netvsc_remove() lets the VF go, taking the XDP program back from it,
takes the program off the channels, then frees the channels and clears
nvdev, and only then unregisters the netdev. dev_xdp_uninstall() still
finds the program in netvsc's xdp_state[] at that point and asks
netvsc_bpf() to remove it, which fails with -ENODEV for the lack of
nvdev. That trips the WARN_ON() in dev_xdp_uninstall() on every unbind
or hot-remove of a netvsc device running native XDP, and returns before
the program is dropped from the XDP dispatcher, which then holds on to
it for good. The core used to ask netvsc for its program first, and
netvsc reported none once nvdev was gone, until commit 7f0a838254bd
("bpf, xdp: Maintain info on attached XDP BPF programs in net_device").Accept the removal once there are no channels and no VF left to take the program off, unless suspend parked the program for resume to put back, as the core would then lose track of it. The core is about to record the programs uppers propagate as well, which would bring the same to a netvsc device enslaved to a bond running XDP. Spotted by AI while reviewing the XDP propagation series. Untested. Cc: [email protected] # LLM report + LLM fix, untested Fixes: 7f0a838254bd ("bpf, xdp: Maintain info on attached XDP BPF programs in net_device") Signed-off-by: Jakub Kicinski <[email protected]> --- drivers/net/hyperv/netvsc_bpf.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/net/hyperv/netvsc_bpf.c b/drivers/net/hyperv/netvsc_bpf.c index 951c19ce15eb..7fe38574f66f 100644 --- a/drivers/net/hyperv/netvsc_bpf.c +++ b/drivers/net/hyperv/netvsc_bpf.c @@ -204,6 +204,12 @@ int netvsc_bpf(struct net_device *dev, struct netdev_bpf *bpf) int ret; if (!nvdev || nvdev->destroy) { + /* The channels and the VF are gone, and so is the program, + * unless suspend parked it for netvsc_resume() to put back. + */ + if (bpf->command == XDP_SETUP_PROG && !bpf->prog && !vf_netdev && + !ndevctx->saved_netvsc_dev_info) + return 0; return -ENODEV; } -- 2.55.0
