* [PATCH] um: vector: fix NULL pointer derefs in queue-less transports
@ 2026-04-10 20:30 Michael Bommarito
2026-04-10 20:37 ` Anton Ivanov
0 siblings, 1 reply; 2+ messages in thread
From: Michael Bommarito @ 2026-04-10 20:30 UTC (permalink / raw)
To: richard, anton.ivanov, johannes
Cc: linux-um, linux-kernel, stable, Michael Bommarito
TAP transport sets neither VECTOR_RX nor VECTOR_TX, so
vector_net_open() never allocates rx_queue or tx_queue. HYBRID sets
VECTOR_RX but not VECTOR_TX, so tx_queue is NULL there too.
vector_reset_stats(), vector_poll(), vector_get_ethtool_stats(), and
vector_get_ringparam() unconditionally deref these queue pointers,
causing a NULL pointer crash on SMP or with any lock debugging option.
Guard all queue pointer accesses with NULL checks.
Fixes: 49da7e64f33e ("High Performance UML Vector Network Driver")
Cc: stable@vger.kernel.org
Cc: Anton Ivanov <anton.ivanov@cambridgegreys.com>
Assisted-by: Claude:claude-opus-4-6
Assisted-by: Codex:gpt-5-4
Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
---
Found while enabling KCOV and lockdep on UML for a network-stack
test lab. Tested boot with SMP=y + PROVE_LOCKING + DEBUG_SPINLOCK +
DEBUG_LOCK_ALLOC + LOCKDEP + KCOV, all with vec0:transport=tap.
Without the fix, the same config panics at addr 0x18 (SMP, no debug),
0x1c (DEBUG_SPINLOCK), or 0x30 (lockdep) -- all offsets into a NULL
vector_queue pointer.
arch/um/drivers/vector_kern.c | 48 +++++++++++++++++------------------
1 file changed, 24 insertions(+), 24 deletions(-)
diff --git a/arch/um/drivers/vector_kern.c b/arch/um/drivers/vector_kern.c
index 2cc90055499a5..6134c376e57be 100644
--- a/arch/um/drivers/vector_kern.c
+++ b/arch/um/drivers/vector_kern.c
@@ -105,25 +105,18 @@ static const struct {
static void vector_reset_stats(struct vector_private *vp)
{
- /* We reuse the existing queue locks for stats */
-
- /* RX stats are modified with RX head_lock held
- * in vector_poll.
- */
-
- spin_lock(&vp->rx_queue->head_lock);
+ if (vp->rx_queue)
+ spin_lock(&vp->rx_queue->head_lock);
vp->estats.rx_queue_max = 0;
vp->estats.rx_queue_running_average = 0;
vp->estats.rx_encaps_errors = 0;
vp->estats.sg_ok = 0;
vp->estats.sg_linearized = 0;
- spin_unlock(&vp->rx_queue->head_lock);
-
- /* TX stats are modified with TX head_lock held
- * in vector_send.
- */
+ if (vp->rx_queue)
+ spin_unlock(&vp->rx_queue->head_lock);
- spin_lock(&vp->tx_queue->head_lock);
+ if (vp->tx_queue)
+ spin_lock(&vp->tx_queue->head_lock);
vp->estats.tx_timeout_count = 0;
vp->estats.tx_restart_queue = 0;
vp->estats.tx_kicks = 0;
@@ -131,7 +124,8 @@ static void vector_reset_stats(struct vector_private *vp)
vp->estats.tx_flow_control_xoff = 0;
vp->estats.tx_queue_max = 0;
vp->estats.tx_queue_running_average = 0;
- spin_unlock(&vp->tx_queue->head_lock);
+ if (vp->tx_queue)
+ spin_unlock(&vp->tx_queue->head_lock);
}
static int get_mtu(struct arglist *def)
@@ -1163,7 +1157,8 @@ static int vector_poll(struct napi_struct *napi, int budget)
if ((vp->options & VECTOR_TX) != 0)
tx_enqueued = (vector_send(vp->tx_queue) > 0);
- spin_lock(&vp->rx_queue->head_lock);
+ if (vp->rx_queue)
+ spin_lock(&vp->rx_queue->head_lock);
if ((vp->options & VECTOR_RX) > 0)
err = vector_mmsg_rx(vp, budget);
else {
@@ -1171,7 +1166,8 @@ static int vector_poll(struct napi_struct *napi, int budget)
if (err > 0)
err = 1;
}
- spin_unlock(&vp->rx_queue->head_lock);
+ if (vp->rx_queue)
+ spin_unlock(&vp->rx_queue->head_lock);
if (err > 0)
work_done += err;
@@ -1421,10 +1417,10 @@ static void vector_get_ringparam(struct net_device *netdev,
{
struct vector_private *vp = netdev_priv(netdev);
- ring->rx_max_pending = vp->rx_queue->max_depth;
- ring->tx_max_pending = vp->tx_queue->max_depth;
- ring->rx_pending = vp->rx_queue->max_depth;
- ring->tx_pending = vp->tx_queue->max_depth;
+ ring->rx_max_pending = vp->rx_queue ? vp->rx_queue->max_depth : 0;
+ ring->tx_max_pending = vp->tx_queue ? vp->tx_queue->max_depth : 0;
+ ring->rx_pending = ring->rx_max_pending;
+ ring->tx_pending = ring->tx_max_pending;
}
static void vector_get_strings(struct net_device *dev, u32 stringset, u8 *buf)
@@ -1466,11 +1462,15 @@ static void vector_get_ethtool_stats(struct net_device *dev,
* to date.
