXNJMD6QfOkCHJeNKOr9S5Aof dt2r9QBB6zcV8QnhmfL5iI7X4wQD7tTet5htO2WPA5BEMP5dijFSOw4UPE+Lhzv2q5LK 5HV7w4+HrG1ca1hkrXB6+rb/rhJeDKRcQ5Dcup5NM88PoC5KEG1XvcQsQqo5B/h8TKm7 e5cGWaG4HApS9lstrIOBi0IDqYyrmfPAEcyaLyygMUnN3VZIKcQacn/E3X3FUEWJqVza Gd4g== X-Forwarded-Encrypted: i=1; AKwUvByLhuEa05LTvHWrtTXsXVg6FK5X/5W7U94SAyIwqBS4RyCvAw6/yuMKB2Adbns2347xXXJmy07j/8RHkpM=@vger.kernel.org X-Gm-Message-State: AFuF++kGxPb7wlSkpCxT04n53U6cDB1xypUg2ZROAPbBMMDc6sVN5uqG jceo78js9fmoGEp0CNaDTVOKNPy3/54vnPyzpWa1f7E8niMSG9YMGdajSy+m0RMQ7SofDf+bBpT aTk7nAQBu44wWeA== X-Received: from pfko10.prod.google.com ([2002:a05:6a00:214a:b0:87d:d4a:136c]) (user=joshwash job=prod-delivery.src-stubby-dispatcher) by 2002:a05:6a00:3316:b0:86e:8deb:fbd4 with SMTP id d2e1a72fcca58-87d1a7af6fdmr683675b3a.11.1790106345528; Tue, 22 Sep 2026 12:45:45 -0700 (PDT) Date: Tue, 22 Sep 2026 12:45:28 -0700 In-Reply-To: <20260922194533.631387-1-joshwash@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20260922194533.631387-1-joshwash@google.com> X-Mailer: git-send-email 2.55.0.1082.g2b9226bbc0-goog Message-ID: <20260922194533.631387-5-joshwash@google.com> Subject: [PATCH net v2 4/9] gve: don't register xsk pool on pre-existing queues in RDA mode From: Joshua Washington To: netdev@vger.kernel.org Cc: Joshua Washington , Harshitha Ramamurthy , Andrew Lunn , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Alexei Starovoitov , Daniel Borkmann , Jesper Dangaard Brouer , John Fastabend , Stanislav Fomichev , Jordan Rhee , Willem de Bruijn , Tim Hostetler , Ankit Garg , Eddie Phillips , Praveen Kaligineedi , Jeroen de Borst , linux-kernel@vger.kernel.org, bpf@vger.kernel.org, stable@vger.kernel.org Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" When XSK pools are enabled after an XDP program has already been loaded, XSK pools are registered on pre-existing queues before queues are re-created with the XSK pool fully registered in DQ RDA mode. This can lead to a race condition between the RX NAPI and the control plane thread wherein a pre-existing queue sees the live XSK pool and attempts to use recycled buffers not backed by XSK buffs for AF_XDP ZC traffic. This causes the following kernel panic to occur when attempting to DMA map a NULL XSK buffer: BUG: kernel NULL pointer dereference, address: 0000000000000050 ... RIP: 0010:gve_rx_post_buffers_dqo+0x99/0x190 [gve] ... Call Trace: gve_rx_poll_dqo+0x4d9/0xf10 [gve] gve_napi_poll_dqo+0x76/0x170 [gve] __napi_poll+0x28/0x160 net_rx_action+0x2a0/0x350 handle_softirqs+0xd4/0x280 ? sort_range+0x20/0x20 run_ksoftirqd+0x2d/0x40 smpboot_thread_fn+0xd5/0x1d0 kthread+0xd7/0x100 ? kthread_complete_and_exit+0x20/0x20 ret_from_fork+0x1f/0x30 The XSK pool should only be registered with current queues if XSK buffers are allocated on-the-fly, as is the case in QPL mode. Fixes: c1fffc5d66a7 ("gve: implement DQO RX datapath and control path for A= F_XDP zero-copy") Cc: stable@vger.kernel.org Reviewed-by: Jordan Rhee Reviewed-by: Tim Hostetler Signed-off-by: Joshua Washington --- drivers/net/ethernet/google/gve/gve_main.c | 16 +++++++--------- 1 file changed, 7 insertions(+), 9 deletions(-) diff --git a/drivers/net/ethernet/google/gve/gve_main.c b/drivers/net/ether= net/google/gve/gve_main.c index 9cc343a16271..b9bcdc7619b2 100644 --- a/drivers/net/ethernet/google/gve/gve_main.c +++ b/drivers/net/ethernet/google/gve/gve_main.c @@ -1654,20 +1654,18 @@ static int gve_xsk_pool_enable(struct net_device *d= ev, if (!priv->xdp_prog || !netif_running(dev)) return 0; =20 - err =3D gve_reg_xsk_pool(priv, dev, pool, qid); - if (err) - goto err_xsk_pool_dma_mapped; - - /* Stop and start RDA queues to repost buffers. */ - if (!gve_is_qpl(priv)) { + if (gve_is_qpl(priv)) { + err =3D gve_reg_xsk_pool(priv, dev, pool, qid); + if (err) + goto err_xsk_pool_dma_mapped; + } else { + /* Stop and start RDA queues to repost buffers. */ err =3D gve_configure_rings_xdp(priv, priv->rx_cfg.num_queues); if (err) - goto err_xsk_pool_registered; + goto err_xsk_pool_dma_mapped; } return 0; =20 -err_xsk_pool_registered: - gve_unreg_xsk_pool(priv, qid); err_xsk_pool_dma_mapped: clear_bit(qid, priv->xsk_pools); xsk_pool_dma_unmap(pool, --=20 2.55.0.1082.g2b9226bbc0-goog From nobody Thu Sep 24 15:10:14 2026 Received: from mail-pg1-f200.google.com (mail-pg1-f200.google.com [209.85.215.200]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5C9594A206C for ; Tue, 22 Sep 2026 19:45:48 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.215.200 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790106351; cv=none; b=NoKjRoU0x9bdRqioOSFmnvwFwlcxZQZf4Hq7EfPVI5oNeqdYJFe3Fq6J2a7qyWwoG/+9xaV0tObnL90X6hxk+l5gcfaVnFjFLZNpSTlHpc1SwC3p0d87seMqAw7h70dlPvYIsQSDBTpJ8nsCQC2uuXGXIiKqMp4n/ga7MhVSKRk= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790106351; c=relaxed/simple; bh=qIMCCaTvSWDTxA3XuP5WL1+WB8BXmmqRBAoCppkztHc=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=HflG9lcqke0flEPb/CJ8n9f9W4UOt0LCucddOaVobhp32XNRnSVplwUXDyXwpht9P2Lw/SnEWkkBfoUR1Hr/UUVZyefxHWU03SrwuZ1U191dqTKO7k4JE1ZwBlwLwsjzwo7xd5EgokpN+hgFw/qHQWetoBKgt8rFFpj1eHOOA/M= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--joshwash.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=bow9y9QX; arc=none smtp.client-ip=209.85.215.200 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--joshwash.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="bow9y9QX" Received: by mail-pg1-f200.google.com with SMTP id 41be03b00d2f7-cc4e496e5c3so216542a12.0 for ; Tue, 22 Sep 2026 12:45:48 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1790106348; x=1790711148; darn=vger.kernel.org; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:from:to:cc:subject:date:message-id:reply-to :content-type; bh=UvcRcnpVi8ICqxsH8+8hVW6wZ840sbPSq2HiKDG88Is=; b=bow9y9QXxCzVs4du4wnN39XFgYuKSSzS3X6x33Uy979X5SXJv0Z3aGzqhGVXqBAJ6M 2TtpmiMPG0qRM3RsI88AkZ7mykZbovbziTzSR/7pqU8xPEKq09fpmmbVG+XNvCY8PV9N Ww9rocpZMlbukhmRDxDn1IQo4jLd7qqwpZPFYr2nY5ShZoKbZUxAfNFmbATN5qEtcv4e PqzFQ0h3BG68xqNT8phsNwojJxjfxro8vleS5/lTaNVpQ/LNcNoSe+5RYg7sJFcHoeMU Kxs7LOsGbInTfiUQfm5P3YpivvR33xp0+wpany3oBkUHO6Q73yjTCamCP87hzFPrycpE krnQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1790106348; x=1790711148; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=UvcRcnpVi8ICqxsH8+8hVW6wZ840sbPSq2HiKDG88Is=; b=dMI2gwkIx/nPbfEc6m7UkHKAQaNt09er92YrFssH/rLzssCZSoodQlM+amjpq6FlUh +CJdWSjjU+UyD5F62VpRX7DNJ/QbzNPq1zy0j2mh9OMd19KpFLJzsFp/2GuC0i8ckRLu Cj05LET1/8jTZKfmVO/8VeNbxOqkvLy5Yv75RZWf5IpMqhbYH5TJR3haA7CkJHCCDUYZ TAhKqwAyfFrjFNMHEM2nS75IbYFU/hZmahZtKuJQ5Aq4Ns5KDzp0uyxApFmF1xxTHX17 xhruh0kFJo+q0/qSAx0S38KkVBkoH0CJcAzB/LT9Eq17Z+xmiySfInjtr/NDyFhkMxCb dZQQ== X-Forwarded-Encrypted: i=1; AKwUvBwtTeCnXS2Jmkr86RnvfYb4ZYgDFZQ1/nVLbdrJ2YzQUCz8+FHPmvMC5o9dLMy1yLS3tt8TYjap0u0p7V0=@vger.kernel.org X-Gm-Message-State: AFuF++moGL9FPZFNtOmsHnFUyPC5bHG+LZ7EworASbWolObRERXn+eIO QgPQ0EUThhFmt60zgxKiA0OposAiGpaRdSd0uor+hh13DwzNKXvntnTG0fWlsF8MgjlwvQJXSzt wl0x7cjBgh1sfgw== X-Received: from pfbfu12.prod.google.com ([2002:a05:6a00:610c:b0:84a:251a:a85e]) (user=joshwash job=prod-delivery.src-stubby-dispatcher) by 2002:a05:6a20:939d:b0:3dd:e2e3:30fc with SMTP id adf61e73a8af0-3ddf82fa284mr499447637.49.1790106347525; Tue, 22 Sep 2026 12:45:47 -0700 (PDT) Date: Tue, 22 Sep 2026 12:45:29 -0700 In-Reply-To: <20260922194533.631387-1-joshwash@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20260922194533.631387-1-joshwash@google.com> X-Mailer: git-send-email 2.55.0.1082.g2b9226bbc0-goog Message-ID: <20260922194533.631387-6-joshwash@google.com> Subject: [PATCH net v2 5/9] gve: fix napi_disable deadlock when attempting to disable XSK pools From: Joshua Washington To: netdev@vger.kernel.org Cc: Joshua Washington , Harshitha Ramamurthy , Andrew Lunn , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Alexei Starovoitov , Daniel Borkmann , Jesper Dangaard Brouer , John Fastabend , Stanislav Fomichev , Jordan Rhee , Willem de Bruijn , Tim Hostetler , Ankit Garg , Eddie Phillips , Praveen Kaligineedi , Jeroen de Borst , linux-kernel@vger.kernel.org, bpf@vger.kernel.org, stable@vger.kernel.org Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" When disabling XSK pools, GVE calls the unlocked versions of napi_disable and napi_enable. However, the netdev lock has already been acquired before ndo_bpf is called because GVE supports queue management ops. Calling the unlocked versions of napi_disable/enable results in a deadlock when attempting to disable XSK pools, as the thread attempts to re-acquire a lock it already holds. Update the NAPI calls to use the locked versions. Fixes: 606048cbd834 ("net: designate XSK pool pointers in queues as "ops pr= otected"") Cc: stable@vger.kernel.org Reviewed-by: Harshitha Ramamurthy Reviewed-by: Jordan Rhee Signed-off-by: Joshua Washington --- drivers/net/ethernet/google/gve/gve_main.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/net/ethernet/google/gve/gve_main.c b/drivers/net/ether= net/google/gve/gve_main.c index b9bcdc7619b2..3712ff364cbd 100644 --- a/drivers/net/ethernet/google/gve/gve_main.c +++ b/drivers/net/ethernet/google/gve/gve_main.c @@ -1706,17 +1706,17 @@ static int gve_xsk_pool_disable(struct net_device *= dev, } =20 napi_rx =3D &priv->ntfy_blocks[priv->rx[qid].ntfy_id].napi; - napi_disable(napi_rx); /* make sure current rx poll is done */ + napi_disable_locked(napi_rx); /* make sure current rx poll is done */ =20 tx_qid =3D gve_xdp_tx_queue_id(priv, qid); napi_tx =3D &priv->ntfy_blocks[priv->tx[tx_qid].ntfy_id].napi; - napi_disable(napi_tx); /* make sure current tx poll is done */ + napi_disable_locked(napi_tx); /* make sure current tx poll is done */ =20 gve_unreg_xsk_pool(priv, qid); smp_mb(); /* Make sure it is visible to the workers on datapath */ =20 - napi_enable(napi_rx); - napi_enable(napi_tx); + napi_enable_locked(napi_rx); + napi_enable_locked(napi_tx); if (gve_is_gqi(priv)) { if (gve_rx_work_pending(&priv->rx[qid])) napi_schedule(napi_rx); --=20 2.55.0.1082.g2b9226bbc0-goog From nobody Thu Sep 24 15:10:14 2026 Received: from mail-pj1-f69.google.com (mail-pj1-f69.google.com [209.85.216.69]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5C07D49E5C3 for ; Tue, 22 Sep 2026 19:45:50 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.69 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790106352; cv=none; b=haMIsE3NDnafvig1guC/W79CZ+PBwn0aOoslhdDNzRGECE60SWddp6yh8muA5C05AQqea8hVkFq/AZpvBr9w0WcrReYmzAVrQxieSoZs4ArG76HZlzW/sF0MazSZBId1PihG0hJHcrw3L0jfZ0guBQ0+pKLcI4JBjaC7JlNyDIQ= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790106352; c=relaxed/simple; bh=FfCctRadccrhbBiciGBmKdfV1QGWKniOCykBzuPatXA=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=CxH9d6J0m5X5R4hPnWb9gVKrnrRlp1bSXPcdTuWKCwr8ILgqMTXfffvHeteH4gplIbbAp7/hVY2oGK0hTfaaBlxqu27TreoSmKzgsD6KFofpJLKyat5HvfxvXpp+y7KTRaICNQck5eQswWIiyQPpSQTj5nhChzMJNvhdIsQLj38= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--joshwash.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=eS9JzGm9; arc=none smtp.client-ip=209.85.216.69 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--joshwash.