From: Sasha Levin <sashal@kernel.org>
To: stable@vger.kernel.org
Cc: yanxia <yanxia@cmss.chinamobile.com>,
Jakub Kicinski <kuba@kernel.org>, Sasha Levin <sashal@kernel.org>
Subject: [PATCH 6.1.y] veth: fix stale peer max_mtu on XDP program replacement
Date: Wed, 11 Nov 2026 13:16:49 -0500 [thread overview]
Message-ID: <20261111181637.3806221-1-sashal@kernel.org> (raw)
In-Reply-To: <20261107055359-failed-6.1-c955325db639@kernel.org>
From: yanxia <yanxia@cmss.chinamobile.com>
[ Upstream commit c955325db639e9503941227e14e1f1ccc99442a1 ]
veth_xdp_set() calculates the peer MTU limit from the incoming program's
XDP fragment capability, but only stores it when no program was attached.
Replacing a program with one having a different fragment capability
therefore leaves the peer's max_mtu stale.
Replacing a regular program with an xdp.frags program keeps rejecting
otherwise valid jumbo MTUs. The opposite replacement leaves a larger
limit in place and permits MTUs which a fresh attachment of the regular
program would reject.
Update peer->max_mtu after every successful attachment or replacement.
Keep the GSO feature update conditional on the first attachment.
Found during review of the XDP replacement path and confirmed with
native XDP on an isolated veth pair. Before the fix, direct replacement
rejects MTU 9000 after switching to xdp.frags, and accepts it after
switching back to a regular program. Detaching and attaching instead
produces the expected results in both directions.
UML tests on net reproduce the problem before this change and match the
detach/attach controls afterwards, with both devices up or down and
with either endpoint receiving XDP. Failed replacements preserve the
previous state; same-type replacements and detach also behave as
expected. Small-frame traffic passes in the devices-up cases.
Fixes: 7cda76d858a4 ("veth: Allow jumbo frames in xdp mode")
Cc: stable@vger.kernel.org
Signed-off-by: yanxia <yanxia@cmss.chinamobile.com>
Link: https://patch.msgid.link/20261020020147.790274-1-yanxia@cmss.chinamobile.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
[ sashal: adjusted context for the missing xdp_features_set_redirect_target(peer, true) call ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/veth.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
diff --git a/drivers/net/veth.c b/drivers/net/veth.c
index e8064b9253720..b8a2b3be2767e 100644
--- a/drivers/net/veth.c
+++ b/drivers/net/veth.c
@@ -1536,10 +1536,9 @@ static int veth_xdp_set(struct net_device *dev, struct bpf_prog *prog,
}
}
- if (!old_prog) {
+ if (!old_prog)
peer->hw_features &= ~NETIF_F_GSO_SOFTWARE;
- peer->max_mtu = max_mtu;
- }
+ peer->max_mtu = max_mtu;
}
if (old_prog) {
--
2.53.0
prev parent reply other threads:[~2026-11-11 18:16 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-11-07 10:53 FAILED: patch "[PATCH] veth: fix stale peer max_mtu on XDP program replacement" failed to apply to 6.1-stable tree Sasha Levin
2026-11-11 18:16 ` Sasha Levin [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20261111181637.3806221-1-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=kuba@kernel.org \
--cc=stable@vger.kernel.org \
--cc=yanxia@cmss.chinamobile.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox