Re: [PATCH net] veth: manage XDP program pointers during channel resize

[Jakub Kicinski]

On Thu, 17 Sep 2026 23:39:25 +0800 Weiming Shi wrote:
> veth_set_channels() tears down XDP resources for removed RX queues
> without clearing rq->xdp_prog.  If the program is then detached or
> replaced, those queues keep the old pointer after bpf_prog_put().  A
> later channel increase can re-enable NAPI and run the freed program.
> 
> Clear the program pointer after taking an RX queue offline, and publish
> the current program only after bringing the queue back online succeeds.
> 
>   BUG: unable to handle page fault for address: ffffc90000256048
>   Oops: Oops: 0000 [#1] SMP KASAN NOPTI
>   RIP: veth_xdp_rcv_skb (include/linux/filter.h:779
>                          include/net/xdp.h:696 drivers/net/veth.c:820)
>   Call Trace:
>    veth_xdp_rcv (drivers/net/veth.c:941)
>    veth_poll (drivers/net/veth.c:986)
>    __napi_poll (net/core/dev.c:7787)
>    net_rx_action (net/core/dev.c:7850 net/core/dev.c:8007)
>    handle_softirqs (kernel/softirq.c:645)
>   Kernel panic - not syncing: Fatal exception in interrupt
> 
> Cc: stable@xxxxxxxxxxxxxxx
> Fixes: 4752eeb3d891 ("veth: implement support for set_channel ethtool op")
> Reported-by: <co+65e5c76b187f08b2@xxxxxxx>
> Assisted-by: LLM
> Signed-off-by: Weiming Shi <bestswngs@xxxxxxxxx>
> ---
>  drivers/net/veth.c | 8 +++++++-
>  1 file changed, 7 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/net/veth.c b/drivers/net/veth.c
> index 6ed3ee81153fb..ef7624bc2c0ec 100644
> --- a/drivers/net/veth.c
> +++ b/drivers/net/veth.c
> @@ -1247,12 +1247,15 @@ static int veth_napi_enable(struct net_device *dev)
>  static void veth_disable_range_safe(struct net_device *dev, int start, int end)
>  {
>  	struct veth_priv *priv = netdev_priv(dev);
> +	int i;
>  
>  	if (start >= end)
>  		return;
>  
>  	if (priv->_xdp_prog) {
>  		veth_napi_del_range(dev, start, end);
> +		for (i = start; i < end; i++)
> +			rcu_assign_pointer(priv->rq[i].xdp_prog, NULL);
>  		veth_disable_xdp_range(dev, start, end, false);
>  	} else if (veth_gro_requested(dev)) {
>  		veth_napi_del_range(dev, start, end);
> @@ -1262,7 +1265,7 @@ static void veth_disable_range_safe(struct net_device *dev, int start, int end)
>  static int veth_enable_range_safe(struct net_device *dev, int start, int end)
>  {
>  	struct veth_priv *priv = netdev_priv(dev);
> -	int err;
> +	int err, i;
>  
>  	if (start >= end)
>  		return 0;
> @@ -1281,6 +1284,9 @@ static int veth_enable_range_safe(struct net_device *dev, int start, int end)
>  			veth_disable_xdp_range(dev, start, end, true);
>  			return err;
>  		}
> +		for (i = start; i < end; i++)
> +			rcu_assign_pointer(priv->rq[i].xdp_prog,
> +					   priv->_xdp_prog);
>  	} else if (veth_gro_requested(dev)) {
>  		return veth_napi_enable_range(dev, start, end);
>  	}

This is pure slop, cramming loops into functions which have none.
Shameful, really.

Please test this and submit it if it passes the tests:

diff --git a/drivers/net/veth.c b/drivers/net/veth.c
index 6ed3ee81153f..5d5e8ebce65a 100644
--- a/drivers/net/veth.c
+++ b/drivers/net/veth.c
@@ -1054,6 +1054,8 @@ static int __veth_napi_enable_range(struct net_device *dev, int start, int end)
        for (i = start; i < end; i++) {
                struct veth_rq *rq = &priv->rq[i];
 
+               if (priv->_xdp_prog)
+                       rcu_assign_pointer(rq->xdp_prog, priv->_xdp_prog);
                napi_enable(&rq->xdp_napi);
                rcu_assign_pointer(priv->rq[i].napi, &priv->rq[i].xdp_napi);
        }
@@ -1088,6 +1090,7 @@ static void veth_napi_del_range(struct net_device *dev, int start, int end)
 
                rcu_assign_pointer(priv->rq[i].napi, NULL);
                napi_disable(&rq->xdp_napi);
+               rcu_assign_pointer(rq->xdp_prog, NULL);
                __netif_napi_del(&rq->xdp_napi);
        }
        synchronize_net();