Re: [PATCH net] virtio_net: atomically disable rx mode work

[sashiko-bot@kernel.org]

> virtio-net uses a boolean to gate rx_mode_work during device teardown.
> The flag is changed under RTNL, but ndo_set_rx_mode checks it under the
> address-list lock. A callback can therefore pass the check and enqueue work
> after teardown has flushed it. The work is also enabled before late
> probe operations that can fail, allowing probe unwind to free the netdev
> with work still queued.
> 
> KASAN reports the worker using a virtqueue that probe unwind already freed:
> 
>   BUG: KASAN: slab-use-after-free in virtqueue_add_split
>   Workqueue: events virtnet_rx_mode_work
>   Call Trace:
>    virtqueue_add_split (drivers/virtio/virtio_ring.c:706)
>    virtqueue_add_sgs (drivers/virtio/virtio_ring.c:2839)
>    virtnet_send_command_reply (drivers/net/virtio_net.c:3565)
> [ ... ]
> Fixes: b9f7425239a0 ("virtio-net: convert rx mode setting to use workqueue")
> Cc: stable@vger.kernel.org
> Reported-by: <co+d17c2bc750a9cbbb@bugs.sh>
> Assisted-by: LLM
> Signed-off-by: Weiming Shi <bestswngs@gmail.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261017114237.2786302-2-bestswngs@gmail.com?part=1