* [PATCH net] veth: manage XDP program pointers during channel resize
@ 2026-09-17 15:39 Weiming Shi
2026-09-21 12:45 ` Simon Horman
` (2 more replies)
0 siblings, 3 replies; 6+ messages in thread
From: Weiming Shi @ 2026-09-17 15:39 UTC (permalink / raw)
To: Andrew Lunn, David S. Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, Alexei Starovoitov, Daniel Borkmann,
Jesper Dangaard Brouer, John Fastabend, Stanislav Fomichev
Cc: netdev, linux-kernel, bpf, co+65e5c76b187f08b2, Xiang Mei,
Weiming Shi, stable
veth_set_channels() tears down XDP resources for removed RX queues
without clearing rq->xdp_prog. If the program is then detached or
replaced, those queues keep the old pointer after bpf_prog_put(). A
later channel increase can re-enable NAPI and run the freed program.
Clear the program pointer after taking an RX queue offline, and publish
the current program only after bringing the queue back online succeeds.
BUG: unable to handle page fault for address: ffffc90000256048
Oops: Oops: 0000 [#1] SMP KASAN NOPTI
RIP: veth_xdp_rcv_skb (include/linux/filter.h:779
include/net/xdp.h:696 drivers/net/veth.c:820)
Call Trace:
veth_xdp_rcv (drivers/net/veth.c:941)
veth_poll (drivers/net/veth.c:986)
__napi_poll (net/core/dev.c:7787)
net_rx_action (net/core/dev.c:7850 net/core/dev.c:8007)
handle_softirqs (kernel/softirq.c:645)
Kernel panic - not syncing: Fatal exception in interrupt
Cc: stable@vger.kernel.org
Fixes: 4752eeb3d891 ("veth: implement support for set_channel ethtool op")
Reported-by: <co+65e5c76b187f08b2@bugs.sh>
Assisted-by: LLM
Signed-off-by: Weiming Shi <bestswngs@gmail.com>
---
drivers/net/veth.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/drivers/net/veth.c b/drivers/net/veth.c
index 6ed3ee81153fb..ef7624bc2c0ec 100644
--- a/drivers/net/veth.c
+++ b/drivers/net/veth.c
@@ -1247,12 +1247,15 @@ static int veth_napi_enable(struct net_device *dev)
static void veth_disable_range_safe(struct net_device *dev, int start, int end)
{
struct veth_priv *priv = netdev_priv(dev);
+ int i;
if (start >= end)
return;
if (priv->_xdp_prog) {
veth_napi_del_range(dev, start, end);
+ for (i = start; i < end; i++)
+ rcu_assign_pointer(priv->rq[i].xdp_prog, NULL);
veth_disable_xdp_range(dev, start, end, false);
} else if (veth_gro_requested(dev)) {
veth_napi_del_range(dev, start, end);
@@ -1262,7 +1265,7 @@ static void veth_disable_range_safe(struct net_device *dev, int start, int end)
static int veth_enable_range_safe(struct net_device *dev, int start, int end)
{
struct veth_priv *priv = netdev_priv(dev);
- int err;
+ int err, i;
if (start >= end)
return 0;
@@ -1281,6 +1284,9 @@ static int veth_enable_range_safe(struct net_device *dev, int start, int end)
veth_disable_xdp_range(dev, start, end, true);
return err;
}
+ for (i = start; i < end; i++)
+ rcu_assign_pointer(priv->rq[i].xdp_prog,
+ priv->_xdp_prog);
} else if (veth_gro_requested(dev)) {
return veth_napi_enable_range(dev, start, end);
}
--
2.55.0
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH net] veth: manage XDP program pointers during channel resize
2026-09-17 15:39 [PATCH net] veth: manage XDP program pointers during channel resize Weiming Shi
@ 2026-09-21 12:45 ` Simon Horman
2026-09-21 15:23 ` Jason Xing
2026-09-21 22:41 ` Jakub Kicinski
2 siblings, 0 replies; 6+ messages in thread
From: Simon Horman @ 2026-09-21 12:45 UTC (permalink / raw)
To: Weiming Shi
Cc: Andrew Lunn, David S. Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, Alexei Starovoitov, Daniel Borkmann,
Jesper Dangaard Brouer, John Fastabend, Stanislav Fomichev,
netdev, linux-kernel, bpf, co+65e5c76b187f08b2, Xiang Mei,
stable
On Thu, Sep 17, 2026 at 11:39:25PM +0800, Weiming Shi wrote:
> veth_set_channels() tears down XDP resources for removed RX queues
> without clearing rq->xdp_prog. If the program is then detached or
> replaced, those queues keep the old pointer after bpf_prog_put(). A
> later channel increase can re-enable NAPI and run the freed program.
