Re: [PATCH net v3 3/4] netdevsim: support devmem RX and TX bindings

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] netdevsim: NULL pointer dereference in nsim_pp_hold_write() for VF
--

commit d75afa7b1b5f97be20adbad5ccb5b51d01ca5219
Author: Mina Almasry <almasrymina@google.com>
Date:   Wed Oct 14 16:17:53 2026 +0000

netdevsim: support devmem RX and TX bindings

This commit enables NETMEM_TX_DMA and configures page_pool instances to
support devmem bind-rx and bind-tx operations in netdevsim software tests.
It updates the pp_hold debugfs file to allocate pages from queue 0, adds
a netdev instance lock to prevent concurrent binding swaps, and checks if
the pool is backed by a memory provider.

> diff --git a/drivers/net/netdevsim/netdev.c b/drivers/net/netdevsim/netdev.c
> index b4a99f3ceac60..357ea9e5623b3 100644
> --- a/drivers/net/netdevsim/netdev.c
> +++ b/drivers/net/netdevsim/netdev.c

[ ... ]

> @@ -929,12 +939,15 @@ nsim_pp_hold_write(struct file *file, const char __user *data,
>  		return ret;
>  
>  	rtnl_lock();
> +	netdev_lock(ns->netdev);
>  	ret = count;
>  	if (val == !!ns->page)
>  		goto exit;
>  
>  	if (!netif_running(ns->netdev) && val) {
>  		ret = -ENETDOWN;
> +	} else if (val && page_pool_is_unreadable(ns->rq[0]->page_pool)) {

[Severity: High]
Does this code dereference a NULL pointer for Virtual Function (VF)
interfaces?

When a VF interface is created and brought up (e.g., via
ip link set dev ethX up, setting netif_running() to true), nsim_queue_init()
is skipped during VF creation, which leaves ns->rq as NULL.

If a user with debugfs write permissions then writes to the VF's pp_hold
file, this condition attempts to evaluate ns->rq[0], dereferencing NULL and
causing a kernel panic.

> +		ret = -EOPNOTSUPP;
>  	} else if (val) {
>  		ns->page = page_pool_dev_alloc_pages(ns->rq[0]->page_pool);
>  		if (!ns->page)

[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261014161754.3782346-1-almasrymina@google.com?part=3