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="eS9JzGm9" Received: by mail-pj1-f69.google.com with SMTP id 98e67ed59e1d1-39d8646b10eso199386a91.1 for ; Tue, 22 Sep 2026 12:45:50 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1790106349; x=1790711149; darn=vger.kernel.org; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:from:to:cc:subject:date:message-id:reply-to :content-type; bh=2Tr6UXn84setH0JvzM0Q9v+ToB161JXMxDfH+vSeors=; b=eS9JzGm9ku21iXaAxvGUZkvoVI71CdlJS7yaaOUt5Frfy7T20LOAPNcxFcgHCMbcCR WVjbKD5+4ofgWsDDTGAziq9ciWIH9if8lAX4hj2uE9H17E+W3cW0PlJTQtpEm9kr4Y3/ 9169SDpdBo1ZmodBnr7AqXSb8x70MpeE4+lbObZB3zEBFAbtXqJ5bpiio8CYLCtgX5/j +HI0wRIEOVEVOzqSoUONgXq0lbkVofLZbZkj+bLweZpdJ8zfKt8Ptu9gVutNUK+SRwj3 AH1FOHijiJa6Qw3MeMrNAbHboQNSoWJa5YBYsGBuWB+KV2kPQpwo3LpX5Q09Mhom2Lmo QEGA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1790106349; x=1790711149; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=2Tr6UXn84setH0JvzM0Q9v+ToB161JXMxDfH+vSeors=; b=B0eMfk6vzYPt4JmtIOvo3kBGNZsIOMlYCYhRd/5M4BP9AKuaBZQqg/2wwIRPhOfdjd dK+Pqr1jGjc4wyise4xrM262YS1LMM2DBkb1srV0WwLaUF+TgWBDltF1JjSkgNZPTIf4 NQqcbMisJyBkGZY41hJTuJwhVcsfp6Ht8khDaTXXv3g0a2dhNsReDDOiRG7eghbSCIgs dHnx57Mi4VkoIKRbp26ElXyy0a5yywrx5uXNocj59pFNUs9LPRmFlZj8KVEsdim5jcCA 4vh4Ro4yShXp2JrAkC5FzHlnP2UucNlLOcRIGitaDXLSmnful/gdwGEZ6+Ry8tChP30x kB6g== X-Forwarded-Encrypted: i=1; AKwUvBwTIGkte3SzBuX1gxbo5sHPG1E3Y/loGRT9UC9VEDz5w/yoObyqPOJePDW35hw1xv3TJq4YXpRC6YWYCpg=@vger.kernel.org X-Gm-Message-State: AFuF++k084whdTo41TYmtW/yDbOrV5yw5toERBOmJZbcK4THKktUaLyn alhPXySW9DmPtRun73aPvZot2znv2IGJl+XGjp7zuo4QdBLYmXW34fg9f2Pau3G4Sq7BP66v3Et KiWXxAQvUMJWjmA== X-Received: from pgp27-n2.prod.google.com ([2002:a05:6a02:62db:20b0:cc7:521e:d606]) (user=joshwash job=prod-delivery.src-stubby-dispatcher) by 2002:a05:6a21:9101:b0:3dd:a00a:7ac6 with SMTP id adf61e73a8af0-3ddf82c1e03mr444531637.51.1790106349298; Tue, 22 Sep 2026 12:45:49 -0700 (PDT) Date: Tue, 22 Sep 2026 12:45:30 -0700 In-Reply-To: <20260922194533.631387-1-joshwash@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20260922194533.631387-1-joshwash@google.com> X-Mailer: git-send-email 2.55.0.1082.g2b9226bbc0-goog Message-ID: <20260922194533.631387-7-joshwash@google.com> Subject: [PATCH net v2 6/9] gve: fix NULL dereference from premature XSK pool DMA unmap From: Joshua Washington To: netdev@vger.kernel.org Cc: Joshua Washington , Harshitha Ramamurthy , Andrew Lunn , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Alexei Starovoitov , Daniel Borkmann , Jesper Dangaard Brouer , John Fastabend , Stanislav Fomichev , Jordan Rhee , Willem de Bruijn , Tim Hostetler , Ankit Garg , Eddie Phillips , Praveen Kaligineedi , Jeroen de Borst , linux-kernel@vger.kernel.org, bpf@vger.kernel.org, stable@vger.kernel.org Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" To ensure that XSK pools are DMA unmapped in all scenarios, GVE performs the unmapping before validating if the interface is up and early returning. However, if rings are up, this introduces a race between the RX NAPI and the control plane. As part of DMA unmapping the XSK pool, the kernel sets pool->dev to NULL. Because xsk_buff_dma_sync_for_cpu() relies on pool->dev, this results in a kernel panic: BUG: kernel NULL pointer dereference, address: 000000000000030c ... RIP: 0010:gve_rx_poll_dqo+0x2e2/0x13b0 [gve] ... Call Trace: gve_napi_poll_dqo+0x88/0x170 [gve] __napi_poll+0x30/0x210 net_rx_action+0x210/0x410 ? dst_destroy_rcu+0x12/0x20 handle_softirqs+0xe4/0x310 __irq_exit_rcu+0x10e/0x130 irq_exit_rcu+0xe/0x20 common_interrupt+0xb6/0xe0 Leave the XSK pool DMA mapped until after rings are guaranteed to no longer rely on the pool. Fixes: d57ae093c887 ("gve: deduplicate xdp info and xsk pool registration l= ogic") Cc: stable@vger.kernel.org Reviewed-by: Jordan Rhee Signed-off-by: Joshua Washington --- drivers/net/ethernet/google/gve/gve_main.c | 25 ++++++++++++---------- 1 file changed, 14 insertions(+), 11 deletions(-) diff --git a/drivers/net/ethernet/google/gve/gve_main.c b/drivers/net/ether= net/google/gve/gve_main.c index 3712ff364cbd..49ae2b8c6a27 100644 --- a/drivers/net/ethernet/google/gve/gve_main.c +++ b/drivers/net/ethernet/google/gve/gve_main.c @@ -1681,22 +1681,18 @@ static int gve_xsk_pool_disable(struct net_device *= dev, struct napi_struct *napi_rx; struct napi_struct *napi_tx; struct xsk_buff_pool *pool; + int err =3D 0; int tx_qid; - int err; =20 - if (qid >=3D priv->rx_cfg.num_queues) - return -EINVAL; + if (qid >=3D priv->rx_cfg.num_queues) { + err =3D -EINVAL; + goto unmap_and_return; + } =20 clear_bit(qid, priv->xsk_pools); =20 - pool =3D xsk_get_pool_from_qid(dev, qid); - if (pool) - xsk_pool_dma_unmap(pool, - DMA_ATTR_SKIP_CPU_SYNC | - DMA_ATTR_WEAK_ORDERING); - if (!netif_running(dev) || !priv->tx_cfg.num_xdp_queues) - return 0; + goto unmap_and_return; =20 /* Stop and start RDA queues to repost buffers. */ if (!gve_is_qpl(priv) && priv->xdp_prog) { @@ -1725,7 +1721,14 @@ static int gve_xsk_pool_disable(struct net_device *d= ev, napi_schedule(napi_tx); } =20 - return 0; +unmap_and_return: + pool =3D xsk_get_pool_from_qid(dev, qid); + if (pool) + xsk_pool_dma_unmap(pool, + DMA_ATTR_SKIP_CPU_SYNC | + DMA_ATTR_WEAK_ORDERING); + + return err; } =20 static int gve_xsk_wakeup(struct net_device *dev, u32 queue_id, u32 flags) --=20 2.55.0.1082.g2b9226bbc0-goog From nobody Thu Sep 24 15:10:14 2026 Received: from mail-pf1-f200.google.com (mail-pf1-f200.google.com [209.85.210.200]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3B8C84A6CCB for ; Tue, 22 Sep 2026 19:45:52 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.200 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790106364; cv=none; b=CMRRyds6IckvYbEyGI6BC1vHtP/gYzwId9hFv5ORnCzrK7zS7D0FnELFwqsFybss0alt9r4TKVxSPHWq09Fee2DqWi+18X379Fj2F32Ar7K0epz2z0BeqFY9cL6JWQXt7UmGEU09mwcDKJmcnse/dfmH4dvvkDad2xptI3NcJ0o= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790106364; c=relaxed/simple; bh=1EJkBF60HcU/pLER8OktBdGOFBFfB6U9QISFMdwHHNY=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=eRz4Pku1LC2S5JRpPLSetNGBo47ZKs0lh6esGEaQ06HCk4+nycaqz69gP0Rl7MVprEOGPoy1oXXVBDDBw6ck83zD6peEMk66YGcbazX47qwZeHHg9NI+0mmLe27DmPnKBv1S1NS8ok7KsfpMyk+Qr4wDYqvacdVMf4QyD3jOp3Y= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--joshwash.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=GF2W7ZMe; arc=none smtp.client-ip=209.85.210.200 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--joshwash.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="GF2W7ZMe" Received: by mail-pf1-f200.google.com with SMTP id d2e1a72fcca58-8679cfe5019so350941b3a.0 for ; Tue, 22 Sep 2026 12:45:52 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1790106351; x=1790711151; darn=vger.kernel.org; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:from:to:cc:subject:date:message-id:reply-to :content-type; bh=lE/2nZUBQE5y8bltkgjlYIgZWN2LasehNWmZI4UlYBI=; b=GF2W7ZMeAwEiZhP3ksEcJ62yH4pS4zP1EEIK0gf8m4g04RRqZIVM/71EkmeGSYDXzn JpfybL+tDDEYlk82YRhhijL4zqQPD+H7i2pjrJ+BVGu77P2Ho32cdToYBFF1FOsbCVoZ 46tutafUzUNry0eudlN+6E3LP8sSMIP94cJmddekjYQ0q1V5us2cdgtMoQxQW5AlLUvk FNDDQhxt4EXWDsq41yJMd7+bv7LT1Dmd0LE+/j76/+Rk1zoDWZHPkP6uH9C8CdpWK3qB jOCMFpOJ0p89eiv7l8Y0Jcj/Pxn0lFIJ85asdFImCLxVgytiNtO24ylqVL6INSwsAbm6 yzJg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1790106351; x=1790711151; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=lE/2nZUBQE5y8bltkgjlYIgZWN2LasehNWmZI4UlYBI=; b=KFFtA2s7scrh9caMNkMInl/J2m3c7qQJVZDLsA3C4qCqkccAoOe9ikB3vTkLzmeEOX zL6kOS+dRWldamKZMs7uAnUIk5wj6ex1Yk4LhQ9aNQVBaZco/gGEAaOdjHO25cBdJNR9 hO24dA+FNbEXnE88dPuglqMH1/dzEmIOVht9vP1ZqJC4PN3biVWUibqh0psEOHLV2xyf NaNwZNM3JGkDGr+guX/5Ep6hHSZvnEfdkfwkTqQaqjG1XmUM4oezLxvbEc0nC/BH2m4q 8sJm1RZ5tMpRVdG2jgDEkt1kQwF2yeQVgl5khWEr45zUAjCTBCl9pa02KbQy6TmtgcNH 8UPQ== X-Forwarded-Encrypted: i=1; AKwUvBxMdAki4Z/U4VUysPGI6Ahwp45Vpigq8ivZAchnIrwO8HisybSZ+COnXDp+2qrSsShd0XPNkyIoBNHGZas=@vger.kernel.org X-Gm-Message-State: AFuF++kfgRm5bmTTgVOYIZWJymYTcRsAfG8/0NH/Ufw7xoZrdq/DPeA/ yz0TjgAothxa6llN5pLZBoC8S5dWb1VcCFdWR0BCdEed4HJgyyX9F5ALCoivSY07OpJKKlkRcg7 uywDEoly4/dGVIg== X-Received: from pfqy13.prod.google.com ([2002:aa7:9e0d:0:b0:848:5540:2ad5]) (user=joshwash job=prod-delivery.src-stubby-dispatcher) by 2002:a05:6a00:1911:b0:87d:430:1578 with SMTP id d2e1a72fcca58-87d1b8a0852mr683603b3a.29.1790106351015; Tue, 22 Sep 2026 12:45:51 -0700 (PDT) Date: Tue, 22 Sep 2026 12:45:31 -0700 In-Reply-To: <20260922194533.631387-1-joshwash@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20260922194533.631387-1-joshwash@google.com> X-Mailer: git-send-email 2.55.0.1082.g2b9226bbc0-goog Message-ID: <20260922194533.631387-8-joshwash@google.com> Subject: [PATCH net v2 7/9] gve: disable NAPI when registering XSK pools in QPL mode From: Joshua Washington To: netdev@vger.kernel.org Cc: Joshua Washington , Harshitha Ramamurthy , Andrew Lunn , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Alexei Starovoitov , Daniel Borkmann , Jesper Dangaard Brouer , John Fastabend , Stanislav Fomichev , Jordan Rhee , Willem de Bruijn , Tim Hostetler , Ankit Garg , Eddie Phillips , Praveen Kaligineedi , Jeroen de Borst , linux-kernel@vger.kernel.org, bpf@vger.kernel.org, stable@vger.kernel.org Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" As a result of QPL modes not posting XSK buffers directly to the NIC, they do not need to recreate queues or re-post DMA buffers. However, traffic should still be quiesced because both the driver and the XDP redirect stack must have the same knowledge about whether a given packet is being processed with AF_XDP zero-copy enabled or not. GVE in QPL mode does not current respect this, which could lead to a race condition between packet processing and the XSK_BUFF_POOL memory model registration. Quiesce traffic by disabling the NAPI while the XSK_BUFF_POOL memory model is being registered with the kernel. Fixes: fd8e40321a12 ("gve: Add AF_XDP zero-copy support for GQI-QPL format") Cc: stable@vger.kernel.org Reviewed-by: Harshitha Ramamurthy Signed-off-by: Joshua Washington --- v2: - newly introduced --- drivers/net/ethernet/google/gve/gve_main.c | 41 ++++++++++++++++++++++ 1 file changed, 41 insertions(+) diff --git a/drivers/net/ethernet/google/gve/gve_main.c b/drivers/net/ether= net/google/gve/gve_main.c index 49ae2b8c6a27..f2bd4011de23 100644 --- a/drivers/net/ethernet/google/gve/gve_main.c +++ b/drivers/net/ethernet/google/gve/gve_main.c @@ -1626,6 +1626,40 @@ static int gve_xdp_xmit(struct net_device *dev, int = n, return -EOPNOTSUPP; } =20 +static void gve_disable_xsk_napis(struct gve_priv *priv, u16 qid) +{ + struct napi_struct *napi_rx, *napi_tx; + u16 tx_qid; + + napi_rx =3D &priv->ntfy_blocks[priv->rx[qid].ntfy_id].napi; + napi_disable_locked(napi_rx); + + tx_qid =3D gve_xdp_tx_queue_id(priv, qid); + napi_tx =3D &priv->ntfy_blocks[priv->tx[tx_qid].ntfy_id].napi; + napi_disable_locked(napi_tx); +} + +static void gve_enable_xsk_napis(struct gve_priv *priv, u16 qid) +{ + struct napi_struct *napi_rx, *napi_tx; + u16 tx_qid; + + napi_rx =3D &priv->ntfy_blocks[priv->rx[qid].ntfy_id].napi; + napi_enable_locked(napi_rx); + + tx_qid =3D gve_xdp_tx_queue_id(priv, qid); + napi_tx =3D &priv->ntfy_blocks[priv->tx[tx_qid].ntfy_id].napi; + napi_enable_locked(napi_tx); + + if (gve_is_gqi(priv)) { + if (gve_rx_work_pending(&priv->rx[qid])) + napi_schedule(napi_rx); + + if (gve_tx_clean_pending(priv, &priv->tx[tx_qid])) + napi_schedule(napi_tx); + } +} + static int gve_xsk_pool_enable(struct net_device *dev, struct xsk_buff_pool *pool, u16 qid) @@ -1655,7 +1689,14 @@ static int gve_xsk_pool_enable(struct net_device *de= v, return 0; =20 if (gve_is_qpl(priv)) { + gve_disable_xsk_napis(priv, qid); + err =3D gve_reg_xsk_pool(priv, dev, pool, qid); + /* Make sure it is visible to the workers on datapath */ + smp_mb(); + + gve_enable_xsk_napis(priv, qid); + if (err) goto err_xsk_pool_dma_mapped; } else { --=20 2.55.0.1082.g2b9226bbc0-goog From nobody Thu Sep 24 15:10:14 2026 Received: from mail-pg1-f199.google.com (mail-pg1-f199.google.com [209.85.215.199]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id F30534A2A4D for ; Tue, 22 Sep 2026 19:45:53 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.215.199 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790106365; cv=none; b=JIcSCZACZvIyhxl3Y0b2j3mNsC96HaRrLubRBeMW57583uvQHGhsP2H/AoauYMD/cMK7dSvPv5vyM5VFw1clgPgOrAHaAiSu7DDVtb17Djk/ZBVXxpbDT/AvmoNVsodZTwZno+Yvr+8KAUGnWaHvWfknypjJq+R7ebFO6ruvBjk= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790106365; c=relaxed/simple; bh=8MoaxatY2izDoNAYUPA3y7R0UpDFQ0rXZF4ec6yabMM=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=pZNEOtOjNtRzPIOJORAFlPV9GnYZveU2ybb0qKRNx1WOb/xKtz9O9ZLmpNoN5Wj800uTwOuaj7fjP4QZsQnEOcoC4vG15+JOU1vyqs3svkd0wL9zfwm27uoikBAWBNl1AaKTGZTGgAFAetrDPWPKKr3olwKiO+vqujtcj2tas50= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--joshwash.