From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8EB4343CE7F; Mon, 17 Aug 2026 13:58:16 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786975097; cv=none; b=ZTpAIaviZurGu7MgtcrYuPITrgdpSwllU7Vb4PZlPtdF1mAXZX9GWj9Q6tMkJpwlroo7VA0cQ6YkD2U7gG3PpfufDrZDDs8BSY3VC221WM9gIOQ/YlRGnV1lGu0XpnVyM5Tl7mOA0tYKdSaJwfrXvlAsJ5+Eb/0clKNIlzyCW28= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786975097; c=relaxed/simple; bh=HRbhfK3d8deySjfywUjFoiIMqIeFSSbLH96y5HhEuE0=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=iOygWzjI0wCActOKSA6gt5epasEtWSCqsXl8UAQOryPmOSLFpvoQMKd9SnVpc1IHwsai29OGtwA7MSq5OSo/PGlOOKzlGC+ZMJ0cfnoMG9P8qZQL2eGt6USYT50Ba86kARF/pMxxw1SOFNfnewgJtRqd0XWfaL1qrXsiZo85Tog= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=iW0Dnw0L; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="iW0Dnw0L" Received: by smtp.kernel.org (Postfix) with ESMTPSA id E8AC01F000E9; Mon, 17 Aug 2026 13:58:15 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1786975096; bh=7xUcF3KDkVcEMA+ZlBlp2bKPNupY7yZgrNE1CD6INyE=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=iW0Dnw0LmYDcTr6oHYmG0DcOYaj0+8/jbak4nLXRD0zQ7/OtsirDqk57rDWHQGCRT xDw8OEm3Ymm1X8+WsVY61g0PaozlalVyfZqLpH99dCYu0TOPdpMYWtzLlfdD70uYwQ YlhNpKVyFSGZu4qFW1mD4h3XPzprQF6OTHmUeGY4= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Dongli Zhang , Willem de Bruijn , "Michael S. Tsirkin" , Jakub Kicinski Subject: [PATCH 6.18 111/250] net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp() Date: Mon, 17 Aug 2026 15:31:12 +0200 Message-ID: <20260817132541.104580250@linuxfoundation.org> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260817132536.466235697@linuxfoundation.org> References: <20260817132536.466235697@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.18-stable review patch. If anyone has any objections, please let me know. ------------------ From: Dongli Zhang commit 3874892dd27d5387aa9a06f58d9060f18f351d24 upstream. The commit 4f61f133f354 ("net: tap: NULL pointer derefence in dev_parse_header_protocol when skb->dev is null") fixed a crash in tap_get_user() by assigning skb->dev before calling tun_vnet_hdr_to_skb(). This is required because virtio_net_hdr_to_skb() may invoke dev_parse_header_protocol(), which dereferences skb->dev. Without the assignment, a NULL pointer dereference can occur. However, tap_get_user_xdp() still parses the virtio-net header before assigning skb->dev. When the vhost TX path passes an XDP buffer containing a GSO virtio-net header but the protocol is set to zero on purpose, tun_vnet_hdr_to_skb() can reach dev_parse_header_protocol() while skb->dev is still NULL, resulting in a crash. Fix this by looking up the tap device and assigning skb->dev before calling tun_vnet_hdr_to_skb(), matching the ordering already used in tap_get_user(). Preserve the existing RCU read-side critical section across dev_queue_xmit(). Fixes: 924a9bc362a5 ("net: check if protocol extracted by virtio_net_hdr_set_proto is correct") Cc: stable@vger.kernel.org Signed-off-by: Dongli Zhang Reviewed-by: Willem de Bruijn Acked-by: Michael S. Tsirkin Link: https://patch.msgid.link/20260802224612.264563-1-dongli.zhang@oracle.com Signed-off-by: Jakub Kicinski Signed-off-by: Greg Kroah-Hartman --- drivers/net/tap.c | 24 ++++++++++++++---------- 1 file changed, 14 insertions(+), 10 deletions(-) --- a/drivers/net/tap.c +++ b/drivers/net/tap.c @@ -1074,10 +1074,21 @@ static int tap_get_user_xdp(struct tap_q skb_reset_mac_header(skb); skb->protocol = eth_hdr(skb)->h_proto; + rcu_read_lock(); + tap = rcu_dereference(q->tap); + if (!tap) { + kfree_skb(skb); + rcu_read_unlock(); + return 0; + } + skb->dev = tap->dev; + if (vnet_hdr_len) { err = tun_vnet_hdr_to_skb(q->flags, skb, gso); - if (err) + if (err) { + rcu_read_unlock(); goto err_kfree; + } } /* Move network header to the right position for VLAN tagged packets */ @@ -1085,15 +1096,8 @@ static int tap_get_user_xdp(struct tap_q vlan_get_protocol_and_depth(skb, skb->protocol, &depth) != 0) skb_set_network_header(skb, depth); - rcu_read_lock(); - tap = rcu_dereference(q->tap); - if (tap) { - skb->dev = tap->dev; - skb_probe_transport_header(skb); - dev_queue_xmit(skb); - } else { - kfree_skb(skb); - } + skb_probe_transport_header(skb); + dev_queue_xmit(skb); rcu_read_unlock(); return 0;