* [PATCH net v2] veth: manage XDP program pointers during channel resize
@ 2026-09-21 23:18 Jakub Kicinski
2026-09-22 23:02 ` Stanislav Fomichev
` (3 more replies)
0 siblings, 4 replies; 5+ messages in thread
From: Jakub Kicinski @ 2026-09-21 23:18 UTC (permalink / raw)
To: davem
Cc: netdev, edumazet, pabeni, andrew+netdev, horms, Jakub Kicinski,
Weiming Shi
veth_set_channels() tears down XDP resources for removed RX queues
without clearing rq->xdp_prog. If the program is then detached or
replaced, those queues keep the old pointer after bpf_prog_put().
A later channel increase can re-enable NAPI and run the freed program.
BUG: unable to handle page fault for address: ffffc90000256048
Oops: Oops: 0000 [#1] SMP KASAN NOPTI
RIP: veth_xdp_rcv_skb (include/linux/filter.h:779
include/net/xdp.h:696 drivers/net/veth.c:820)
Call Trace:
veth_xdp_rcv (drivers/net/veth.c:941)
veth_poll (drivers/net/veth.c:986)
__napi_poll (net/core/dev.c:7787)
net_rx_action (net/core/dev.c:7850 net/core/dev.c:8007)
handle_softirqs (kernel/softirq.c:645)
Kernel panic - not syncing: Fatal exception in interrupt
Fixes: 4752eeb3d891 ("veth: implement support for set_channel ethtool op")
Signed-off-by: Weiming Shi <bestswngs@gmail.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
---
v2:
- different placement to avoid extra loops
v1: https://lore.kernel.org/20260917153923.904124-3-bestswngs@gmail.com
---
drivers/net/veth.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/net/veth.c b/drivers/net/veth.c
index 6ed3ee81153f..71227d0389aa 100644
--- a/drivers/net/veth.c
+++ b/drivers/net/veth.c
@@ -1054,6 +1054,7 @@ static int __veth_napi_enable_range(struct net_device *dev, int start, int end)
for (i = start; i < end; i++) {
struct veth_rq *rq = &priv->rq[i];
+ rcu_assign_pointer(rq->xdp_prog, priv->_xdp_prog);
napi_enable(&rq->xdp_napi);
rcu_assign_pointer(priv->rq[i].napi, &priv->rq[i].xdp_napi);
}
@@ -1088,6 +1089,7 @@ static void veth_napi_del_range(struct net_device *dev, int start, int end)
rcu_assign_pointer(priv->rq[i].napi, NULL);
napi_disable(&rq->xdp_napi);
+ rcu_assign_pointer(rq->xdp_prog, NULL);
__netif_napi_del(&rq->xdp_napi);
}
synchronize_net();
--
2.55.0
^ permalink raw reply related [flat|nested] 5+ messages in thread* Re: [PATCH net v2] veth: manage XDP program pointers during channel resize
2026-09-21 23:18 [PATCH net v2] veth: manage XDP program pointers during channel resize Jakub Kicinski
@ 2026-09-22 23:02 ` Stanislav Fomichev
2026-09-23 9:31 ` Jiayuan Chen
` (2 subsequent siblings)
3 siblings, 0 replies; 5+ messages in thread
From: Stanislav Fomichev @ 2026-09-22 23:02 UTC (permalink / raw)
To: Jakub Kicinski
Cc: davem, netdev, edumazet, pabeni, andrew+netdev, horms,
Weiming Shi
On 09/21, Jakub Kicinski wrote:
> veth_set_channels() tears down XDP resources for removed RX queues
> without clearing rq->xdp_prog. If the program is then detached or
> replaced, those queues keep the old pointer after bpf_prog_put().
> A later channel increase can re-enable NAPI and run the freed program.