>
> Clear the program pointer after taking an RX queue offline, and publish
> the current program only after bringing the queue back online succeeds.
>
> BUG: unable to handle page fault for address: ffffc90000256048
> Oops: Oops: 0000 [#1] SMP KASAN NOPTI
> RIP: veth_xdp_rcv_skb (include/linux/filter.h:779
> include/net/xdp.h:696 drivers/net/veth.c:820)
> Call Trace:
> veth_xdp_rcv (drivers/net/veth.c:941)
> veth_poll (drivers/net/veth.c:986)
> __napi_poll (net/core/dev.c:7787)
> net_rx_action (net/core/dev.c:7850 net/core/dev.c:8007)
> handle_softirqs (kernel/softirq.c:645)
> Kernel panic - not syncing: Fatal exception in interrupt
>
> Cc: stable@vger.kernel.org
> Fixes: 4752eeb3d891 ("veth: implement support for set_channel ethtool op")
> Reported-by: <co+65e5c76b187f08b2@bugs.sh>
> Assisted-by: LLM
> Signed-off-by: Weiming Shi <bestswngs@gmail.com>
Reviewed-by: Simon Horman <horms@kernel.org>
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH net] veth: manage XDP program pointers during channel resize
2026-09-17 15:39 [PATCH net] veth: manage XDP program pointers during channel resize Weiming Shi
2026-09-21 12:45 ` Simon Horman
@ 2026-09-21 15:23 ` Jason Xing
2026-09-21 22:41 ` Jakub Kicinski
2 siblings, 0 replies; 6+ messages in thread
From: Jason Xing @ 2026-09-21 15:23 UTC (permalink / raw)
To: Weiming Shi
Cc: Andrew Lunn, David S. Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, Alexei Starovoitov, Daniel Borkmann,
Jesper Dangaard Brouer, John Fastabend, Stanislav Fomichev,
netdev, linux-kernel, bpf, co+65e5c76b187f08b2, Xiang Mei,
stable
On Fri, Sep 18, 2026 at 2:50 AM Weiming Shi <bestswngs@gmail.com> wrote:
>
> veth_set_channels() tears down XDP resources for removed RX queues
> without clearing rq->xdp_prog. If the program is then detached or
> replaced, those queues keep the old pointer after bpf_prog_put(). A
> later channel increase can re-enable NAPI and run the freed program.
>
> Clear the program pointer after taking an RX queue offline, and publish
> the current program only after bringing the queue back online succeeds.
>
> BUG: unable to handle page fault for address: ffffc90000256048
> Oops: Oops: 0000 [#1] SMP KASAN NOPTI
> RIP: veth_xdp_rcv_skb (include/linux/filter.h:779
> include/net/xdp.h:696 drivers/net/veth.c:820)
> Call Trace:
> veth_xdp_rcv (drivers/net/veth.c:941)
> veth_poll (drivers/net/veth.c:986)
> __napi_poll (net/core/dev.c:7787)
> net_rx_action (net/core/dev.c:7850 net/core/dev.c:8007)
> handle_softirqs (kernel/softirq.c:645)
> Kernel panic - not syncing: Fatal exception in interrupt
>
> Cc: stable@vger.kernel.org
> Fixes: 4752eeb3d891 ("veth: implement support for set_channel ethtool op")
> Reported-by: <co+65e5c76b187f08b2@bugs.sh>
> Assisted-by: LLM
> Signed-off-by: Weiming Shi <bestswngs@gmail.com>
Reviewed-by: Jason Xing <kerneljasonxing@gmail.com>
Thanks!
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH net] veth: manage XDP program pointers during channel resize
2026-09-17 15:39 [PATCH net] veth: manage XDP program pointers during channel resize Weiming Shi
2026-09-21 12:45 ` Simon Horman
2026-09-21 15:23 ` Jason Xing
@ 2026-09-21 22:41 ` Jakub Kicinski
2026-09-21 22:58 ` Jakub Kicinski
2 siblings, 1 reply; 6+ messages in thread
From: Jakub Kicinski @ 2026-09-21 22:41 UTC (permalink / raw)
To: Weiming Shi
Cc: Andrew Lunn, David S. Miller, Eric Dumazet, Paolo Abeni,
Alexei Starovoitov, Daniel Borkmann, Jesper Dangaard Brouer,
John Fastabend, Stanislav Fomichev, netdev, linux-kernel, bpf,
co+65e5c76b187f08b2, Xiang Mei, stable
On Thu, 17 Sep 2026 23:39:25 +0800 Weiming Shi wrote:
> veth_set_channels() tears down XDP resources for removed RX queues
> without clearing rq->xdp_prog. If the program is then detached or
> replaced, those queues keep the old pointer after bpf_prog_put(). A
> later channel increase can re-enable NAPI and run the freed program.
>
> Clear the program pointer after taking an RX queue offline, and publish
> the current program only after bringing the queue back online succeeds.
>
> BUG: unable to handle page fault for address: ffffc90000256048
> Oops: Oops: 0000 [#1] SMP KASAN NOPTI
> RIP: veth_xdp_rcv_skb (include/linux/filter.h:779
> include/net/xdp.h:696 drivers/net/veth.c:820)
> Call Trace:
> veth_xdp_rcv (drivers/net/veth.c:941)
> veth_poll (drivers/net/veth.c:986)
> __napi_poll (net/core/dev.c:7787)
> net_rx_action (net/core/dev.c:7850 net/core/dev.c:8007)
> handle_softirqs (kernel/softirq.c:645)
> Kernel panic - not syncing: Fatal exception in interrupt
>
> Cc: stable@vger.kernel.org
> Fixes: 4752eeb3d891 ("veth: implement support for set_channel ethtool op")
> Reported-by: <co+65e5c76b187f08b2@bugs.sh>
> Assisted-by: LLM
> Signed-off-by: Weiming Shi <bestswngs@gmail.com>
> ---
> drivers/net/veth.c | 8 +++++++-
> 1 file changed, 7 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/net/veth.c b/drivers/net/veth.c
> index 6ed3ee81153fb..ef7624bc2c0ec 100644
> --- a/drivers/net/veth.c
> +++ b/drivers/net/veth.c
> @@ -1247,12 +1247,15 @@ static int veth_napi_enable(struct net_device *dev)
> static void veth_disable_range_safe(struct net_device *dev, int start, int end)
> {
> struct veth_priv *priv = netdev_priv(dev);
> + int i;
>
> if (start >= end)
> return;
>
> if (priv->_xdp_prog) {
> veth_napi_del_range(dev, start, end);
> + for (i = start; i < end; i++)
> + rcu_assign_pointer(priv->rq[i].xdp_prog, NULL);
> veth_disable_xdp_range(dev, start, end, false);
> } else if (veth_gro_requested(dev)) {
> veth_napi_del_range(dev, start, end);
> @@ -1262,7 +1265,7 @@ static void veth_disable_range_safe(struct net_device *dev, int start, int end)
> static int veth_enable_range_safe(struct net_device *dev, int start, int end)
> {
> struct veth_priv *priv = netdev_priv(dev);
> - int err;
> + int err, i;
>
> if (start >= end)
> return 0;
> @@ -1281,6 +1284,9 @@ static int veth_enable_range_safe(struct net_device *dev, int start, int end)
> veth_disable_xdp_range(dev, start, end, true);
> return err;
> }
> + for (i = start; i < end; i++)
> + rcu_assign_pointer(priv->rq[i].xdp_prog,
> + priv->_xdp_prog);
> } else if (veth_gro_requested(dev)) {
> return veth_napi_enable_range(dev, start, end);
> }
This is pure slop, cramming loops into functions which have none.
Shameful, really.
Please test this and submit it if it passes the tests:
diff --git a/drivers/net/veth.c b/drivers/net/veth.c
index 6ed3ee81153f..5d5e8ebce65a 100644
--- a/drivers/net/veth.c
+++ b/drivers/net/veth.c
@@ -1054,6 +1054,8 @@ static int __veth_napi_enable_range(struct net_device *dev, int start, int end)
for (i = start; i < end; i++) {
struct veth_rq *rq = &priv->rq[i];
+ if (priv->_xdp_prog)
+ rcu_assign_pointer(rq->xdp_prog, priv->_xdp_prog);
napi_enable(&rq->xdp_napi);
rcu_assign_pointer(priv->rq[i].napi, &priv->rq[i].xdp_napi);
}
@@ -1088,6 +1090,7 @@ static void veth_napi_del_range(struct net_device *dev, int start, int end)
rcu_assign_pointer(priv->rq[i].napi, NULL);
napi_disable(&rq->xdp_napi);
+ rcu_assign_pointer(rq->xdp_prog, NULL);
__netif_napi_del(&rq->xdp_napi);
}
synchronize_net();
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH net] veth: manage XDP program pointers during channel resize
2026-09-21 22:41 ` Jakub Kicinski
@ 2026-09-21 22:58 ` Jakub Kicinski
2026-09-22 1:57 ` Weiming Shi
0 siblings, 1 reply; 6+ messages in thread
From: Jakub Kicinski @ 2026-09-21 22:58 UTC (permalink / raw)
To: Weiming Shi
Cc: Andrew Lunn, David S. Miller, Eric Dumazet, Paolo Abeni,
Alexei Starovoitov, Daniel Borkmann, Jesper Dangaard Brouer,
John Fastabend, Stanislav Fomichev, netdev, linux-kernel, bpf,
co+65e5c76b187f08b2, Xiang Mei, stable
On Mon, 21 Sep 2026 15:41:47 -0700 Jakub Kicinski wrote:
> This is pure slop, cramming loops into functions which have none.
> Shameful, really.
>
> Please test this and submit it if it passes the tests:
You know what, I'll just post it myself.
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH net] veth: manage XDP program pointers during channel resize
2026-09-21 22:58 ` Jakub Kicinski
@ 2026-09-22 1:57 ` Weiming Shi
0 siblings, 0 replies; 6+ messages in thread
From: Weiming Shi @ 2026-09-22 1:57 UTC (permalink / raw)
To: Jakub Kicinski
Cc: Andrew Lunn, David S. Miller, Eric Dumazet, Paolo Abeni,
Alexei Starovoitov, Daniel Borkmann, Jesper Dangaard Brouer,
John Fastabend, Stanislav Fomichev, netdev, linux-kernel, bpf,
co+65e5c76b187f08b2, Xiang Mei, stable
Jakub Kicinski <kuba@kernel.org> 于2026年9月22日周二 06:58写道：
>
> On Mon, 21 Sep 2026 15:41:47 -0700 Jakub Kicinski wrote:
> > This is pure slop, cramming loops into functions which have none.
> > Shameful, really.
> >
> > Please test this and submit it if it passes the tests:
>
> You know what, I'll just post it myself.
Hi Jakub,
Sorry about the poor implementation.
Thank you for pointing out the issue and taking over the fix.
Best,
Weiming Shi
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2026-09-22 1:57 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-09-17 15:39 [PATCH net] veth: manage XDP program pointers during channel resize Weiming Shi
2026-09-21 12:45 ` Simon Horman
2026-09-21 15:23 ` Jason Xing
2026-09-21 22:41 ` Jakub Kicinski
2026-09-21 22:58 ` Jakub Kicinski
2026-09-22 1:57 ` Weiming Shi
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®