Re: [PATCH net] veth: manage XDP program pointers during channel resize

[Simon Horman]

On Thu, Sep 17, 2026 at 11:39:25PM +0800, Weiming Shi wrote:
> veth_set_channels() tears down XDP resources for removed RX queues
> without clearing rq->xdp_prog.  If the program is then detached or
> replaced, those queues keep the old pointer after bpf_prog_put().  A
> later channel increase can re-enable NAPI and run the freed program.
> 
> Clear the program pointer after taking an RX queue offline, and publish
> the current program only after bringing the queue back online succeeds.
> 
>   BUG: unable to handle page fault for address: ffffc90000256048
>   Oops: Oops: 0000 [#1] SMP KASAN NOPTI
>   RIP: veth_xdp_rcv_skb (include/linux/filter.h:779
>                          include/net/xdp.h:696 drivers/net/veth.c:820)
>   Call Trace:
>    veth_xdp_rcv (drivers/net/veth.c:941)
>    veth_poll (drivers/net/veth.c:986)
>    __napi_poll (net/core/dev.c:7787)
>    net_rx_action (net/core/dev.c:7850 net/core/dev.c:8007)
>    handle_softirqs (kernel/softirq.c:645)
>   Kernel panic - not syncing: Fatal exception in interrupt
> 
> Cc: stable@xxxxxxxxxxxxxxx
> Fixes: 4752eeb3d891 ("veth: implement support for set_channel ethtool op")
> Reported-by: <co+65e5c76b187f08b2@xxxxxxx>
> Assisted-by: LLM
> Signed-off-by: Weiming Shi <bestswngs@xxxxxxxxx>

Reviewed-by: Simon Horman <horms@xxxxxxxxxx>