From: Simon Horman <horms@kernel.org>
To: Subasri S <subasris1210@gmail.com>
Cc: Jakub Kicinski <kuba@kernel.org>,
Andrew Lunn <andrew+netdev@lunn.ch>,
"David S. Miller" <davem@davemloft.net>,
Eric Dumazet <edumazet@google.com>,
Paolo Abeni <pabeni@redhat.com>,
Alexei Starovoitov <ast@kernel.org>,
Daniel Borkmann <daniel@iogearbox.net>,
Jesper Dangaard Brouer <hawk@kernel.org>,
John Fastabend <john.fastabend@gmail.com>,
Stanislav Fomichev <sdf@fomichev.me>,
Willem de Bruijn <willemb@google.com>,
Mina Almasry <almasrymina@google.com>,
netdev@vger.kernel.org, linux-kernel@vger.kernel.org,
bpf@vger.kernel.org,
syzbot+c06674caba265dc61d46@syzkaller.appspotmail.com
Subject: Re: [PATCH v2] netdevsim: update rxq->napi pointer during queue reset
Date: Tue, 18 Aug 2026 14:25:05 +0100 [thread overview]
Message-ID: <20260818132505.GG265046@horms.kernel.org> (raw)
In-Reply-To: <20260815-net-netdevsim-v2-1-d6c85c5157a7@gmail.com>
On Sat, Aug 15, 2026 at 08:19:32AM +0530, Subasri S wrote:
> In netdevsim, when queue reset is performed using debugfs, it triggers
> these sequence of operations: nsim_queue_stop() -> nsim_queue_start()
> -> nsim_queue_mem_free(). nsim_queue_mem_free() frees the old
> nsim_rq struct which embeds the napi_struct. But the rxq->napi pointer
> in the struct netdev_rx_queue still points to the old nsim_rq's embedded
> napi_struct. So, any subsequent xsk_bind() which reads rxq->napi->napi_id
> after a queue reset is a use-after-free.
>
> Add netif_queue_set_napi() calls to nsim_queue_stop() and
> nsim_queue_start() which clears the rxq->napi during stop
> and sets it to the new napi instance during start.
>
> KASAN report:
>
> Call Trace:
> kasan_report+0xdf/0x1c0 mm/kasan/report.c:595
> xsk_bind+0x1582/0x16c0 net/xdp/xsk.c:1758
> __sys_bind_socket net/socket.c:1920 [inline]
> __sys_bind_socket net/socket.c:1912 [inline]
> __sys_bind+0x1a9/0x260 net/socket.c:1951
>
> Allocated by task 5622:
> nsim_queue_alloc+0x3c/0x140 drivers/net/netdevsim/netdev.c:715
> nsim_queue_init drivers/net/netdevsim/netdev.c:1012 [inline]
> nsim_init_netdevsim drivers/net/netdevsim/netdev.c:1059 [inline]
> nsim_create+0xb13/0x1420 drivers/net/netdevsim/netdev.c:1152
> __nsim_dev_port_add+0x3ba/0x8f0 drivers/net/netdevsim/dev.c:1509
> nsim_dev_port_add_all drivers/net/netdevsim/dev.c:1570 [inline]
> nsim_drv_probe+0xdbd/0x13a0 drivers/net/netdevsim/dev.c:1731
>
> Freed by task 5659:
> slab_free mm/slub.c:6377 [inline]
> kfree+0x22b/0x6c0 mm/slub.c:6692
> nsim_queue_mem_free+0xfe/0x190 drivers/net/netdevsim/netdev.c:796
> netdev_rx_queue_reconfig+0x405/0x630 net/core/netdev_rx_queue.c:144
> netdev_rx_queue_restart+0x8f/0xc0 net/core/netdev_rx_queue.c:183
> nsim_qreset_write+0x2e3/0x410 drivers/net/netdevsim/netdev.c:887
>
> Reported-by: syzbot+c06674caba265dc61d46@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=c06674caba265dc61d46
> Fixes: 5bc8e8dbef27 ("netdevsim: add queue management API support")
> Tested-by: syzbot+c06674caba265dc61d46@syzkaller.appspotmail.com
> Signed-off-by: Subasri S <subasris1210@gmail.com>
> ---
> Changes in v2:
> - Restore rxq->napi when reset mode is 1
> - Link to v1: https://lore.kernel.org/r/20260812-net-netdevsim-v1-1-521a85e4fe91@gmail.com
This appears to be addressing the same issue as:
- [PATCH net] netdevsim: update queue NAPI association on queue reset
https://lore.kernel.org/netdev/20260817082511.2300402-1-edumazet@google.com/
prev parent reply other threads:[~2026-08-18 13:25 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-08-15 2:49 [PATCH v2] netdevsim: update rxq->napi pointer during queue reset Subasri S
2026-08-18 13:25 ` Simon Horman [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260818132505.GG265046@horms.kernel.org \
--to=horms@kernel.org \
--cc=almasrymina@google.com \
--cc=andrew+netdev@lunn.ch \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=hawk@kernel.org \
--cc=john.fastabend@gmail.com \
--cc=kuba@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=sdf@fomichev.me \
--cc=subasris1210@gmail.com \
--cc=syzbot+c06674caba265dc61d46@syzkaller.appspotmail.com \
--cc=willemb@google.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.