mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-08-30 07:39:12 -04:00
Code Issues Packages Projects Releases Wiki Activity

virtio_net: Fix resize of the RX ring

Browse Source 
When a AF_XDP socket is attached, the virtnet_rx_resize
should resize the rq->xsk_buffs XSK buffer array. Otherwise,
when the size grows, the virtnet_rx_resume() causes a write
past the end of the array. This is easily reproducable with

    ethtool -G ens3 rx 32
    ./xdpsock -i eth0 -q 0 -r -z &
    ethtool -G eth0 rx 256

Fixes: e9f3962441 ("virtio_net: xsk: rx: support fill with xsk buffer")
Signed-off-by: Anton Protopopov <a.s.protopopov@gmail.com>
Link: https://patch.msgid.link/20260810120728.47445-1-a.s.protopopov@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
This commit is contained in:
Anton Protopopov
2026-08-10 12:07:25 +00:00
committed by Jakub Kicinski
parent 7f16289b91
commit d09c98a6da
1 changed files with 14 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
drivers/net/virtio_net.c
View File

@@ -3444,17 +3444,31 @@ static void virtnet_rx_resume_all(struct virtnet_info *vi)
static int virtnet_rx_resize(struct virtnet_info *vi,
struct receive_queue *rq, u32 ring_num)
{
unsigned int old_ring_num = virtqueue_get_vring_size(rq->vq);
struct xdp_buff **tmp_xsk_buffs = NULL;
int err, qindex;
qindex = rq - vi->rq;
if (rq->xsk_pool && ring_num > old_ring_num) {
tmp_xsk_buffs = kvzalloc_objs(*tmp_xsk_buffs, ring_num);
if (!tmp_xsk_buffs)
return -ENOMEM;
}
virtnet_rx_pause(vi, rq);
err = virtqueue_resize(rq->vq, ring_num, virtnet_rq_unmap_free_buf, NULL);
/* virtqueue_resize may have changed the size even if err != 0 */
if (tmp_xsk_buffs && virtqueue_get_vring_size(rq->vq) > old_ring_num)
swap(rq->xsk_buffs, tmp_xsk_buffs);
if (err)
netdev_err(vi->dev, "resize rx fail: rx queue index: %d err: %d\n", qindex, err);
virtnet_rx_resume(vi, rq, true);
kvfree(tmp_xsk_buffs);
return err;
}