[PATCH net v2 2/2] virtio_net: refuse XDP queue shrink while AF_XDP is bound

virtnet_xdp_set() can lower curr_queue_pairs when an XDP program is
detached.  Unlike ethtool channel updates, that path does not check for
AF_XDP zero-copy pools on the queues being dropped.  A pool can remain
bound on a qid that is no longer covered by curr_queue_pairs, which
breaks later unbind and can leave stale rq/sq->xsk_pool pointers.

Refuse the shrink with -EBUSY while any AF_XDP pool is still bound on a
queue that would become inactive.

Fixes: 09d2b3182c8e ("virtio_net: xsk: bind/unbind xsk for rx")
Signed-off-by: Xiong Weimin <[email protected]>
---
v2:
- new patch: block XDP-driven queue shrink while AF_XDP is bound
- replaces the previous series' approach after review

 drivers/net/virtio_net.c | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index d07ccef..3bd220d 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -6064,6 +6064,21 @@ static int virtnet_xdp_set(struct net_device *dev, struct bpf_prog *prog,
 	if (!prog && !old_prog)
 		return 0;
 
+	/* ethtool channel shrink is gated on xsk_get_pool_from_qid(), but
+	 * XDP detach shrinks curr_queue_pairs here without that check.
+	 * Refusing the shrink keeps AF_XDP queues active until the socket
+	 * unbinds them.
+	 */
+	if (curr_qp + xdp_qp < vi->curr_queue_pairs) {
+		for (i = curr_qp + xdp_qp; i < vi->curr_queue_pairs; i++) {
+			if (vi->rq[i].xsk_pool || vi->sq[i].xsk_pool) {
+				NL_SET_ERR_MSG_MOD(extack,
+						   "Cannot reduce queues while AF_XDP is bound");
+				return -EBUSY;
+			}
+		}
+	}
+
 	if (prog)
 		bpf_prog_add(prog, vi->max_queue_pairs - 1);
 
-- 
2.43.0