From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pz2-f41.google.com (mail-pz2-f41.google.com [74.125.228.41]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7E92755C310 for ; Thu, 17 Sep 2026 15:40:13 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.228.41 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789659626; cv=none; b=JkwSdfJiCNJvsX2fvNG5R3RJh/Bt6x7Y/LSlTOApqH8d5WKYVMpgxq+B2u/QBT/+XENdeSDe73/MvaYXS1wV7PIyREpjEwxNaqA88IMO9va3hr/cckDku99ISKvgM4IZ3iEJFWq5I3OoPlO7RwtafkwvZNLi1KzqO6pO+FwtIhU= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789659626; c=relaxed/simple; bh=KzbsMfT9mDqqgshLhXJ1nuoPk1e2OxZC2YnocBIcZew=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=ozy/wMUZY2hBb1TLwmsk7Ut927ConVCR3KeeAHdJ3lNQA2UVQnt1x2BNwqwv2BT6f8Nm9vw4cbte6tzaY9Xf7Yk7JFHAGJTh7K2AMN4vWiTf23HjNhSaJEi1oc0wRGcxz+EkTjCCSNwXRdeXgF7gPtODoOYfc21XPG6tKyNXL6Q= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=AhKLrtlN; arc=none smtp.client-ip=74.125.228.41 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="AhKLrtlN" Received: by mail-pz2-f41.google.com with SMTP id d2e1a72fcca58-85469e211a3so840639b3a.2 for ; Thu, 17 Sep 2026 08:40:11 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1789659609; x=1790264409; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=/BLueBpn8GLWCUZRyZrIy9LgmAKje6FNvcB8D0aXHBE=; b=AhKLrtlNwMOA/EVggQliESgZgQjHYLZZmJ7I8znC6UW8X8vdLAfJY5lRF54W22ieAh oEIJcbODiSTF060rx2ZLVIP+D34SByHxD0/nWyOH7qZrvq67fflbbVshzIsNGkuFC3a5 Xuo2npM8sdAwMGQrqiPCkRLRDjdVU1yzqrR2oOiP4HcwXCuZgUbGzi4eNyWELsMrjEp1 k0J4PbpNoCx/YuU4/VW+KCwXCUlFVfOrg5dqCtGHJT53QXPF2oq6EYBBpRmpqw6u5jBN vgWag+tmHW3/Mgoc+5cBUAVW2Jaf6cUCTqem8dXKz8WZGF1s8mqxSZ5js9JX5x11Z18d 9ofA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1789659609; x=1790264409; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=/BLueBpn8GLWCUZRyZrIy9LgmAKje6FNvcB8D0aXHBE=; b=C4rXT7HR0uT7Cq0PEVET5+6OlgZc/XttOA82cT+6tgqT4aMdjRACWH6xK1SNRrD04O fkJJsyvDl1x2LJEGGdcp0iDeMPDcmX0ntaUQhASDCD1ANu/o8/MX0WLHqONTLRVPGi65 Ody4u9u3aeuxFGtZTukSa7fL0PrENDU4kCbuZG8ik3aqQ6MHRf8Nbs/liiwp/hnqoTGy H3KH7xb/gY2VWLt9bD99H6GiOpfYIrfUUl2OZMSmUozNOwd7hTqDbGh0R2PVtQ6o264T R9BTKUn/sDcYFJFQdQG8nYOiRzIT9Di0rTW0xJonurPmO36+9BG7netAOjwEygwoXa2j yb+g== X-Forwarded-Encrypted: i=1; AKwUvByLhCrTaqeb/b5o3VLkTT8fNZW+nKW5Pr6j2POnW2baZRMkarG8+EOAz/DXKf+qAU3d5Do=@vger.kernel.org X-Gm-Message-State: AFuF++kc1yGLRjXS1mWBAQBa2vwZhXruVSdqETRYF7d7Lj5eA7s2ttLw sRD/771SCIQxOMREc2EZJ+tUh4fVxKV2bPxm1sEjjFfDac3ePVDbgssq X-Gm-Gg: AYBFou2S0ICfga4rSyswKHMCSLZ2ZSE3EyYScmtnteVoaaJoaGyVV8HsQSdgbafwsMy OWfGd2KKP7I/2Q3DgRVU2eI0sAY/2bxY8NE7d6NJ9Wmx20pvjWfVZA8g7++WUMWglkk4hYwItyH jRF1J7RlLJ5VAzHbniFXGZ6CejyNxXNx8GUVjQK8ays4FT6rekmX8dVNvCWMwyJsf6ONcDqaRL2 OFGeI9oQg6OzV1odIC5Fb17sElHBZjdxRFxm4ItidqvJuemG/BWHvkZVzSTFa/Psd7trPUKsMbM 84Tlt1S8Rua5Aq3aup6h/DsshUay0sclxUsRZO+EpDt0snc193a8aHICC/Oe7E/9ZJFr3BwQMiQ /uo353uQJyQBjwu29u+DwxN3K5yn1Fali0y595PM0g0sKjYcsPAkMhZkEwpZ91GW3DJBSaOJv4l T/xMfW1PIfYdB9LeTSo1L6JO8jdMzxtIRYaBkcod/O29ZI+D+jWgPt8sIM4vQ+jCi5vNx1gahaf jaG2sTN6JCRc2IxGLUgd2UIzz6K3yG3 X-Received: by 2002:a05:6a00:1892:b0:869:4d90:a0cd with SMTP id d2e1a72fcca58-8723a5a7c3dmr15557312b3a.16.1789659608898; Thu, 17 Sep 2026 08:40:08 -0700 (PDT) Received: from 192.168.50.3 ([198.176.50.208]) by smtp.gmail.com with ESMTPSA id 41be03b00d2f7-cc50abb1776sm3467697a12.27.2026.09.17.08.39.55 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 17 Sep 2026 08:40:08 -0700 (PDT) From: Weiming Shi To: Andrew Lunn , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Alexei Starovoitov , Daniel Borkmann , Jesper Dangaard Brouer , John Fastabend , Stanislav Fomichev Cc: netdev@vger.kernel.org, linux-kernel@vger.kernel.org, bpf@vger.kernel.org, co+65e5c76b187f08b2@bugs.sh, Xiang Mei , Weiming Shi , stable@vger.kernel.org Subject: [PATCH net] veth: manage XDP program pointers during channel resize Date: Thu, 17 Sep 2026 23:39:25 +0800 Message-ID: <20260917153923.904124-3-bestswngs@gmail.com> X-Mailer: git-send-email 2.55.0 Precedence: bulk X-Mailing-List: bpf@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit veth_set_channels() tears down XDP resources for removed RX queues without clearing rq->xdp_prog. If the program is then detached or replaced, those queues keep the old pointer after bpf_prog_put(). A later channel increase can re-enable NAPI and run the freed program. Clear the program pointer after taking an RX queue offline, and publish the current program only after bringing the queue back online succeeds. BUG: unable to handle page fault for address: ffffc90000256048 Oops: Oops: 0000 [#1] SMP KASAN NOPTI RIP: veth_xdp_rcv_skb (include/linux/filter.h:779 include/net/xdp.h:696 drivers/net/veth.c:820) Call Trace: veth_xdp_rcv (drivers/net/veth.c:941) veth_poll (drivers/net/veth.c:986) __napi_poll (net/core/dev.c:7787) net_rx_action (net/core/dev.c:7850 net/core/dev.c:8007) handle_softirqs (kernel/softirq.c:645) Kernel panic - not syncing: Fatal exception in interrupt Cc: stable@vger.kernel.org Fixes: 4752eeb3d891 ("veth: implement support for set_channel ethtool op") Reported-by: Assisted-by: LLM Signed-off-by: Weiming Shi --- drivers/net/veth.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/drivers/net/veth.c b/drivers/net/veth.c index 6ed3ee81153fb..ef7624bc2c0ec 100644 --- a/drivers/net/veth.c +++ b/drivers/net/veth.c @@ -1247,12 +1247,15 @@ static int veth_napi_enable(struct net_device *dev) static void veth_disable_range_safe(struct net_device *dev, int start, int end) { struct veth_priv *priv = netdev_priv(dev); + int i; if (start >= end) return; if (priv->_xdp_prog) { veth_napi_del_range(dev, start, end); + for (i = start; i < end; i++) + rcu_assign_pointer(priv->rq[i].xdp_prog, NULL); veth_disable_xdp_range(dev, start, end, false); } else if (veth_gro_requested(dev)) { veth_napi_del_range(dev, start, end); @@ -1262,7 +1265,7 @@ static void veth_disable_range_safe(struct net_device *dev, int start, int end) static int veth_enable_range_safe(struct net_device *dev, int start, int end) { struct veth_priv *priv = netdev_priv(dev); - int err; + int err, i; if (start >= end) return 0; @@ -1281,6 +1284,9 @@ static int veth_enable_range_safe(struct net_device *dev, int start, int end) veth_disable_xdp_range(dev, start, end, true); return err; } + for (i = start; i < end; i++) + rcu_assign_pointer(priv->rq[i].xdp_prog, + priv->_xdp_prog); } else if (veth_gro_requested(dev)) { return veth_napi_enable_range(dev, start, end); } -- 2.55.0