[PATCH net] netdevsim: fix panic when NETIF_F_LOOPBACK is set on a VF port

[PATCH net] netdevsim: fix panic when NETIF_F_LOOPBACK is set on a VF port

[Jiayuan Chen]

A netdevsim VF port cannot process incoming data.  It never runs
nsim_queue_init(), so ns->rq is NULL, and nsim_vf_netdev_ops has no
->ndo_open, so its NAPI is never set up either.

Since commit 358008f41d9b ("netdevsim: add loopback support") an outgoing
netdevsim can also be the incoming device.  nsim_setup() is shared by PF
and VF ports and offers NETIF_F_LOOPBACK to both, so the feature can be
turned on for a VF; nsim_start_xmit() then takes ns as peer_ns and
dereferences peer_ns->rq[], which panics.

Disable NETIF_F_LOOPBACK on VF ports.

Reproduce in qemu:
  modprobe netdevsim
  echo "90 1" > /sys/bus/netdevsim/new_device
  echo 2 > /sys/bus/netdevsim/devices/netdevsim90/sriov_numvfs
  devlink dev eswitch set netdevsim/netdevsim90 mode switchdev
  ethtool -K eth2 loopback on   # eth2 is the vfnum 0 port
  ip link set eth2 up

Panic:
  KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
  CPU: 0 UID: 0 PID: 141 Comm: kworker/0:3 Not tainted 7.2.0+ #338 PREEMPT
  Workqueue: mld mld_ifc_work
  RIP: 0010:nsim_start_xmit (drivers/net/netdevsim/netdev.c:159)
  dev_hard_start_xmit ( net/core/dev.c:3953)
  sch_direct_xmit (net/sched/sch_generic.c:372)
  __dev_queue_xmit (net/core/dev.c:4262 net/core/dev.c:4884)
  neigh_resolve_output (net/core/neighbour.c:1616)
  ip6_finish_output2 (net/ipv6/ip6_output.c:138)
  ip6_finish_output (net/ipv6/ip6_output.c:221)
  ip6_output (net/ipv6/ip6_output.c:248)
  ......

Fixes: 358008f41d9b ("netdevsim: add loopback support")
Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev>
---
 drivers/net/netdevsim/netdev.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/drivers/net/netdevsim/netdev.c b/drivers/net/netdevsim/netdev.c
index b4a99f3ceac6..7bb72aea90a0 100644
--- a/drivers/net/netdevsim/netdev.c
+++ b/drivers/net/netdevsim/netdev.c
@@ -1113,6 +1113,14 @@ static int nsim_init_netdevsim_vf(struct netdevsim *ns)
 	int err;
 
 	ns->netdev->netdev_ops = &nsim_vf_netdev_ops;
+
+	/* nsim_setup() offers NETIF_F_LOOPBACK to every port, but a VF port
+	 * has neither queues nor NAPI, and looping a frame back means
+	 * receiving it.
+	 */
+	ns->netdev->hw_features &= ~NETIF_F_LOOPBACK;
+	ns->netdev->features &= ~NETIF_F_LOOPBACK;
+
 	rtnl_lock();
 	err = register_netdevice(ns->netdev);
 	rtnl_unlock();
-- 
2.43.0

Re: [PATCH net] netdevsim: fix panic when NETIF_F_LOOPBACK is set on a VF port

[Jakub Kicinski]

On Mon, 31 Aug 2026 12:22:20 +0800 Jiayuan Chen wrote:
> A netdevsim VF port cannot process incoming data.  It never runs
> nsim_queue_init(), so ns->rq is NULL, and nsim_vf_netdev_ops has no
> ->ndo_open, so its NAPI is never set up either.  
> 
> Since commit 358008f41d9b ("netdevsim: add loopback support") an outgoing
> netdevsim can also be the incoming device.  nsim_setup() is shared by PF
> and VF ports and offers NETIF_F_LOOPBACK to both, so the feature can be
> turned on for a VF; nsim_start_xmit() then takes ns as peer_ns and
> dereferences peer_ns->rq[], which panics.

None of the offloads are there either, hm.. VF already has its own
net_device_ops struct. Let's replace:

       .ndo_start_xmit         = nsim_start_xmit,

with some dedicated nsim_start_xmit_vf() which unconditionally
drops the traffic? Even if we clear the LOOPBACK it will be easy
to re-introduce the bug by adding some PF-only code in the PF xmit.
-- 
pw-bot: cr