* Re: [PATCH net] veth: manage XDP program pointers during channel resize
2026-09-17 15:39 [PATCH net] veth: manage XDP program pointers during channel resize Weiming Shi
@ 2026-09-21 12:45 ` Simon Horman
2026-09-21 15:23 ` Jason Xing
2026-09-21 22:41 ` Jakub Kicinski
2 siblings, 0 replies; 6+ messages in thread
From: Simon Horman @ 2026-09-21 12:45 UTC (permalink / raw)
To: Weiming Shi
Cc: Andrew Lunn, David S. Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, Alexei Starovoitov, Daniel Borkmann,
Jesper Dangaard Brouer, John Fastabend, Stanislav Fomichev,
netdev, linux-kernel, bpf, co+65e5c76b187f08b2, Xiang Mei,
stable
On Thu, Sep 17, 2026 at 11:39:25PM +0800, Weiming Shi wrote:
> veth_set_channels() tears down XDP resources for removed RX queues
> without clearing rq->xdp_prog. If the program is then detached or
> replaced, those queues keep the old pointer after bpf_prog_put(). A
> later channel increase can re-enable NAPI and run the freed program.
>
> Clear the program pointer after taking an RX queue offline, and publish
> the current program only after bringing the queue back online succeeds.
>
> BUG: unable to handle page fault for address: ffffc90000256048
> Oops: Oops: 0000 [#1] SMP KASAN NOPTI
> RIP: veth_xdp_rcv_skb (include/linux/filter.h:779
> include/net/xdp.h:696 drivers/net/veth.c:820)
> Call Trace:
> veth_xdp_rcv (drivers/net/veth.c:941)
> veth_poll (drivers/net/veth.c:986)
> __napi_poll (net/core/dev.c:7787)
> net_rx_action (net/core/dev.c:7850 net/core/dev.c:8007)
> handle_softirqs (kernel/softirq.c:645)
> Kernel panic - not syncing: Fatal exception in interrupt
>
> Cc: stable@vger.kernel.org
> Fixes: 4752eeb3d891 ("veth: implement support for set_channel ethtool op")
> Reported-by: <co+65e5c76b187f08b2@bugs.sh>
> Assisted-by: LLM
> Signed-off-by: Weiming Shi <bestswngs@gmail.com>
Reviewed-by: Simon Horman <horms@kernel.org>
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [PATCH net] veth: manage XDP program pointers during channel resize
2026-09-17 15:39 [PATCH net] veth: manage XDP program pointers during channel resize Weiming Shi
2026-09-21 12:45 ` Simon Horman
@ 2026-09-21 15:23 ` Jason Xing
2026-09-21 22:41 ` Jakub Kicinski
2 siblings, 0 replies; 6+ messages in thread
From: Jason Xing @ 2026-09-21 15:23 UTC (permalink / raw)
To: Weiming Shi
Cc: Andrew Lunn, David S. Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, Alexei Starovoitov, Daniel Borkmann,
Jesper Dangaard Brouer, John Fastabend, Stanislav Fomichev,
netdev, linux-kernel, bpf, co+65e5c76b187f08b2, Xiang Mei,
stable
On Fri, Sep 18, 2026 at 2:50 AM Weiming Shi <bestswngs@gmail.com> wrote:
>
> veth_set_channels() tears down XDP resources for removed RX queues
> without clearing rq->xdp_prog. If the program is then detached or
> replaced, those queues keep the old pointer after bpf_prog_put(). A
> later channel increase can re-enable NAPI and run the freed program.
>
> Clear the program pointer after taking an RX queue offline, and publish
> the current program only after bringing the queue back online succeeds.
>
> BUG: unable to handle page fault for address: ffffc90000256048
> Oops: Oops: 0000 [#1] SMP KASAN NOPTI
> RIP: veth_xdp_rcv_skb (include/linux/filter.h:779
> include/net/xdp.h:696 drivers/net/veth.c:820)
> Call Trace:
> veth_xdp_rcv (drivers/net/veth.c:941)
> veth_poll (drivers/net/veth.c:986)
> __napi_poll (net/core/dev.c:7787)
> net_rx_action (net/core/dev.c:7850 net/core/dev.c:8007)
> handle_softirqs (kernel/softirq.c:645)
> Kernel panic - not syncing: Fatal exception in interrupt
>
> Cc: stable@vger.kernel.org
> Fixes: 4752eeb3d891 ("veth: implement support for set_channel ethtool op")
> Reported-by: <co+65e5c76b187f08b2@bugs.sh>
> Assisted-by: LLM
> Signed-off-by: Weiming Shi <bestswngs@gmail.com>
Reviewed-by: Jason Xing <kerneljasonxing@gmail.com>
Thanks!
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [PATCH net] veth: manage XDP program pointers during channel resize
2026-09-17 15:39 [PATCH net] veth: manage XDP program pointers during channel resize Weiming Shi
2026-09-21 12:45 ` Simon Horman
2026-09-21 15:23 ` Jason Xing
@ 2026-09-21 22:41 ` Jakub Kicinski
2026-09-21 22:58 ` Jakub Kicinski
2 siblings, 1 reply; 6+ messages in thread
From: Jakub Kicinski @ 2026-09-21 22:41 UTC (permalink / raw)
To: Weiming Shi
Cc: Andrew Lunn, David S. Miller, Eric Dumazet, Paolo Abeni,
Alexei Starovoitov, Daniel Borkmann, Jesper Dangaard Brouer,
John Fastabend, Stanislav Fomichev, netdev, linux-kernel, bpf,
co+65e5c76b187f08b2, Xiang Mei, stable
On Thu, 17 Sep 2026 23:39:25 +0800 Weiming Shi wrote:
> veth_set_channels() tears down XDP resources for removed RX queues
> without clearing rq->xdp_prog. If the program is then detached or
> replaced, those queues keep the old pointer after bpf_prog_put(). A
> later channel increase can re-enable NAPI and run the freed program.
>
> Clear the program pointer after taking an RX queue offline, and publish
> the current program only after bringing the queue back online succeeds.
>
> BUG: unable to handle page fault for address: ffffc90000256048
> Oops: Oops: 0000 [#1] SMP KASAN NOPTI
> RIP: veth_xdp_rcv_skb (include/linux/filter.h:779
> include/net/xdp.h:696 drivers/net/veth.c:820)
> Call Trace:
> veth_xdp_rcv (drivers/net/veth.c:941)
> veth_poll (drivers/net/veth.c:986)
> __napi_poll (net/core/dev.c:7787)
> net_rx_action (net/core/dev.c:7850 net/core/dev.c:8007)
> handle_softirqs (kernel/softirq.c:645)
> Kernel panic - not syncing: Fatal exception in interrupt
>
> Cc: stable@vger.kernel.org
> Fixes: 4752eeb3d891 ("veth: implement support for set_channel ethtool op")
> Reported-by: <co+65e5c76b187f08b2@bugs.sh>
> Assisted-by: LLM
> Signed-off-by: Weiming Shi <bestswngs@gmail.com>
> ---
> drivers/net/veth.c | 8 +++++++-
> 1 file changed, 7 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/net/veth.c b/drivers/net/veth.c
> index 6ed3ee81153fb..ef7624bc2c0ec 100644
> --- a/drivers/net/veth.c
> +++ b/drivers/net/veth.c
> @@ -1247,12 +1247,15 @@ static int veth_napi_enable(struct net_device *dev)
> static void veth_disable_range_safe(struct net_device *dev, int start, int end)
> {
> struct veth_priv *priv = netdev_priv(dev);
> + int i;
>
> if (start >= end)
> return;
>
> if (priv->_xdp_prog) {
> veth_napi_del_range(dev, start, end);
> + for (i = start; i < end; i++)
> + rcu_assign_pointer(priv->rq[i].xdp_prog, NULL);
> veth_disable_xdp_range(dev, start, end, false);
> } else if (veth_gro_requested(dev)) {
> veth_napi_del_range(dev, start, end);
> @@ -1262,7 +1265,7 @@ static void veth_disable_range_safe(struct net_device *dev, int start, int end)
> static int veth_enable_range_safe(struct net_device *dev, int start, int end)
> {
> struct veth_priv *priv = netdev_priv(dev);
> - int err;
> + int err, i;
>
> if (start >= end)
> return 0;
> @@ -1281,6 +1284,9 @@ static int veth_enable_range_safe(struct net_device *dev, int start, int end)
> veth_disable_xdp_range(dev, start, end, true);
> return err;
> }
> + for (i = start; i < end; i++)
> + rcu_assign_pointer(priv->rq[i].xdp_prog,
> + priv->_xdp_prog);
> } else if (veth_gro_requested(dev)) {
> return veth_napi_enable_range(dev, start, end);
> }
This is pure slop, cramming loops into functions which have none.
Shameful, really.
Please test this and submit it if it passes the tests:
diff --git a/drivers/net/veth.c b/drivers/net/veth.c
index 6ed3ee81153f..5d5e8ebce65a 100644
--- a/drivers/net/veth.c
+++ b/drivers/net/veth.c
@@ -1054,6 +1054,8 @@ static int __veth_napi_enable_range(struct net_device *dev, int start, int end)
for (i = start; i < end; i++) {
struct veth_rq *rq = &priv->rq[i];
+ if (priv->_xdp_prog)
+ rcu_assign_pointer(rq->xdp_prog, priv->_xdp_prog);
napi_enable(&rq->xdp_napi);
rcu_assign_pointer(priv->rq[i].napi, &priv->rq[i].xdp_napi);
}
@@ -1088,6 +1090,7 @@ static void veth_napi_del_range(struct net_device *dev, int start, int end)
rcu_assign_pointer(priv->rq[i].napi, NULL);
napi_disable(&rq->xdp_napi);
+ rcu_assign_pointer(rq->xdp_prog, NULL);
__netif_napi_del(&rq->xdp_napi);
}
synchronize_net();
^ permalink raw reply [flat|nested] 6+ messages in thread