Re: [RFC net-next 03/15] net: Add memory provider capabilities

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] net: Use-After-Free in NAPI poll due to erroneous kick after failed queue rollback
--

commit 6916b55bc2fd7fcbee42e2cf1fc4f277ee96ed12
Author: Björn Töpel <bjorn@kernel.org>

    net: Add memory provider capabilities
    
    The current memory providers, devmem and io_uring zero-copy RX, give
    memory that the CPU cannot read. The core allows them only on queues
    with header-data split on, a zero header-split threshold, and no XDP
    program. AF_XDP needs a provider that the CPU can read and that
    works with XDP.

> diff --git a/net/core/netdev_rx_queue.c b/net/core/netdev_rx_queue.c
> index 00a7011eb4d57..610e31d1a7173 100644
> --- a/net/core/netdev_rx_queue.c
> +++ b/net/core/netdev_rx_queue.c
[ ... ]
> @@ -165,6 +197,11 @@ static int netdev_rx_queue_reconfig(struct net_device *dev,
>  
>  err_free_new_queue_mem:
>  	qops->ndo_queue_mem_free(dev, new_mem);
> +	/* Freeing the replacement can hand provider memory back to the old
> +	 * queue, which still runs unless the rollback failed.
> +	 */
> +	if (err != -ENETDOWN && netif_running(dev))
> +		netdev_rx_queue_kick(rxq);
>  
>  err_free_old_mem:
>  	kvfree(old_mem);

[Severity: High]
Does this code risk a use-after-free if the queue rollback fails?

If ndo_queue_start() fails during the rollback, the old memory is freed, but
err is not updated to reflect the failure:

net/core/netdev_rx_queue.c:netdev_rx_queue_reconfig() {
err_start_queue:
	if (qops->ndo_queue_start(dev, qcfg_old, old_mem, rxq_idx)) {
		WARN(1, ...);
		qops->ndo_queue_mem_free(dev, old_mem);
	}

err_free_new_queue_mem:
	qops->ndo_queue_mem_free(dev, new_mem);
	/* err still holds its previous value (e.g., -ENOMEM) */
	if (err != -ENETDOWN && netif_running(dev))
		netdev_rx_queue_kick(rxq);

Because err isn't updated to -ENETDOWN when the rollback fails, the kick will
proceed and schedule a NAPI poll on a stopped queue whose memory was just
freed.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261002190018.696925-1-bjorn@kernel.org?part=3