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=ty7KKIUU; arc=none smtp.client-ip=209.85.215.199 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--joshwash.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="ty7KKIUU" Received: by mail-pg1-f199.google.com with SMTP id 41be03b00d2f7-cc4922b7c31so230728a12.1 for ; Tue, 22 Sep 2026 12:45:53 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1790106353; x=1790711153; darn=vger.kernel.org; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:from:to:cc:subject:date:message-id:reply-to :content-type; bh=Tz/q0nSTLJ4QRO3t2821L4KQPs7Ia7F9nioYJaCojlQ=; b=ty7KKIUUBsIG7gQP2wBYce8qEzE6r3Yt5nLvdn3shhm3+4U3/VJIARTV70i5513tv5 Jvv3fOrykovpfVPl1SkXVo0jRDeoWa/zNoTwN2D+O8Qzn6Xvp1H2OxZcGbB0mb7Ou7eH Gmn3oFo7LwIOm6dKA5wLxR7bKnTeOqOhKUaVQrLK5KzTJyKDCUAzQddsERGULmJoBKeI I1ecHz7o5IHRVMdaUCidBf+bgrij3IKBB39ku8/Vk5th5mJ1qaBeO54xgBOlAmvvFmwV ODp26ElXO200WWwvmUJBLrCi5ke+j2llrKL0NlFpVDIBuaX0/aBwZmvJ8HHx7x8Uf/s0 Dofg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1790106353; x=1790711153; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=Tz/q0nSTLJ4QRO3t2821L4KQPs7Ia7F9nioYJaCojlQ=; b=HhHXS8OKB00AqO51S4lf5d3R4Mk4Kz4hom6mDnbOWmA54AsFwir/6mE5hYOUbdYHli k34YmE8MH9zruHt8dKgcMRghiQlNmr6DVYaFLDL19t2WwMzwUElTpFL4aHaOG6/tmn4w XOCRNiHUN8A7fLXc3pWoZpEhIRKGsJlSkEzYPf9Km9y16vFSOyZQyWVKF+0Azi9Rwm+X G7JV5dZSJkdNJSZMF32UKAAiX3NNjzI42TYuhEKrh5ZBZwvWgsDeDda7zdQql54QYCud 8BrIeQ20gSBApsOVcp57e8ErIMfzyCfeUDky04dbkziWtxa0TdSEPouM5+GE02l7ukO7 8xDg== X-Forwarded-Encrypted: i=1; AKwUvBxroeWaT85Yfec8JYdNziY/crIUZ025qNaZ/YM73UyArlqS2bQwsOMO5bnyKZBMxvWucY6kF1QhV2tWv8o=@vger.kernel.org X-Gm-Message-State: AFuF++mu7Jjx69xTBaPIP1P9nIrYFJpS69euWGQ0aDvU6nzj4FHtX24G HSxYegVwWNwM6x33rnVQ2b5hSgsXFk/MVI7Sxu3cMPjNIIJBc3bKuv+lXfxTw7exxiIs6bKZOOo QXfLxmeTfPUIbzw== X-Received: from pgbco10.prod.google.com ([2002:a05:6a02:34a:b0:cc1:bcd4:fc4d]) (user=joshwash job=prod-delivery.src-stubby-dispatcher) by 2002:a05:6a21:b98:b0:3dd:85a8:cad6 with SMTP id adf61e73a8af0-3ddf82c4947mr500247637.45.1790106352893; Tue, 22 Sep 2026 12:45:52 -0700 (PDT) Date: Tue, 22 Sep 2026 12:45:32 -0700 In-Reply-To: <20260922194533.631387-1-joshwash@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20260922194533.631387-1-joshwash@google.com> X-Mailer: git-send-email 2.55.0.1082.g2b9226bbc0-goog Message-ID: <20260922194533.631387-9-joshwash@google.com> Subject: [PATCH net v2 8/9] gve: ensure XDP mem model is registered when disabling XSK pools From: Joshua Washington To: netdev@vger.kernel.org Cc: Joshua Washington , Harshitha Ramamurthy , Andrew Lunn , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Alexei Starovoitov , Daniel Borkmann , Jesper Dangaard Brouer , John Fastabend , Stanislav Fomichev , Jordan Rhee , Willem de Bruijn , Tim Hostetler , Ankit Garg , Eddie Phillips , Praveen Kaligineedi , Jeroen de Borst , linux-kernel@vger.kernel.org, bpf@vger.kernel.org, stable@vger.kernel.org Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" When disabling XSK pools, QPL and RDA modes have different behaviors, but they are both incorrect in that the function returns just after unregistering the memory model. RDA mode performs an internally consistent re-configuration of rings, making the extra logic, including the XSK pool unregistration, unnecessary. However, it is possible for the reconfiguration to fail due to memory allocation. Instead of freeing and re-allocating ring memory, stop the rings and reinitialize the ring state. That way, failure to stop the rings would result in a safer device reset, making it safe to unregister the pool regardless of the error condition when stopping queues. This change involves a bit of refactoring in the TX initialization path, introducing new methods to reset ring state when stopping the rings. QPL mode, which does not need to reconfigure rings due to not posting XSK umem to the hardware ring, simply misses registering the RXQ XDP info with the MEM_TYPE_PAGE_SHARED memory model. Make a best-effort attempt to register memory model in both cases. Because memory model registration can fail and xp_release_deferred cannot, the XSK pool must be unregistered and DMA-unmapped regardless of whether memory model registration succeeds. In both cases, there should be a guarantee against the device DMA'ing into freed memory, however. Fixes: 077f7153fd25 ("gve: merge xdp and xsk registration") Cc: stable@vger.kernel.org Reviewed-by: Harshitha Ramamurthy Signed-off-by: Joshua Washington --- v2: - Newly introduced --- drivers/net/ethernet/google/gve/gve_main.c | 77 +++++++++----- drivers/net/ethernet/google/gve/gve_tx_dqo.c | 101 ++++++++++++++----- 2 files changed, 126 insertions(+), 52 deletions(-) diff --git a/drivers/net/ethernet/google/gve/gve_main.c b/drivers/net/ether= net/google/gve/gve_main.c index f2bd4011de23..787d311ff99b 100644 --- a/drivers/net/ethernet/google/gve/gve_main.c +++ b/drivers/net/ethernet/google/gve/gve_main.c @@ -1715,15 +1715,56 @@ static int gve_xsk_pool_enable(struct net_device *d= ev, return err; } =20 +static int gve_unreg_xsk_pool_live(struct gve_priv *priv, + struct net_device *dev, u16 qid) +{ + struct gve_rx_ring *rx; + int err; + + rx =3D &priv->rx[qid]; + gve_disable_xsk_napis(priv, qid); + + gve_unreg_xsk_pool(priv, qid); + if (gve_is_qpl(priv)) + err =3D xdp_rxq_info_reg_mem_model(&rx->xdp_rxq, + MEM_TYPE_PAGE_SHARED, + NULL); + else + err =3D xdp_rxq_info_reg_mem_model(&rx->xdp_rxq, + MEM_TYPE_PAGE_POOL, + rx->dqo.page_pool); + if (err) + netdev_warn(dev, + "Failed to register memory model after unregistering XSK pool"); + + smp_mb(); /* Make sure it is visible to the workers on datapath */ + + gve_enable_xsk_napis(priv, qid); + + return err; +} + +static int gve_restart_rings(struct gve_priv *priv) +{ + struct gve_tx_alloc_rings_cfg tx_alloc_cfg =3D {0}; + struct gve_rx_alloc_rings_cfg rx_alloc_cfg =3D {0}; + int err; + + gve_get_curr_alloc_cfgs(priv, &tx_alloc_cfg, &rx_alloc_cfg); + err =3D gve_queues_stop(priv); + if (err) + return err; + + err =3D gve_queues_start(priv, &tx_alloc_cfg, &rx_alloc_cfg); + return err; +} + static int gve_xsk_pool_disable(struct net_device *dev, u16 qid) { struct gve_priv *priv =3D netdev_priv(dev); - struct napi_struct *napi_rx; - struct napi_struct *napi_tx; struct xsk_buff_pool *pool; int err =3D 0; - int tx_qid; =20 if (qid >=3D priv->rx_cfg.num_queues) { err =3D -EINVAL; @@ -1735,31 +1776,11 @@ static int gve_xsk_pool_disable(struct net_device *= dev, if (!netif_running(dev) || !priv->tx_cfg.num_xdp_queues) goto unmap_and_return; =20 - /* Stop and start RDA queues to repost buffers. */ - if (!gve_is_qpl(priv) && priv->xdp_prog) { - err =3D gve_configure_rings_xdp(priv, priv->rx_cfg.num_queues); - if (err) - return err; - } - - napi_rx =3D &priv->ntfy_blocks[priv->rx[qid].ntfy_id].napi; - napi_disable_locked(napi_rx); /* make sure current rx poll is done */ - - tx_qid =3D gve_xdp_tx_queue_id(priv, qid); - napi_tx =3D &priv->ntfy_blocks[priv->tx[tx_qid].ntfy_id].napi; - napi_disable_locked(napi_tx); /* make sure current tx poll is done */ - - gve_unreg_xsk_pool(priv, qid); - smp_mb(); /* Make sure it is visible to the workers on datapath */ - - napi_enable_locked(napi_rx); - napi_enable_locked(napi_tx); - if (gve_is_gqi(priv)) { - if (gve_rx_work_pending(&priv->rx[qid])) - napi_schedule(napi_rx); - - if (gve_tx_clean_pending(priv, &priv->tx[tx_qid])) - napi_schedule(napi_tx); + if (gve_is_qpl(priv)) { + err =3D gve_unreg_xsk_pool_live(priv, dev, qid); + } else { + /* Stop and start RDA queues to repost buffers. */ + err =3D gve_restart_rings(priv); } =20 unmap_and_return: diff --git a/drivers/net/ethernet/google/gve/gve_tx_dqo.c b/drivers/net/eth= ernet/google/gve/gve_tx_dqo.c index 80ab0a449ff5..78f946ae7264 100644 --- a/drivers/net/ethernet/google/gve/gve_tx_dqo.c +++ b/drivers/net/ethernet/google/gve/gve_tx_dqo.c @@ -208,6 +208,78 @@ static void gve_tx_clean_pending_packets(struct gve_tx= _ring *tx) } } =20 +static void gve_tx_init_ring_state_dqo(struct gve_tx_ring *tx) +{ + int i; + + atomic_set_release(&tx->dqo_compl.hw_tx_head, 0); + + /* Set up linked list of pending packets */ + for (i =3D 0; i < tx->dqo.num_pending_packets - 1; i++) + tx->dqo.pending_packets[i].next =3D i + 1; + + tx->dqo.pending_packets[tx->dqo.num_pending_packets - 1].next =3D -1; + atomic_set_release(&tx->dqo_compl.free_pending_packets, -1); + + tx->dqo_compl.miss_completions.head =3D -1; + tx->dqo_compl.miss_completions.tail =3D -1; + tx->dqo_compl.timed_out_completions.head =3D -1; + tx->dqo_compl.timed_out_completions.tail =3D -1; + + /* Generate free TX buf list */ + if (tx->dqo.tx_qpl_buf_next) { + for (i =3D 0; i < tx->dqo.num_tx_qpl_bufs - 1; i++) + tx->dqo.tx_qpl_buf_next[i] =3D i + 1; + tx->dqo.tx_qpl_buf_next[tx->dqo.num_tx_qpl_bufs - 1] =3D -1; + + atomic_set_release(&tx->dqo_compl.free_tx_qpl_buf_head, -1); + atomic_set_release(&tx->dqo_compl.free_tx_qpl_buf_cnt, 0); + } +} + +static void gve_tx_reset_ring_dqo(struct gve_tx_ring *tx) +{ + size_t size; + + /* Reset dqo_tx fields. */ + tx->dqo_tx.head =3D 0; + tx->dqo_tx.tail =3D 0; + tx->dqo_tx.last_re_idx =3D 0; + tx->dqo_tx.posted_packet_desc_cnt =3D 0; + tx->dqo_tx.completed_packet_desc_cnt =3D 0; + tx->dqo_tx.free_pending_packets =3D 0; + + /* Reset dqo_compl fields. */ + tx->dqo_compl.head =3D 0; + tx->dqo_compl.cur_gen_bit =3D 0; + tx->dqo_compl.xsk_reorder_queue_head =3D 0; + tx->dqo_compl.xsk_reorder_queue_tail =3D 0; + + if (tx->dqo.xsk_reorder_queue) { + size =3D (tx->dqo.complq_mask + 1) * + sizeof(*tx->dqo.xsk_reorder_queue); + memset(tx->dqo.xsk_reorder_queue, 0, size); + atomic_set(&tx->dqo_tx.xsk_reorder_queue_tail, 0); + } + + size =3D sizeof(tx->dqo.tx_ring[0]) * (tx->mask + 1); + memset(tx->dqo.tx_ring, 0, size); + + size =3D sizeof(tx->dqo.compl_ring[0]) * (tx->dqo.complq_mask + 1); + memset(tx->dqo.compl_ring, 0, size); + + memset(tx->q_resources, 0, sizeof(*tx->q_resources)); + + if (tx->dqo.tx_qpl_buf_next) { + tx->dqo_tx.free_tx_qpl_buf_head =3D 0; + size =3D sizeof(tx->dqo.tx_qpl_buf_next[0]) * + tx->dqo.num_tx_qpl_bufs; + memset(tx->dqo.tx_qpl_buf_next, 0, size); + } + + gve_tx_init_ring_state_dqo(tx); +} + void gve_tx_stop_ring_dqo(struct gve_priv *priv, int idx) { int ntfy_idx =3D gve_tx_idx_to_ntfy(priv, idx); @@ -222,6 +294,7 @@ void gve_tx_stop_ring_dqo(struct gve_priv *priv, int id= x) netdev_tx_reset_queue(tx->netdev_txq); gve_tx_clean_pending_packets(tx); gve_tx_remove_from_block(priv, idx); + gve_tx_reset_ring_dqo(tx); } =20 static void gve_tx_free_ring_dqo(struct gve_priv *priv, struct gve_tx_ring= *tx, @@ -270,11 +343,10 @@ static void gve_tx_free_ring_dqo(struct gve_priv *pri= v, struct gve_tx_ring *tx, netif_dbg(priv, drv, priv->dev, "freed tx queue %d\n", idx); } =20 -static int gve_tx_qpl_buf_init(struct gve_tx_ring *tx) +static int gve_tx_qpl_buf_list_alloc(struct gve_tx_ring *tx) { int num_tx_qpl_bufs =3D GVE_TX_BUFS_PER_PAGE_DQO * tx->dqo.qpl->num_entries; - int i; =20 tx->dqo.tx_qpl_buf_next =3D kvzalloc_objs(tx->dqo.tx_qpl_buf_next[0], num_tx_qpl_bufs); @@ -282,13 +354,6 @@ static int gve_tx_qpl_buf_init(struct gve_tx_ring *tx) return -ENOMEM; =20 tx->dqo.num_tx_qpl_bufs =3D num_tx_qpl_bufs; - - /* Generate free TX buf list */ - for (i =3D 0; i < num_tx_qpl_bufs - 1; i++) - tx->dqo.tx_qpl_buf_next[i] =3D i + 1; - tx->dqo.tx_qpl_buf_next[num_tx_qpl_bufs - 1] =3D -1; - - atomic_set_release(&tx->dqo_compl.free_tx_qpl_buf_head, -1); return 0; } =20 @@ -304,6 +369,7 @@ void gve_tx_start_ring_dqo(struct gve_priv *priv, int i= dx) gve_add_napi(priv, ntfy_idx, gve_napi_poll_dqo); } =20 + static int gve_tx_alloc_ring_dqo(struct gve_priv *priv, struct gve_tx_alloc_rings_cfg *cfg, struct gve_tx_ring *tx, @@ -313,13 +379,11 @@ static int gve_tx_alloc_ring_dqo(struct gve_priv *pri= v, int num_pending_packets; size_t bytes; u32 qpl_id; - int i; =20 memset(tx, 0, sizeof(*tx)); tx->q_num =3D idx; tx->dev =3D hdev; spin_lock_init(&tx->dqo_tx.xdp_lock); - atomic_set_release(&tx->dqo_compl.hw_tx_head, 0); =20 /* Queue sizes must be a power of 2 */ tx->mask =3D cfg->ring_size - 1; @@ -350,13 +414,6 @@ static int gve_tx_alloc_ring_dqo(struct gve_priv *priv, if (!tx->dqo.pending_packets) goto err; =20 - /* Set up linked list of pending packets */ - for (i =3D 0; i < tx->dqo.num_pending_packets - 1; i++) - tx->dqo.pending_packets[i].next =3D i + 1; - - tx->dqo.pending_packets[tx->dqo.num_pending_packets - 1].next =3D -1; - atomic_set_release(&tx->dqo_compl.free_pending_packets, -1); - /* Only alloc xsk pool for XDP queues */ if (idx >=3D cfg->qcfg->num_queues && cfg->num_xdp_rings) { tx->dqo.xsk_reorder_queue =3D @@ -367,11 +424,6 @@ static int gve_tx_alloc_ring_dqo(struct gve_priv *priv, goto err; } =20 - tx->dqo_compl.miss_completions.head =3D -1; - tx->dqo_compl.miss_completions.tail =3D -1; - tx->dqo_compl.timed_out_completions.head =3D -1; - tx->dqo_compl.timed_out_completions.tail =3D -1; - bytes =3D sizeof(tx->dqo.tx_ring[0]) * (tx->mask + 1); tx->dqo.tx_ring =3D dma_alloc_coherent(hdev, bytes, &tx->bus, GFP_KERNEL); if (!tx->dqo.tx_ring) @@ -397,10 +449,11 @@ static int gve_tx_alloc_ring_dqo(struct gve_priv *pri= v, if (!tx->dqo.qpl) goto err; =20 - if (gve_tx_qpl_buf_init(tx)) + if (gve_tx_qpl_buf_list_alloc(tx)) goto err; } =20 + gve_tx_init_ring_state_dqo(tx); return 0; =20 err: --=20 2.55.0.1082.g2b9226bbc0-goog From nobody Thu Sep 24 15:10:14 2026 Received: from mail-pl1-f198.google.com (mail-pl1-f198.google.com [209.85.214.198]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7AE5F4A4EF4 for ; Tue, 22 Sep 2026 19:45:57 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.198 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790106366; cv=none; b=Y4tmXO+WqgU//2WSdHO0ZIBYLmPQfcr9ihSfp/z6cxzAQqoFrciZcPWAu1zweNp3EYsoQpE1ZyCEV9pK9bx6nDtOEOYz1qGHtflCnUvSguhlBrUNZPICfL2GW8jxWedn7Jd8aWd72rVTiXmeZzff7kaWyCy+q/KJCyZBLOUCY0c= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790106366; c=relaxed/simple; bh=ecSyTfJPz96M1UC/DhEKoRu2pGbe4F6v4SIrDUuNNkg=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=doO+/aiivAUSWPJkIf/46l5kGl5f9ERo8FhiRnFTcXWVsqXIdm6/MHLfANWBLsblXMO5JV//ONN78XQeXkfNw3fUnA/s28GX2LcQo54Q5XiscC2d3avzgmZ7x4IUePXOzKdNoSoWuELOkrOWKztqzoMDFBhYjo8NO3I/+252y+8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--joshwash.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=ejvYmY18; arc=none smtp.client-ip=209.85.214.198 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--joshwash.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="ejvYmY18" Received: by mail-pl1-f198.google.com with SMTP id d9443c01a7336-2d94a158dc8so2760905ad.2 for ; Tue, 22 Sep 2026 12:45:57 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1790106355; x=1790711155; darn=vger.kernel.org; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:from:to:cc:subject:date:message-id:reply-to :content-type; bh=R0lSci6HT5gQeGkphetiqsMSe/tz0UwH39MUVuL7NZk=; b=ejvYmY18PQ1hH6dgBLjaV/k5vnyyz7ieNeRVlq0Hnuy8SGUc9LHFSS+s+yBI80R/wD m4iGey8h++uGkdUxZU3KsmvJfg0G1//1u2TmdutdVhsj1of09ebdz3GM4O+jUrWArUm4 jGI5h+9QSB5whgLd2ydiTZO5OuL2sIZ+qDJxJfUN0BjKuFFFdPjG5MBhOzJSbHVf7BiH AhV1j5kTL6wVHbSrrbqR85gGPGGDT8PXgRaWeInNaGmLy0WaUeDDMZwPvEMLRBiHZ/P7 oQagtbvAwkUpdzQnrltCd5ZL6AxuXLGRzKafqIaqP4Y7RyjX6ilf2qzIEgWXKl/d0I5+ hMKA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1790106355; x=1790711155; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=R0lSci6HT5gQeGkphetiqsMSe/tz0UwH39MUVuL7NZk=; b=IDf2SQiWnl5/GzZD0npNH6iaoDMJulm6cuxUC690oKj6HvnTbtSMstt99SZbjIL3yW TflFzgNDFipa+H3KCoTBY7hZod9AdNIZ/iPQfFGAmbTL8dkEBVJgMTt14nAmwttZZKIN dXBHKCYoVV4cv8F0FcU2ACA1vcFzrw04vElIbGlGtaFd8XqxGeEsRLOcQ2d7PzlGDJOq EW5hipsjW/Iuba1Taphj4kDV2Wd7YfMb708AWE0vo88LUpNBNK455/xMUlTKdf0csut9 FQkag45lb/bn5CwsoXqT9oHolm79siF7/BzA5StGgIe1N+vWeoa0sPr6pYABM8ZWrdoJ jGRQ== X-Forwarded-Encrypted: i=1; AKwUvBz+E1Bcy3mis0BcFwu0nr8bs06y7FT0jicFG3HQ0d+n+3WW4eq0aC3ad2WzBoZlv+ZnDIrqxhGcb1Nvems=@vger.kernel.org X-Gm-Message-State: AFuF++njSEIS/rk2z823yoDN4QUbRbFk5ZNImGUx+Q5g9OAiB3MTqVKz B5Jbyy39zOUwHTnEvqnSyZffu9yDgB9xPir3x7t2eDZaZeGsLSyQZEVxI975xrUblwRQi1EocZU KRB8FDRMei2zOyw== X-Received: from plcy11.prod.google.com ([2002:a17:903:10b:b0:2df:638e:e034]) (user=joshwash job=prod-delivery.src-stubby-dispatcher) by 2002:a17:902:e548:b0:2dd:c053:9c73 with SMTP id d9443c01a7336-2df69dea44bmr3666085ad.41.1790106354635; Tue, 22 Sep 2026 12:45:54 -0700 (PDT) Date: Tue, 22 Sep 2026 12:45:33 -0700 In-Reply-To: <20260922194533.631387-1-joshwash@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20260922194533.631387-1-joshwash@google.com> X-Mailer: git-send-email 2.55.0.1082.g2b9226bbc0-goog Message-ID: <20260922194533.631387-10-joshwash@google.com> Subject: [PATCH net v2 9/9] gve: prevent XDP frame leak and corruption during DQO TX cleanup From: Joshua Washington To: netdev@vger.kernel.org Cc: Joshua Washington , Harshitha Ramamurthy , Andrew Lunn , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Alexei Starovoitov , Daniel Borkmann , Jesper Dangaard Brouer , John Fastabend , Stanislav Fomichev , Jordan Rhee , Willem de Bruijn , Tim Hostetler , Ankit Garg , Eddie Phillips , Praveen Kaligineedi , Jeroen de Borst , linux-kernel@vger.kernel.org, bpf@vger.kernel.org, stable@vger.kernel.org Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Eddie Phillips When tearing down a DQO TX ring or processing miss completions, pending packets were assumed to be SKBs. If an XDP frame was pending during cleanup or timeout, cur_state->skb was accessed on an xdpf union pointer or the XDP frame was leaked without calling xdp_return_frame(). Refactor gve_tx_clean_pending_packets(), gve_handle_miss_completion(), and