[PATCH] netdevsim: update rxq->napi pointer during queue reset

[PATCH] netdevsim: update rxq->napi pointer during queue reset

[Subasri S]

In netdevsim, when queue reset is performed using debugfs, it triggers
these sequence of operations: nsim_queue_stop() -> nsim_queue_start()
-> nsim_queue_mem_free(). nsim_queue_mem_free() frees the old
nsim_rq struct which embeds the napi_struct. But the rxq->napi pointer
in the struct netdev_rx_queue still points to the old nsim_rq's embedded
napi_struct. So, any subsequent xsk_bind() which reads rxq->napi->napi_id
after a queue reset is a use-after-free.

Add netif_queue_set_napi() calls to nsim_queue_stop() and
nsim_queue_start() which clears the rxq->napi during stop
and sets it to the new napi instance during start.

KASAN report:

Call Trace:
 kasan_report+0xdf/0x1c0 mm/kasan/report.c:595
 xsk_bind+0x1582/0x16c0 net/xdp/xsk.c:1758
 __sys_bind_socket net/socket.c:1920 [inline]
 __sys_bind_socket net/socket.c:1912 [inline]
 __sys_bind+0x1a9/0x260 net/socket.c:1951

Allocated by task 5622:
 nsim_queue_alloc+0x3c/0x140 drivers/net/netdevsim/netdev.c:715
 nsim_queue_init drivers/net/netdevsim/netdev.c:1012 [inline]
 nsim_init_netdevsim drivers/net/netdevsim/netdev.c:1059 [inline]
 nsim_create+0xb13/0x1420 drivers/net/netdevsim/netdev.c:1152
 __nsim_dev_port_add+0x3ba/0x8f0 drivers/net/netdevsim/dev.c:1509
 nsim_dev_port_add_all drivers/net/netdevsim/dev.c:1570 [inline]
 nsim_drv_probe+0xdbd/0x13a0 drivers/net/netdevsim/dev.c:1731

Freed by task 5659:
 slab_free mm/slub.c:6377 [inline]
 kfree+0x22b/0x6c0 mm/slub.c:6692
 nsim_queue_mem_free+0xfe/0x190 drivers/net/netdevsim/netdev.c:796
 netdev_rx_queue_reconfig+0x405/0x630 net/core/netdev_rx_queue.c:144
 netdev_rx_queue_restart+0x8f/0xc0 net/core/netdev_rx_queue.c:183
 nsim_qreset_write+0x2e3/0x410 drivers/net/netdevsim/netdev.c:887

Reported-by: syzbot+c06674caba265dc61d46@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=c06674caba265dc61d46
Fixes: 5bc8e8dbef27 ("netdevsim: add queue management API support")
Tested-by: syzbot+c06674caba265dc61d46@syzkaller.appspotmail.com
Signed-off-by: Subasri S <subasris1210@gmail.com>
---
 drivers/net/netdevsim/netdev.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/net/netdevsim/netdev.c b/drivers/net/netdevsim/netdev.c
index 4e9d7e10b527..c18f9f540084 100644
--- a/drivers/net/netdevsim/netdev.c
+++ b/drivers/net/netdevsim/netdev.c
@@ -826,6 +826,8 @@ nsim_queue_start(struct net_device *dev, struct netdev_queue_config *qcfg,
 	}
 
 	ns->rq[idx] = qmem->rq;
+	netif_queue_set_napi(dev, idx, NETDEV_QUEUE_TYPE_RX,
+			     &ns->rq[idx]->napi);
 	napi_enable_locked(&ns->rq[idx]->napi);
 
 	return 0;
@@ -838,6 +840,7 @@ static int nsim_queue_stop(struct net_device *dev, void *per_queue_mem, int idx)
 
 	netdev_assert_locked(dev);
 
+	netif_queue_set_napi(dev, idx, NETDEV_QUEUE_TYPE_RX, NULL);
 	napi_disable_locked(&ns->rq[idx]->napi);
 
 	if (ns->rq_reset_mode == 1) {

---
base-commit: a59f57e2aa127c5354168d2ec4bac920df1be4f4
change-id: 20260812-net-netdevsim-aad6100834dd

Best regards,
-- 
Subasri S <subasris1210@gmail.com>

Re: [PATCH] netdevsim: update rxq->napi pointer during queue reset

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] The patch clears `rxq->napi` in `nsim_queue_stop()` but fails to restore it in `nsim_queue_start()` when `rq_reset_mode == 1`, breaking NAPI-dependent features.
--

--- Patch [1]: [PATCH] netdevsim: update rxq->napi pointer during queue reset ---
commit a7e8e5d48bb567359bb7891a0b39d7f888c35d27
Author: Subasri S <subasris1210@gmail.com>

netdevsim: update rxq->napi pointer during queue reset

This commit addresses a use-after-free issue by properly clearing and setting
the rxq->napi pointer during a queue reset. It modifies nsim_queue_stop() to
clear the pointer and nsim_queue_start() to set it to the new napi instance.

Closes: https://syzkaller.appspot.com/bug?extid=c06674caba265dc61d46

> diff --git a/drivers/net/netdevsim/netdev.c b/drivers/net/netdevsim/netdev.c
> index 4e9d7e10b527e..c18f9f540084a 100644
> --- a/drivers/net/netdevsim/netdev.c
> +++ b/drivers/net/netdevsim/netdev.c

[ ... ]

> @@ -826,6 +826,8 @@ nsim_queue_start(struct net_device *dev, struct netdev_queue_config *qcfg,
>  	}
>  
>  	ns->rq[idx] = qmem->rq;
> +	netif_queue_set_napi(dev, idx, NETDEV_QUEUE_TYPE_RX,
> +			     &ns->rq[idx]->napi);

[Severity: Medium]
Will this leave rxq->napi as NULL when ns->rq_reset_mode == 1?

Since nsim_queue_stop() now unconditionally sets the pointer to NULL:

drivers/net/netdevsim/netdev.c:nsim_queue_stop() {
	...
	netif_queue_set_napi(dev, idx, NETDEV_QUEUE_TYPE_RX, NULL);
	...
}

Earlier in this function (nsim_queue_start), there is an early return
for rq_reset_mode == 1 that bypasses the new restoration code:

drivers/net/netdevsim/netdev.c:nsim_queue_start() {
	...
	if (ns->rq_reset_mode == 1) {
		ns->rq[idx]->page_pool = qmem->pp;
		napi_enable_locked(&ns->rq[idx]->napi);
		return 0;
	}
	...
}

Does this skip restoring rxq->napi, leaving it NULL and preventing XSK busy
polling from working after a reset in mode 1?

>  	napi_enable_locked(&ns->rq[idx]->napi);
>  
>  	return 0;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260812-net-netdevsim-v1-1-521a85e4fe91@gmail.com?part=1