[PATCH net v2] veth: manage XDP program pointers during channel resize

[PATCH net v2] veth: manage XDP program pointers during channel resize

[Jakub Kicinski]

veth_set_channels() tears down XDP resources for removed RX queues
without clearing rq->xdp_prog.  If the program is then detached or
replaced, those queues keep the old pointer after bpf_prog_put().
A later channel increase can re-enable NAPI and run the freed program.

  BUG: unable to handle page fault for address: ffffc90000256048
  Oops: Oops: 0000 [#1] SMP KASAN NOPTI
  RIP: veth_xdp_rcv_skb (include/linux/filter.h:779
                         include/net/xdp.h:696 drivers/net/veth.c:820)
  Call Trace:
   veth_xdp_rcv (drivers/net/veth.c:941)
   veth_poll (drivers/net/veth.c:986)
   __napi_poll (net/core/dev.c:7787)
   net_rx_action (net/core/dev.c:7850 net/core/dev.c:8007)
   handle_softirqs (kernel/softirq.c:645)
  Kernel panic - not syncing: Fatal exception in interrupt

Fixes: 4752eeb3d891 ("veth: implement support for set_channel ethtool op")
Signed-off-by: Weiming Shi <bestswngs@gmail.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
---
v2:
 - different placement to avoid extra loops
v1: https://lore.kernel.org/20260917153923.904124-3-bestswngs@gmail.com
---
 drivers/net/veth.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/veth.c b/drivers/net/veth.c
index 6ed3ee81153f..71227d0389aa 100644
--- a/drivers/net/veth.c
+++ b/drivers/net/veth.c
@@ -1054,6 +1054,7 @@ static int __veth_napi_enable_range(struct net_device *dev, int start, int end)
 	for (i = start; i < end; i++) {
 		struct veth_rq *rq = &priv->rq[i];
 
+		rcu_assign_pointer(rq->xdp_prog, priv->_xdp_prog);
 		napi_enable(&rq->xdp_napi);
 		rcu_assign_pointer(priv->rq[i].napi, &priv->rq[i].xdp_napi);
 	}
@@ -1088,6 +1089,7 @@ static void veth_napi_del_range(struct net_device *dev, int start, int end)
 
 		rcu_assign_pointer(priv->rq[i].napi, NULL);
 		napi_disable(&rq->xdp_napi);
+		rcu_assign_pointer(rq->xdp_prog, NULL);
 		__netif_napi_del(&rq->xdp_napi);
 	}
 	synchronize_net();
-- 
2.55.0

Re: [PATCH net v2] veth: manage XDP program pointers during channel resize

[Stanislav Fomichev]

On 09/21, Jakub Kicinski wrote:
> veth_set_channels() tears down XDP resources for removed RX queues
> without clearing rq->xdp_prog.  If the program is then detached or
> replaced, those queues keep the old pointer after bpf_prog_put().
> A later channel increase can re-enable NAPI and run the freed program.
> 
>   BUG: unable to handle page fault for address: ffffc90000256048
>   Oops: Oops: 0000 [#1] SMP KASAN NOPTI
>   RIP: veth_xdp_rcv_skb (include/linux/filter.h:779
>                          include/net/xdp.h:696 drivers/net/veth.c:820)
>   Call Trace:
>    veth_xdp_rcv (drivers/net/veth.c:941)
>    veth_poll (drivers/net/veth.c:986)
>    __napi_poll (net/core/dev.c:7787)
>    net_rx_action (net/core/dev.c:7850 net/core/dev.c:8007)
>    handle_softirqs (kernel/softirq.c:645)
>   Kernel panic - not syncing: Fatal exception in interrupt
> 
> Fixes: 4752eeb3d891 ("veth: implement support for set_channel ethtool op")
> Signed-off-by: Weiming Shi <bestswngs@gmail.com>
> Signed-off-by: Jakub Kicinski <kuba@kernel.org>

Acked-by: Stanislav Fomichev <sdf@fomichev.me>

Re: [PATCH net v2] veth: manage XDP program pointers during channel resize

[Jiayuan Chen]