remove_miss_completions() to switch on pending_packet->type. Fixes: d8a8ca14c937 ("gve: add XDP_TX and XDP_REDIRECT support for DQ RDA") Cc: stable@vger.kernel.org Signed-off-by: Eddie Phillips Signed-off-by: Joshua Washington --- v2: - Newly introduced. --- drivers/net/ethernet/google/gve/gve_tx_dqo.c | 155 +++++++++++++------ 1 file changed, 104 insertions(+), 51 deletions(-) diff --git a/drivers/net/ethernet/google/gve/gve_tx_dqo.c b/drivers/net/eth= ernet/google/gve/gve_tx_dqo.c index 78f946ae7264..e8481b993beb 100644 --- a/drivers/net/ethernet/google/gve/gve_tx_dqo.c +++ b/drivers/net/ethernet/google/gve/gve_tx_dqo.c @@ -186,6 +186,49 @@ static void gve_unmap_packet(struct device *dev, pkt->num_bufs =3D 0; } =20 +static struct gve_tx_pending_packet_dqo * +gve_xsk_reorder_queue_head(struct gve_tx_ring *tx) +{ + u32 head =3D tx->dqo_compl.xsk_reorder_queue_head; + + if (head =3D=3D tx->dqo_compl.xsk_reorder_queue_tail) { + tx->dqo_compl.xsk_reorder_queue_tail =3D + atomic_read_acquire(&tx->dqo_tx.xsk_reorder_queue_tail); + + if (head =3D=3D tx->dqo_compl.xsk_reorder_queue_tail) + return NULL; + } + + return &tx->dqo.pending_packets[tx->dqo.xsk_reorder_queue[head]]; +} + +static void gve_xsk_reorder_queue_pop_dqo(struct gve_tx_ring *tx) +{ + tx->dqo_compl.xsk_reorder_queue_head++; + tx->dqo_compl.xsk_reorder_queue_head &=3D tx->dqo.complq_mask; +} + +static void gve_tx_process_xsk_completions(struct gve_tx_ring *tx) +{ + u32 num_xsks =3D 0; + + while (true) { + struct gve_tx_pending_packet_dqo *pending_packet =3D + gve_xsk_reorder_queue_head(tx); + + if (!pending_packet || + pending_packet->state !=3D GVE_PACKET_STATE_XSK_COMPLETE) + break; + + num_xsks++; + gve_xsk_reorder_queue_pop_dqo(tx); + gve_free_pending_packet(tx, pending_packet); + } + + if (num_xsks) + xsk_tx_completed(tx->xsk_pool, num_xsks); +} + /* gve_tx_free_desc - Cleans up all pending tx requests and buffers. */ static void gve_tx_clean_pending_packets(struct gve_tx_ring *tx) @@ -201,11 +244,30 @@ static void gve_tx_clean_pending_packets(struct gve_t= x_ring *tx) else gve_unmap_packet(tx->dev, cur_state); =20 - if (cur_state->skb) { - dev_consume_skb_any(cur_state->skb); - cur_state->skb =3D NULL; + switch (cur_state->type) { + case GVE_TX_PENDING_PACKET_DQO_SKB: + if (cur_state->skb) { + dev_consume_skb_any(cur_state->skb); + cur_state->skb =3D NULL; + } + break; + case GVE_TX_PENDING_PACKET_DQO_XDP_FRAME: + if (cur_state->xdpf) { + xdp_return_frame(cur_state->xdpf); + cur_state->xdpf =3D NULL; + } + break; + case GVE_TX_PENDING_PACKET_DQO_XSK: + cur_state->state =3D GVE_PACKET_STATE_XSK_COMPLETE; + break; + default: + WARN_ON_ONCE(1); + break; } } + + if (tx->xsk_pool) + gve_tx_process_xsk_completions(tx); } =20 static void gve_tx_init_ring_state_dqo(struct gve_tx_ring *tx) @@ -1089,28 +1151,6 @@ static void gve_xsk_reorder_queue_push_dqo(struct gv= e_tx_ring *tx, atomic_set_release(&tx->dqo_tx.xsk_reorder_queue_tail, tail); } =20 -static struct gve_tx_pending_packet_dqo * -gve_xsk_reorder_queue_head(struct gve_tx_ring *tx) -{ - u32 head =3D tx->dqo_compl.xsk_reorder_queue_head; - - if (head =3D=3D tx->dqo_compl.xsk_reorder_queue_tail) { - tx->dqo_compl.xsk_reorder_queue_tail =3D - atomic_read_acquire(&tx->dqo_tx.xsk_reorder_queue_tail); - - if (head =3D=3D tx->dqo_compl.xsk_reorder_queue_tail) - return NULL; - } - - return &tx->dqo.pending_packets[tx->dqo.xsk_reorder_queue[head]]; -} - -static void gve_xsk_reorder_queue_pop_dqo(struct gve_tx_ring *tx) -{ - tx->dqo_compl.xsk_reorder_queue_head++; - tx->dqo_compl.xsk_reorder_queue_head &=3D tx->dqo.complq_mask; -} - /* Transmit a given skb and ring the doorbell. */ netdev_tx_t gve_tx_dqo(struct sk_buff *skb, struct net_device *dev) { @@ -1347,8 +1387,25 @@ static void gve_handle_miss_completion(struct gve_pr= iv *priv, secs_to_jiffies(GVE_REINJECT_COMPL_TIMEOUT); add_to_list(tx, &tx->dqo_compl.miss_completions, pending_packet); =20 - *bytes +=3D pending_packet->skb->len; - (*pkts)++; + switch (pending_packet->type) { + case GVE_TX_PENDING_PACKET_DQO_SKB: + if (pending_packet->skb) { + *bytes +=3D pending_packet->skb->len; + (*pkts)++; + } + break; + case GVE_TX_PENDING_PACKET_DQO_XDP_FRAME: + if (pending_packet->xdpf) { + *bytes +=3D pending_packet->xdpf->len; + (*pkts)++; + } + break; + case GVE_TX_PENDING_PACKET_DQO_XSK: + break; + default: + WARN_ON_ONCE(1); + break; + } } =20 static void remove_miss_completions(struct gve_priv *priv, @@ -1377,9 +1434,26 @@ static void remove_miss_completions(struct gve_priv = *priv, else gve_unmap_packet(tx->dev, pending_packet); =20 - /* This indicates the packet was dropped. */ - dev_kfree_skb_any(pending_packet->skb); - pending_packet->skb =3D NULL; + switch (pending_packet->type) { + case GVE_TX_PENDING_PACKET_DQO_SKB: + if (pending_packet->skb) { + /* This indicates the packet was dropped. */ + dev_kfree_skb_any(pending_packet->skb); + pending_packet->skb =3D NULL; + } + break; + case GVE_TX_PENDING_PACKET_DQO_XDP_FRAME: + if (pending_packet->xdpf) { + xdp_return_frame(pending_packet->xdpf); + pending_packet->xdpf =3D NULL; + } + break; + case GVE_TX_PENDING_PACKET_DQO_XSK: + break; + default: + WARN_ON_ONCE(1); + break; + } =20 u64_stats_update_begin(&tx->statss); tx->dropped_pkt++; @@ -1426,27 +1500,6 @@ static void remove_timed_out_completions(struct gve_= priv *priv, } } =20 -static void gve_tx_process_xsk_completions(struct gve_tx_ring *tx) -{ - u32 num_xsks =3D 0; - - while (true) { - struct gve_tx_pending_packet_dqo *pending_packet =3D - gve_xsk_reorder_queue_head(tx); - - if (!pending_packet || - pending_packet->state !=3D GVE_PACKET_STATE_XSK_COMPLETE) - break; - - num_xsks++; - gve_xsk_reorder_queue_pop_dqo(tx); - gve_free_pending_packet(tx, pending_packet); - } - - if (num_xsks) - xsk_tx_completed(tx->xsk_pool, num_xsks); -} - int gve_clean_tx_done_dqo(struct gve_priv *priv, struct gve_tx_ring *tx, struct napi_struct *napi) { --=20 2.55.0.1082.g2b9226bbc0-goog