From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 83CFA43CE46; Mon, 17 Aug 2026 13:44:42 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786974288; cv=none; b=dLnATsY3mm78WSeeR1cmdc1DmvhZwrlHU2rLC9hEVn2A0nfyR8ofvZxu+PI3F0/juGXRCT3UCp9OuSpvFAs5fUdw2zYI1AuJi/PM6EmhXYqGshezbIZ2esGWuPA7EH3WYdDgQ7+gBHORwsqp76e50ZEQ+68DR6TlciT7yLmz9mg= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786974288; c=relaxed/simple; bh=4nLgLV62J2RIOnjnsKttXEV1e9kq4F2jhEP8MHI5Ouc=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=ljVLJJoaomWC53WImj6DlW+hI0BEgncEGv3uQ4mRyhA334uvhfz640j6rqfAqTgEGRu1ylkEbDS/S08VbIjSLDb27nSjVIkoewLZGnoa2mgecxcG7cXyGUL0zzmbtW1SwkJiR/KoCm/dzFqD6soHWvC51lblgFZYr4efIl2wU54= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=wUUO1gtL; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="wUUO1gtL" Received: by smtp.kernel.org (Postfix) with ESMTPSA id F40F71F000E9; Mon, 17 Aug 2026 13:44:39 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1786974280; bh=+5C2ME6jc4RTfsLawT222BLcGFgeQLGibThLz+sLQjo=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=wUUO1gtLcQiFwvDV0TQ03/886M/62oPUy3BLYsd/kI2DhKYLBo4Zk3aAkAeF28XrY IPCH/xY8noBQLT9TkS+WWJ1nzhmSEcRZOV6/dKIBAYAiNvj+Xo7ZrN7isXWrG1ttPe s6G0BAbPr474TWD+ucUjD0Ms9JAcArs2Kv3zQfTU= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Dongli Zhang , Willem de Bruijn , "Michael S. Tsirkin" , Jakub Kicinski Subject: [PATCH 7.1 124/271] net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp() Date: Mon, 17 Aug 2026 15:30:49 +0200 Message-ID: <20260817132541.964455050@linuxfoundation.org> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260817132536.752504388@linuxfoundation.org> References: <20260817132536.752504388@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 7.1-stable review patch. If anyone has any objections, please let me know. ------------------ From: Dongli Zhang commit 3874892dd27d5387aa9a06f58d9060f18f351d24 upstream. The commit 4f61f133f354 ("net: tap: NULL pointer derefence in dev_parse_header_protocol when skb->dev is null") fixed a crash in tap_get_user() by assigning skb->dev before calling tun_vnet_hdr_to_skb(). This is required because virtio_net_hdr_to_skb() may invoke dev_parse_header_protocol(), which dereferences skb->dev. Without the assignment, a NULL pointer dereference can occur. However, tap_get_user_xdp() still parses the virtio-net header before assigning skb->dev. When the vhost TX path passes an XDP buffer containing a GSO virtio-net header but the protocol is set to zero on purpose, tun_vnet_hdr_to_skb() can reach dev_parse_header_protocol() while skb->dev is still NULL, resulting in a crash. Fix this by looking up the tap device and assigning skb->dev before calling tun_vnet_hdr_to_skb(), matching the ordering already used in tap_get_user(). Preserve the existing RCU read-side critical section across dev_queue_xmit(). Fixes: 924a9bc362a5 ("net: check if protocol extracted by virtio_net_hdr_set_proto is correct") Cc: stable@vger.kernel.org Signed-off-by: Dongli Zhang Reviewed-by: Willem de Bruijn Acked-by: Michael S. Tsirkin Link: https://patch.msgid.link/20260802224612.264563-1-dongli.zhang@oracle.com Signed-off-by: Jakub Kicinski Signed-off-by: Greg Kroah-Hartman --- drivers/net/tap.c | 24 ++++++++++++++---------- 1 file changed, 14 insertions(+), 10 deletions(-) --- a/drivers/net/tap.c +++ b/drivers/net/tap.c @@ -1074,10 +1074,21 @@ static int tap_get_user_xdp(struct tap_q skb_reset_mac_header(skb); skb->protocol = eth_hdr(skb)->h_proto; + rcu_read_lock(); + tap = rcu_dereference(q->tap); + if (!tap) { + kfree_skb(skb); + rcu_read_unlock(); + return 0; + } + skb->dev = tap->dev; + if (vnet_hdr_len) { err = tun_vnet_hdr_to_skb(q->flags, skb, gso); - if (err) + if (err) { + rcu_read_unlock(); goto err_kfree; + } } /* Move network header to the right position for VLAN tagged packets */ @@ -1085,15 +1096,8 @@ static int tap_get_user_xdp(struct tap_q vlan_get_protocol_and_depth(skb, skb->protocol, &depth) != 0) skb_set_network_header(skb, depth); - rcu_read_lock(); - tap = rcu_dereference(q->tap); - if (tap) { - skb->dev = tap->dev; - skb_probe_transport_header(skb); - dev_queue_xmit(skb); - } else { - kfree_skb(skb); - } + skb_probe_transport_header(skb); + dev_queue_xmit(skb); rcu_read_unlock(); return 0;