* [PATCH net] virtio_net: Fix resize of the RX ring
@ 2026-08-10 12:07 Anton Protopopov
2026-08-10 13:07 ` Vadim Fedorenko
0 siblings, 1 reply; 3+ messages in thread
From: Anton Protopopov @ 2026-08-10 12:07 UTC (permalink / raw)
To: Michael S. Tsirkin, Jason Wang, Xuan Zhuo, Eugenio Pérez,
Andrew Lunn, David S. Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, netdev, virtualization, linux-kernel
Cc: Anton Protopopov
When a AF_XDP socket is attached, the virtnet_rx_resize
should resize the rq->xsk_buffs XSK buffer array. Otherwise,
when the size grows, the virtnet_rx_resume() causes a write
past the end of the array. This is easily reproducable with
ethtool -G ens3 rx 32
./xdpsock -i eth0 -q 0 -r -z &
ethtool -G eth0 rx 256
Fixes: e9f3962441c0 ("virtio_net: xsk: rx: support fill with xsk buffer")
Signed-off-by: Anton Protopopov <a.s.protopopov@gmail.com>
---
drivers/net/virtio_net.c | 14 ++++++++++++++
1 file changed, 14 insertions(+)
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index 3e2a5876c6c8..e34c52d059d3 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -3444,17 +3444,31 @@ static void virtnet_rx_resume_all(struct virtnet_info *vi)
static int virtnet_rx_resize(struct virtnet_info *vi,
struct receive_queue *rq, u32 ring_num)
{
+ unsigned int old_ring_num = virtqueue_get_vring_size(rq->vq);
+ struct xdp_buff **tmp_xsk_buffs = NULL;
int err, qindex;
qindex = rq - vi->rq;
+ if (rq->xsk_pool && ring_num > old_ring_num) {
+ tmp_xsk_buffs = kvzalloc_objs(*tmp_xsk_buffs, ring_num);
+ if (!tmp_xsk_buffs)
+ return -ENOMEM;
+ }
+
virtnet_rx_pause(vi, rq);
err = virtqueue_resize(rq->vq, ring_num, virtnet_rq_unmap_free_buf, NULL);
+
+ /* virtqueue_resize may have changed the size even if err != 0 */
+ if (tmp_xsk_buffs && virtqueue_get_vring_size(rq->vq) > old_ring_num)
+ swap(rq->xsk_buffs, tmp_xsk_buffs);
+
if (err)
netdev_err(vi->dev, "resize rx fail: rx queue index: %d err: %d\n", qindex, err);
virtnet_rx_resume(vi, rq, true);
+ kvfree(tmp_xsk_buffs);
return err;
}
--
2.43.0
^ permalink raw reply related [flat|nested] 3+ messages in thread* Re: [PATCH net] virtio_net: Fix resize of the RX ring
2026-08-10 12:07 [PATCH net] virtio_net: Fix resize of the RX ring Anton Protopopov
@ 2026-08-10 13:07 ` Vadim Fedorenko
2026-08-10 13:35 ` Anton Protopopov
0 siblings, 1 reply; 3+ messages in thread
From: Vadim Fedorenko @ 2026-08-10 13:07 UTC (permalink / raw)
To: Anton Protopopov, Michael S. Tsirkin, Jason Wang, Xuan Zhuo,
Eugenio Pérez, Andrew Lunn, David S. Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, netdev, virtualization, linux-kernel
On 10/08/2026 13:07, Anton Protopopov wrote:
> When a AF_XDP socket is attached, the virtnet_rx_resize
> should resize the rq->xsk_buffs XSK buffer array. Otherwise,
> when the size grows, the virtnet_rx_resume() causes a write
> past the end of the array. This is easily reproducable with
>
> ethtool -G ens3 rx 32
> ./xdpsock -i eth0 -q 0 -r -z &
> ethtool -G eth0 rx 256
>
> Fixes: e9f3962441c0 ("virtio_net: xsk: rx: support fill with xsk buffer")
> Signed-off-by: Anton Protopopov <a.s.protopopov@gmail.com>
> ---
> drivers/net/virtio_net.c | 14 ++++++++++++++
> 1 file changed, 14 insertions(+)
>
> diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
> index 3e2a5876c6c8..e34c52d059d3 100644
> --- a/drivers/net/virtio_net.c
> +++ b/drivers/net/virtio_net.c
> @@ -3444,17 +3444,31 @@ static void virtnet_rx_resume_all(struct virtnet_info *vi)
> static int virtnet_rx_resize(struct virtnet_info *vi,
> struct receive_queue *rq, u32 ring_num)
> {
> + unsigned int old_ring_num = virtqueue_get_vring_size(rq->vq);
> + struct xdp_buff **tmp_xsk_buffs = NULL;
> int err, qindex;
>
> qindex = rq - vi->rq;
>
> + if (rq->xsk_pool && ring_num > old_ring_num) {
why do you cover only the case for growing buffer? Don't we expect to
free some memory in case of shrinking? Should be fine given you are
swapping buffers completely...