>
> BUG: unable to handle page fault for address: ffffc90000256048
> Oops: Oops: 0000 [#1] SMP KASAN NOPTI
> RIP: veth_xdp_rcv_skb (include/linux/filter.h:779
> include/net/xdp.h:696 drivers/net/veth.c:820)
> Call Trace:
> veth_xdp_rcv (drivers/net/veth.c:941)
> veth_poll (drivers/net/veth.c:986)
> __napi_poll (net/core/dev.c:7787)
> net_rx_action (net/core/dev.c:7850 net/core/dev.c:8007)
> handle_softirqs (kernel/softirq.c:645)
> Kernel panic - not syncing: Fatal exception in interrupt
>
> Fixes: 4752eeb3d891 ("veth: implement support for set_channel ethtool op")
> Signed-off-by: Weiming Shi <bestswngs@gmail.com>
> Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Acked-by: Stanislav Fomichev <sdf@fomichev.me>
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [PATCH net v2] veth: manage XDP program pointers during channel resize
2026-09-21 23:18 [PATCH net v2] veth: manage XDP program pointers during channel resize Jakub Kicinski
2026-09-22 23:02 ` Stanislav Fomichev
@ 2026-09-23 9:31 ` Jiayuan Chen
2026-09-23 9:53 ` Jason Xing
2026-09-24 0:00 ` patchwork-bot+netdevbpf
3 siblings, 0 replies; 5+ messages in thread
From: Jiayuan Chen @ 2026-09-23 9:31 UTC (permalink / raw)
To: Jakub Kicinski, davem
Cc: netdev, edumazet, pabeni, andrew+netdev, horms, Weiming Shi
On 9/22/26 7:18 AM, Jakub Kicinski wrote:
> veth_set_channels() tears down XDP resources for removed RX queues
> without clearing rq->xdp_prog. If the program is then detached or
> replaced, those queues keep the old pointer after bpf_prog_put().
> A later channel increase can re-enable NAPI and run the freed program.
>
> BUG: unable to handle page fault for address: ffffc90000256048
> Oops: Oops: 0000 [#1] SMP KASAN NOPTI
> RIP: veth_xdp_rcv_skb (include/linux/filter.h:779
> include/net/xdp.h:696 drivers/net/veth.c:820)
> Call Trace:
> veth_xdp_rcv (drivers/net/veth.c:941)
> veth_poll (drivers/net/veth.c:986)
> __napi_poll (net/core/dev.c:7787)
> net_rx_action (net/core/dev.c:7850 net/core/dev.c:8007)
> handle_softirqs (kernel/softirq.c:645)
> Kernel panic - not syncing: Fatal exception in interrupt
>
> Fixes: 4752eeb3d891 ("veth: implement support for set_channel ethtool op")
> Signed-off-by: Weiming Shi <bestswngs@gmail.com>
> Signed-off-by: Jakub Kicinski <kuba@kernel.org>
> ---
> v2:
> - different placement to avoid extra loops
> v1: https://lore.kernel.org/20260917153923.904124-3-bestswngs@gmail.com
> ---
> drivers/net/veth.c | 2 ++
> 1 file changed, 2 insertions(+)
>
> diff --git a/drivers/net/veth.c b/drivers/net/veth.c
> index 6ed3ee81153f..71227d0389aa 100644
> --- a/drivers/net/veth.c
> +++ b/drivers/net/veth.c
> @@ -1054,6 +1054,7 @@ static int __veth_napi_enable_range(struct net_device *dev, int start, int end)
> for (i = start; i < end; i++) {
> struct veth_rq *rq = &priv->rq[i];
>
> + rcu_assign_pointer(rq->xdp_prog, priv->_xdp_prog);
> napi_enable(&rq->xdp_napi);
> rcu_assign_pointer(priv->rq[i].napi, &priv->rq[i].xdp_napi);
> }
> @@ -1088,6 +1089,7 @@ static void veth_napi_del_range(struct net_device *dev, int start, int end)
>
> rcu_assign_pointer(priv->rq[i].napi, NULL);
> napi_disable(&rq->xdp_napi);
> + rcu_assign_pointer(rq->xdp_prog, NULL);
> __netif_napi_del(&rq->xdp_napi);
> }
> synchronize_net();
Reviewed-by: Jiayuan Chen <jiayuan.chen@linux.dev>
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [PATCH net v2] veth: manage XDP program pointers during channel resize
2026-09-21 23:18 [PATCH net v2] veth: manage XDP program pointers during channel resize Jakub Kicinski
2026-09-22 23:02 ` Stanislav Fomichev
2026-09-23 9:31 ` Jiayuan Chen
@ 2026-09-23 9:53 ` Jason Xing
2026-09-24 0:00 ` patchwork-bot+netdevbpf
3 siblings, 0 replies; 5+ messages in thread
From: Jason Xing @ 2026-09-23 9:53 UTC (permalink / raw)
To: Jakub Kicinski
Cc: davem, netdev, edumazet, pabeni, andrew+netdev, horms,
Weiming Shi
On Tue, Sep 22, 2026 at 7:19 AM Jakub Kicinski <kuba@kernel.org> wrote:
>
> veth_set_channels() tears down XDP resources for removed RX queues
> without clearing rq->xdp_prog. If the program is then detached or
> replaced, those queues keep the old pointer after bpf_prog_put().
> A later channel increase can re-enable NAPI and run the freed program.
>
> BUG: unable to handle page fault for address: ffffc90000256048
> Oops: Oops: 0000 [#1] SMP KASAN NOPTI
> RIP: veth_xdp_rcv_skb (include/linux/filter.h:779
> include/net/xdp.h:696 drivers/net/veth.c:820)
> Call Trace:
> veth_xdp_rcv (drivers/net/veth.c:941)
> veth_poll (drivers/net/veth.c:986)
> __napi_poll (net/core/dev.c:7787)
> net_rx_action (net/core/dev.c:7850 net/core/dev.c:8007)
> handle_softirqs (kernel/softirq.c:645)
> Kernel panic - not syncing: Fatal exception in interrupt
>
> Fixes: 4752eeb3d891 ("veth: implement support for set_channel ethtool op")
> Signed-off-by: Weiming Shi <bestswngs@gmail.com>
> Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Reviewed-by: Jason Xing <kerneljasonxing@gmail.com>
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [PATCH net v2] veth: manage XDP program pointers during channel resize
2026-09-21 23:18 [PATCH net v2] veth: manage XDP program pointers during channel resize Jakub Kicinski
` (2 preceding siblings ...)
2026-09-23 9:53 ` Jason Xing
@ 2026-09-24 0:00 ` patchwork-bot+netdevbpf
3 siblings, 0 replies; 5+ messages in thread
From: patchwork-bot+netdevbpf @ 2026-09-24 0:00 UTC (permalink / raw)
To: Jakub Kicinski
Cc: davem, netdev, edumazet, pabeni, andrew+netdev, horms, bestswngs
Hello:
This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:
On Mon, 21 Sep 2026 16:18:56 -0700 you wrote:
> veth_set_channels() tears down XDP resources for removed RX queues
> without clearing rq->xdp_prog. If the program is then detached or
> replaced, those queues keep the old pointer after bpf_prog_put().
> A later channel increase can re-enable NAPI and run the freed program.
>
> BUG: unable to handle page fault for address: ffffc90000256048
> Oops: Oops: 0000 [#1] SMP KASAN NOPTI
> RIP: veth_xdp_rcv_skb (include/linux/filter.h:779
> include/net/xdp.h:696 drivers/net/veth.c:820)
> Call Trace:
> veth_xdp_rcv (drivers/net/veth.c:941)
> veth_poll (drivers/net/veth.c:986)
> __napi_poll (net/core/dev.c:7787)
> net_rx_action (net/core/dev.c:7850 net/core/dev.c:8007)
> handle_softirqs (kernel/softirq.c:645)
> Kernel panic - not syncing: Fatal exception in interrupt
>
> [...]
Here is the summary with links:
- [net,v2] veth: manage XDP program pointers during channel resize
https://git.kernel.org/netdev/net/c/7104a3707143
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2026-09-24 0:01 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-09-21 23:18 [PATCH net v2] veth: manage XDP program pointers during channel resize Jakub Kicinski
2026-09-22 23:02 ` Stanislav Fomichev
2026-09-23 9:31 ` Jiayuan Chen
2026-09-23 9:53 ` Jason Xing
2026-09-24 0:00 ` patchwork-bot+netdevbpf
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox