virtnet_xdp_set() can lower curr_queue_pairs when an XDP program is
detached. Unlike ethtool channel updates, that path does not check for
AF_XDP zero-copy pools on the queues being dropped. A pool can remain
bound on a qid that is no longer covered by curr_queue_pairs, which
breaks later unbind and can leave stale rq/sq->xsk_pool pointers.
Refuse the shrink with -EBUSY while any AF_XDP pool is still bound on a
queue that would become inactive.
Fixes: 09d2b3182c8e ("virtio_net: xsk: bind/unbind xsk for rx")
Signed-off-by: Xiong Weimin <[email protected]>
---
v2:
- new patch: block XDP-driven queue shrink while AF_XDP is bound
- replaces the previous series' approach after review
drivers/net/virtio_net.c | 15 +++++++++++++++
1 file changed, 15 insertions(+)
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index d07ccef..3bd220d 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -6064,6 +6064,21 @@ static int virtnet_xdp_set(struct net_device *dev,
struct bpf_prog *prog,
if (!prog && !old_prog)
return 0;
+ /* ethtool channel shrink is gated on xsk_get_pool_from_qid(), but
+ * XDP detach shrinks curr_queue_pairs here without that check.
+ * Refusing the shrink keeps AF_XDP queues active until the socket
+ * unbinds them.
+ */
+ if (curr_qp + xdp_qp < vi->curr_queue_pairs) {
+ for (i = curr_qp + xdp_qp; i < vi->curr_queue_pairs; i++) {
+ if (vi->rq[i].xsk_pool || vi->sq[i].xsk_pool) {
+ NL_SET_ERR_MSG_MOD(extack,
+ "Cannot reduce queues while
AF_XDP is bound");
+ return -EBUSY;
+ }
+ }
+ }
+
if (prog)
bpf_prog_add(prog, vi->max_queue_pairs - 1);
--
2.43.0