> + tmp_xsk_buffs = kvzalloc_objs(*tmp_xsk_buffs, ring_num);
> + if (!tmp_xsk_buffs)
> + return -ENOMEM;
> + }
> +
> virtnet_rx_pause(vi, rq);
>
> err = virtqueue_resize(rq->vq, ring_num, virtnet_rq_unmap_free_buf, NULL);
> +
> + /* virtqueue_resize may have changed the size even if err != 0 */
> + if (tmp_xsk_buffs && virtqueue_get_vring_size(rq->vq) > old_ring_num)
> + swap(rq->xsk_buffs, tmp_xsk_buffs);
> +
> if (err)
> netdev_err(vi->dev, "resize rx fail: rx queue index: %d err: %d\n", qindex, err);
>
> virtnet_rx_resume(vi, rq, true);
> + kvfree(tmp_xsk_buffs);
> return err;
> }
>
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [PATCH net] virtio_net: Fix resize of the RX ring
2026-08-10 13:07 ` Vadim Fedorenko
@ 2026-08-10 13:35 ` Anton Protopopov
0 siblings, 0 replies; 3+ messages in thread
From: Anton Protopopov @ 2026-08-10 13:35 UTC (permalink / raw)
To: Vadim Fedorenko
Cc: Michael S. Tsirkin, Jason Wang, Xuan Zhuo, Eugenio Pérez,
Andrew Lunn, David S. Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, netdev, virtualization, linux-kernel
On 26/08/10 02:07PM, Vadim Fedorenko wrote:
> On 10/08/2026 13:07, Anton Protopopov wrote:
> > When a AF_XDP socket is attached, the virtnet_rx_resize
> > should resize the rq->xsk_buffs XSK buffer array. Otherwise,
> > when the size grows, the virtnet_rx_resume() causes a write
> > past the end of the array. This is easily reproducable with
> >
> > ethtool -G ens3 rx 32
> > ./xdpsock -i eth0 -q 0 -r -z &
> > ethtool -G eth0 rx 256
> >
> > Fixes: e9f3962441c0 ("virtio_net: xsk: rx: support fill with xsk buffer")
> > Signed-off-by: Anton Protopopov <a.s.protopopov@gmail.com>
> > ---
> > drivers/net/virtio_net.c | 14 ++++++++++++++
> > 1 file changed, 14 insertions(+)
> >
> > diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
> > index 3e2a5876c6c8..e34c52d059d3 100644
> > --- a/drivers/net/virtio_net.c
> > +++ b/drivers/net/virtio_net.c
> > @@ -3444,17 +3444,31 @@ static void virtnet_rx_resume_all(struct virtnet_info *vi)
> > static int virtnet_rx_resize(struct virtnet_info *vi,
> > struct receive_queue *rq, u32 ring_num)
> > {
> > + unsigned int old_ring_num = virtqueue_get_vring_size(rq->vq);
> > + struct xdp_buff **tmp_xsk_buffs = NULL;
> > int err, qindex;
> > qindex = rq - vi->rq;
> > + if (rq->xsk_pool && ring_num > old_ring_num) {
>
> why do you cover only the case for growing buffer? Don't we expect to
> free some memory in case of shrinking? Should be fine given you are
> swapping buffers completely...
Isn't this common for "realloc[s]" to just return the same ptr, when
shrinking (to avoid extra actual allocations)? But I do not have
any strong feelings about this, can switch to "shrink/grow", if this
looks better.
> > + tmp_xsk_buffs = kvzalloc_objs(*tmp_xsk_buffs, ring_num);
> > + if (!tmp_xsk_buffs)
> > + return -ENOMEM;
> > + }
> > +
> > virtnet_rx_pause(vi, rq);
> > err = virtqueue_resize(rq->vq, ring_num, virtnet_rq_unmap_free_buf, NULL);
> > +
> > + /* virtqueue_resize may have changed the size even if err != 0 */
> > + if (tmp_xsk_buffs && virtqueue_get_vring_size(rq->vq) > old_ring_num)
> > + swap(rq->xsk_buffs, tmp_xsk_buffs);
> > +
> > if (err)
> > netdev_err(vi->dev, "resize rx fail: rx queue index: %d err: %d\n", qindex, err);
> > virtnet_rx_resume(vi, rq, true);
> > + kvfree(tmp_xsk_buffs);
> > return err;
> > }
>
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-08-10 13:25 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-08-10 12:07 [PATCH net] virtio_net: Fix resize of the RX ring Anton Protopopov
2026-08-10 13:07 ` Vadim Fedorenko
2026-08-10 13:35 ` Anton Protopopov
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox