Re: [PATCH net-next 1/5] net: record XDP programs propagated to lower devices

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] netvsc: XDP programs permanently locked on VF during device removal
--

commit f794b6189b6f7c17a488a5d7e9c45d50b3617887
Author: Jakub Kicinski <kuba@kernel.org>

net: record XDP programs propagated to lower devices

This commit changes the XDP setup to record propagated programs in the
lower device's xdp_state[] array. It introduces the xdp_from_upper flag
to differentiate these from user-installed programs and prevent userspace
from modifying them directly.

> diff --git a/net/core/dev.c b/net/core/dev.c
> index f660fccfc0dbc..096d1dedebfd4 100644
> --- a/net/core/dev.c
> +++ b/net/core/dev.c
[ ... ]
> @@ -10532,6 +10570,11 @@ static int dev_xdp_attach(struct net_device *dev, struct netlink_ext_ack *extack
>  		NL_SET_ERR_MSG(extack, "XDP_FLAGS_REPLACE is not specified");
>  		return -EINVAL;
>  	}
> +	/* the program belongs to an upper device */
> +	if (dev->xdp_from_upper) {
> +		NL_SET_ERR_MSG(extack, "Can't replace an XDP program installed by an upper device");
> +		return -EBUSY;
> +	}

[Severity: High]
Does this change permanently lock the XDP program on a VF during netvsc
device removal?

Looking at netvsc_remove() in drivers/net/hyperv/netvsc_drv.c, it clears its
internal BPF program and unregisters the VF, but skips propagating the XDP
removal to the VF:

drivers/net/hyperv/netvsc_drv.c:netvsc_remove() {
	...
	netvsc_xdp_set(net, NULL, NULL, nvdev);

	// ...
	vf_netdev = rtnl_dereference(ndev_ctx->vf_netdev);
	if (vf_netdev)
		netvsc_unregister_vf(vf_netdev);
	...
}

The linkage is destroyed before unregister_netdevice() triggers
dev_xdp_uninstall(). Because the VF was orphaned without clearing
xdp_from_upper, userspace seems permanently prevented from recovering the
VF's XDP slot here.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260928223648.2739371-1-kuba@kernel.org?part=1