From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 85FB9408617; Tue, 21 Jul 2026 22:13:59 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784672040; cv=none; b=qdIM0bv//oCRbrAaa/wgfFjklNOMKn1rp8CTr1si4aAjivh+H3V6po5W7JbNia/3Z7XeuKteYUI9wwG8kF/iINrAqwWZI4bzQoNYw042DKAhnS0R3s5Bp3k46HtKbuISSbvhJUnEv0Qo2AW1gpQVcsB+SYajTWeP6bnjyJajj40= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784672040; c=relaxed/simple; bh=BMfUr3sNXH8cFn2PWa6Zz2RUTYN4a0T7M3BnhvsiFuI=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=VFCA0qwdbPIpVgdqmIExass6HDapxwxJrfgloGCBVkymCda1nVCmfcmiihfortqMwQOuXq9/inUmktMF4/IwFUtMiX3PtWX44UcWmzMWiwEVKAntf3FakV6nl5hiWew13wYJA8xzOXN9M8WC1rJZ4MuvLXFT3s5aeyunOQNZfDc= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=IYUep+v8; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="IYUep+v8" Received: by smtp.kernel.org (Postfix) with ESMTPSA id F1A511F000E9; Tue, 21 Jul 2026 22:13:58 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1784672039; bh=a3AXKQrmxPVl9UPK9XdjRXILC1GsBI1tQxCcLaJTNxw=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=IYUep+v8ek40EpSEyBmtsSc6BJQxEhIWEnhuz5uE1y5Azhwx6WfsG1RpioozgMOkm 0tzBZXB7gIEi7cMVxegficPRDExcIVONW1KFBLWAB6Zwr2AndHEUaSCWpgKDCI9zMK IQ5QdBhhHrvVHLZkMcYA44ZoSBT+ZDBQLL51SrpE= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Guenter Roeck , Eric Dumazet , =?UTF-8?q?Bj=C3=B6rn=20T=C3=B6pel?= , Daniel Borkmann , Ilias Apalodimas , "Michael S. Tsirkin" , Tariq Toukan , Pavan Chebbi , Jakub Kicinski , Sasha Levin Subject: [PATCH 5.15 474/843] veth: fix NAPI leak in XDP enable error path Date: Tue, 21 Jul 2026 17:21:49 +0200 Message-ID: <20260721152416.699613054@linuxfoundation.org> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260721152405.946368001@linuxfoundation.org> References: <20260721152405.946368001@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 5.15-stable review patch. If anyone has any objections, please let me know. ------------------ From: Eric Dumazet [ Upstream commit 6739027cb72da26890edd424c77080d187b2a92e ] During XDP enablement in veth, if xdp_rxq_info_reg() or xdp_rxq_info_reg_mem_model() fails, the driver rolls back the changes. However, the rollback loop: for (i--; i >= start; i--) { decrements the loop index 'i' before the first iteration. This correctly skips unregistering the rxq for the failed index 'i' (as registration failed or was already cleaned up), but it also erroneously skips calling netif_napi_deli() for rq[i].xdp_napi. Since netif_napi_add() was already called for index 'i', this leaves a dangling napi_struct in the device's napi_list. When the veth device is later destroyed, the freed queue memory (which contains the leaked NAPI structure) can be reused. The subsequent device teardown iterates the NAPI list and corrupts the reallocated memory, leading to UAF. Fix this by explicitly deleting the NAPI association for the failed index 'i' before rolling back the successfully configured queues. Fixes: b02e5a0ebb17 ("xsk: Propagate napi_id to XDP socket Rx path") Reported-by: Guenter Roeck Signed-off-by: Eric Dumazet Cc: Björn Töpel Cc: Daniel Borkmann Cc: Ilias Apalodimas Cc: Michael S. Tsirkin Cc: Tariq Toukan Reviewed-by: Pavan Chebbi Link: https://patch.msgid.link/20260622111825.88337-1-edumazet@google.com Signed-off-by: Jakub Kicinski Signed-off-by: Sasha Levin --- drivers/net/veth.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/net/veth.c b/drivers/net/veth.c index cfacf8965bc593..55c53895386aa9 100644 --- a/drivers/net/veth.c +++ b/drivers/net/veth.c @@ -1034,6 +1034,8 @@ static int veth_enable_xdp_range(struct net_device *dev, int start, int end, err_reg_mem: xdp_rxq_info_unreg(&priv->rq[i].xdp_rxq); err_rxq_reg: + if (!napi_already_on) + netif_napi_del(&priv->rq[i].xdp_napi); for (i--; i >= start; i--) { struct veth_rq *rq = &priv->rq[i]; -- 2.53.0