On 9/22/26 7:18 AM, Jakub Kicinski wrote:
> veth_set_channels() tears down XDP resources for removed RX queues
> without clearing rq->xdp_prog.  If the program is then detached or
> replaced, those queues keep the old pointer after bpf_prog_put().
> A later channel increase can re-enable NAPI and run the freed program.
>
>    BUG: unable to handle page fault for address: ffffc90000256048
>    Oops: Oops: 0000 [#1] SMP KASAN NOPTI
>    RIP: veth_xdp_rcv_skb (include/linux/filter.h:779
>                           include/net/xdp.h:696 drivers/net/veth.c:820)
>    Call Trace:
>     veth_xdp_rcv (drivers/net/veth.c:941)
>     veth_poll (drivers/net/veth.c:986)
>     __napi_poll (net/core/dev.c:7787)
>     net_rx_action (net/core/dev.c:7850 net/core/dev.c:8007)
>     handle_softirqs (kernel/softirq.c:645)
>    Kernel panic - not syncing: Fatal exception in interrupt
>
> Fixes: 4752eeb3d891 ("veth: implement support for set_channel ethtool op")
> Signed-off-by: Weiming Shi <bestswngs@gmail.com>
> Signed-off-by: Jakub Kicinski <kuba@kernel.org>
> ---
> v2:
>   - different placement to avoid extra loops
> v1: https://lore.kernel.org/20260917153923.904124-3-bestswngs@gmail.com
> ---
>   drivers/net/veth.c | 2 ++
>   1 file changed, 2 insertions(+)
>
> diff --git a/drivers/net/veth.c b/drivers/net/veth.c
> index 6ed3ee81153f..71227d0389aa 100644
> --- a/drivers/net/veth.c
> +++ b/drivers/net/veth.c
> @@ -1054,6 +1054,7 @@ static int __veth_napi_enable_range(struct net_device *dev, int start, int end)
>   	for (i = start; i < end; i++) {
>   		struct veth_rq *rq = &priv->rq[i];
>   
> +		rcu_assign_pointer(rq->xdp_prog, priv->_xdp_prog);
>   		napi_enable(&rq->xdp_napi);
>   		rcu_assign_pointer(priv->rq[i].napi, &priv->rq[i].xdp_napi);
>   	}
> @@ -1088,6 +1089,7 @@ static void veth_napi_del_range(struct net_device *dev, int start, int end)
>   
>   		rcu_assign_pointer(priv->rq[i].napi, NULL);
>   		napi_disable(&rq->xdp_napi);
> +		rcu_assign_pointer(rq->xdp_prog, NULL);
>   		__netif_napi_del(&rq->xdp_napi);
>   	}
>   	synchronize_net();


Reviewed-by: Jiayuan Chen <jiayuan.chen@linux.dev>

Re: [PATCH net v2] veth: manage XDP program pointers during channel resize

[Jason Xing]

On Tue, Sep 22, 2026 at 7:19 AM Jakub Kicinski <kuba@kernel.org> wrote:
>
> veth_set_channels() tears down XDP resources for removed RX queues
> without clearing rq->xdp_prog.  If the program is then detached or
> replaced, those queues keep the old pointer after bpf_prog_put().
> A later channel increase can re-enable NAPI and run the freed program.
>
>   BUG: unable to handle page fault for address: ffffc90000256048
>   Oops: Oops: 0000 [#1] SMP KASAN NOPTI
>   RIP: veth_xdp_rcv_skb (include/linux/filter.h:779
>                          include/net/xdp.h:696 drivers/net/veth.c:820)
>   Call Trace:
>    veth_xdp_rcv (drivers/net/veth.c:941)
>    veth_poll (drivers/net/veth.c:986)
>    __napi_poll (net/core/dev.c:7787)
>    net_rx_action (net/core/dev.c:7850 net/core/dev.c:8007)
>    handle_softirqs (kernel/softirq.c:645)
>   Kernel panic - not syncing: Fatal exception in interrupt
>
> Fixes: 4752eeb3d891 ("veth: implement support for set_channel ethtool op")
> Signed-off-by: Weiming Shi <bestswngs@gmail.com>
> Signed-off-by: Jakub Kicinski <kuba@kernel.org>

Reviewed-by: Jason Xing <kerneljasonxing@gmail.com>

Re: [PATCH net v2] veth: manage XDP program pointers during channel resize

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Mon, 21 Sep 2026 16:18:56 -0700 you wrote:
> veth_set_channels() tears down XDP resources for removed RX queues
> without clearing rq->xdp_prog.  If the program is then detached or
> replaced, those queues keep the old pointer after bpf_prog_put().
> A later channel increase can re-enable NAPI and run the freed program.
> 
>   BUG: unable to handle page fault for address: ffffc90000256048
>   Oops: Oops: 0000 [#1] SMP KASAN NOPTI
>   RIP: veth_xdp_rcv_skb (include/linux/filter.h:779
>                          include/net/xdp.h:696 drivers/net/veth.c:820)
>   Call Trace:
>    veth_xdp_rcv (drivers/net/veth.c:941)
>    veth_poll (drivers/net/veth.c:986)
>    __napi_poll (net/core/dev.c:7787)
>    net_rx_action (net/core/dev.c:7850 net/core/dev.c:8007)
>    handle_softirqs (kernel/softirq.c:645)
>   Kernel panic - not syncing: Fatal exception in interrupt
> 
> [...]

Here is the summary with links:
  - [net,v2] veth: manage XDP program pointers during channel resize
    https://git.kernel.org/netdev/net/c/7104a3707143

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html