*/
- spin_lock(&vp->tx_queue->head_lock);
- spin_lock(&vp->rx_queue->head_lock);
+ if (vp->tx_queue)
+ spin_lock(&vp->tx_queue->head_lock);
+ if (vp->rx_queue)
+ spin_lock(&vp->rx_queue->head_lock);
memcpy(tmp_stats, &vp->estats, sizeof(struct vector_estats));
- spin_unlock(&vp->rx_queue->head_lock);
- spin_unlock(&vp->tx_queue->head_lock);
+ if (vp->rx_queue)
+ spin_unlock(&vp->rx_queue->head_lock);
+ if (vp->tx_queue)
+ spin_unlock(&vp->tx_queue->head_lock);
}
static int vector_get_coalesce(struct net_device *netdev,
--
2.53.0
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] um: vector: fix NULL pointer derefs in queue-less transports
2026-04-10 20:30 [PATCH] um: vector: fix NULL pointer derefs in queue-less transports Michael Bommarito
@ 2026-04-10 20:37 ` Anton Ivanov
0 siblings, 0 replies; 2+ messages in thread
From: Anton Ivanov @ 2026-04-10 20:37 UTC (permalink / raw)
To: Michael Bommarito, richard, johannes; +Cc: linux-um, linux-kernel, stable
On 10/04/2026 21:30, Michael Bommarito wrote:
> TAP transport sets neither VECTOR_RX nor VECTOR_TX, so
> vector_net_open() never allocates rx_queue or tx_queue. HYBRID sets
> VECTOR_RX but not VECTOR_TX, so tx_queue is NULL there too.
>
> vector_reset_stats(), vector_poll(), vector_get_ethtool_stats(), and
> vector_get_ringparam() unconditionally deref these queue pointers,
> causing a NULL pointer crash on SMP or with any lock debugging option.
>
> Guard all queue pointer accesses with NULL checks.
>
> Fixes: 49da7e64f33e ("High Performance UML Vector Network Driver")
> Cc: stable@vger.kernel.org
> Cc: Anton Ivanov <anton.ivanov@cambridgegreys.com>
> Assisted-by: Claude:claude-opus-4-6
> Assisted-by: Codex:gpt-5-4
> Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
> ---
> Found while enabling KCOV and lockdep on UML for a network-stack
> test lab. Tested boot with SMP=y + PROVE_LOCKING + DEBUG_SPINLOCK +
> DEBUG_LOCK_ALLOC + LOCKDEP + KCOV, all with vec0:transport=tap.
>
> Without the fix, the same config panics at addr 0x18 (SMP, no debug),
> 0x1c (DEBUG_SPINLOCK), or 0x30 (lockdep) -- all offsets into a NULL
> vector_queue pointer.
>
> arch/um/drivers/vector_kern.c | 48 +++++++++++++++++------------------
> 1 file changed, 24 insertions(+), 24 deletions(-)
>
> diff --git a/arch/um/drivers/vector_kern.c b/arch/um/drivers/vector_kern.c
> index 2cc90055499a5..6134c376e57be 100644
> --- a/arch/um/drivers/vector_kern.c
> +++ b/arch/um/drivers/vector_kern.c
> @@ -105,25 +105,18 @@ static const struct {
>
> static void vector_reset_stats(struct vector_private *vp)
> {
> - /* We reuse the existing queue locks for stats */
> -
> - /* RX stats are modified with RX head_lock held
> - * in vector_poll.
> - */
> -
> - spin_lock(&vp->rx_queue->head_lock);
> + if (vp->rx_queue)
> + spin_lock(&vp->rx_queue->head_lock);
> vp->estats.rx_queue_max = 0;
> vp->estats.rx_queue_running_average = 0;
> vp->estats.rx_encaps_errors = 0;
> vp->estats.sg_ok = 0;
> vp->estats.sg_linearized = 0;
> - spin_unlock(&vp->rx_queue->head_lock);
> -
> - /* TX stats are modified with TX head_lock held
> - * in vector_send.
> - */
> + if (vp->rx_queue)
> + spin_unlock(&vp->rx_queue->head_lock);
>
> - spin_lock(&vp->tx_queue->head_lock);
> + if (vp->tx_queue)
> + spin_lock(&vp->tx_queue->head_lock);
> vp->estats.tx_timeout_count = 0;
> vp->estats.tx_restart_queue = 0;
> vp->estats.tx_kicks = 0;
> @@ -131,7 +124,8 @@ static void vector_reset_stats(struct vector_private *vp)
> vp->estats.tx_flow_control_xoff = 0;
> vp->estats.tx_queue_max = 0;
> vp->estats.tx_queue_running_average = 0;
> - spin_unlock(&vp->tx_queue->head_lock);
> + if (vp->tx_queue)
> + spin_unlock(&vp->tx_queue->head_lock);
> }
>
> static int get_mtu(struct arglist *def)
> @@ -1163,7 +1157,8 @@ static int vector_poll(struct napi_struct *napi, int budget)
>
> if ((vp->options & VECTOR_TX) != 0)
> tx_enqueued = (vector_send(vp->tx_queue) > 0);
> - spin_lock(&vp->rx_queue->head_lock);
> + if (vp->rx_queue)
> + spin_lock(&vp->rx_queue->head_lock);
> if ((vp->options & VECTOR_RX) > 0)
> err = vector_mmsg_rx(vp, budget);
> else {
> @@ -1171,7 +1166,8 @@ static int vector_poll(struct napi_struct *napi, int budget)
> if (err > 0)
> err = 1;
> }
> - spin_unlock(&vp->rx_queue->head_lock);
> + if (vp->rx_queue)
> + spin_unlock(&vp->rx_queue->head_lock);
> if (err > 0)
> work_done += err;
>
> @@ -1421,10 +1417,10 @@ static void vector_get_ringparam(struct net_device *netdev,
> {
> struct vector_private *vp = netdev_priv(netdev);
>
> - ring->rx_max_pending = vp->rx_queue->max_depth;
> - ring->tx_max_pending = vp->tx_queue->max_depth;
> - ring->rx_pending = vp->rx_queue->max_depth;
> - ring->tx_pending = vp->tx_queue->max_depth;
> + ring->rx_max_pending = vp->rx_queue ? vp->rx_queue->max_depth : 0;
> + ring->tx_max_pending = vp->tx_queue ? vp->tx_queue->max_depth : 0;
> + ring->rx_pending = ring->rx_max_pending;
> + ring->tx_pending = ring->tx_max_pending;
> }
>
> static void vector_get_strings(struct net_device *dev, u32 stringset, u8 *buf)
> @@ -1466,11 +1462,15 @@ static void vector_get_ethtool_stats(struct net_device *dev,
> * to date.
> */
>
> - spin_lock(&vp->tx_queue->head_lock);
> - spin_lock(&vp->rx_queue->head_lock);
> + if (vp->tx_queue)
> + spin_lock(&vp->tx_queue->head_lock);
> + if (vp->rx_queue)
> + spin_lock(&vp->rx_queue->head_lock);
> memcpy(tmp_stats, &vp->estats, sizeof(struct vector_estats));
> - spin_unlock(&vp->rx_queue->head_lock);
> - spin_unlock(&vp->tx_queue->head_lock);
> + if (vp->rx_queue)
> + spin_unlock(&vp->rx_queue->head_lock);
> + if (vp->tx_queue)
> + spin_unlock(&vp->tx_queue->head_lock);
> }
>
> static int vector_get_coalesce(struct net_device *netdev,
Acked-By: Anton Ivanov <anton.ivanov@cambridgegreys.com>
--
Anton R. Ivanov
Cambridgegreys Limited. Registered in England. Company Number 10273661
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2026-04-10 20:37 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-04-10 20:30 [PATCH] um: vector: fix NULL pointer derefs in queue-less transports Michael Bommarito
2026-04-10 20:37 ` Anton Ivanov
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox