[PATCH net] netdevsim: update queue NAPI association on queue reset

[PATCH net] netdevsim: update queue NAPI association on queue reset

[Eric Dumazet]

In netdevsim, receive queues (struct nsim_rq) embed their own struct
napi_struct. When queue reset is performed (e.g. via queue_reset
debugfs), nsim_queue_start() swaps in a newly allocated struct nsim_rq,
and nsim_queue_mem_free() later deletes and frees the old one.

However, nsim_queue_start() failed to update the queue-to-NAPI mapping
via netif_queue_set_napi(). As a result, dev->_rx[idx].napi continued to
point to the old NAPI struct. After the old queue was freed, a subsequent
queue dump via Netlink (NETDEV_CMD_QUEUE_GET) triggered a KASAN
slab-use-after-free read in nla_put_napi_id() when accessing
rxq->napi->napi_id.

Fix this by calling netif_queue_set_napi() in nsim_queue_start() to
associate the new NAPI with the RX queue, and clear the association
with netif_queue_set_napi(..., NULL) in nsim_del_napi() during teardown.

Fixes: 5bc8e8dbef27 ("netdevsim: add queue management API support")
Reported-by: syzbot+483a6efbc4882c1201ee@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/netdev/6a82c3d4.f7a79266.2f965f.0024.GAE@google.com/T/#u
Signed-off-by: Eric Dumazet <edumazet@google.com>
---
 drivers/net/netdevsim/netdev.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/netdevsim/netdev.c b/drivers/net/netdevsim/netdev.c
index 4e9d7e10b527e5e4127331c141e4197afe0efa07..b4a99f3ceac60b66db4b30280db403d4e4319c99 100644
--- a/drivers/net/netdevsim/netdev.c
+++ b/drivers/net/netdevsim/netdev.c
@@ -529,6 +529,7 @@ static void nsim_del_napi(struct netdevsim *ns)
 	for (i = 0; i < dev->num_rx_queues; i++) {
 		struct nsim_rq *rq = ns->rq[i];
 
+		netif_queue_set_napi(dev, i, NETDEV_QUEUE_TYPE_RX, NULL);
 		napi_disable_locked(&rq->napi);
 		__netif_napi_del_locked(&rq->napi);
 	}
@@ -826,6 +827,7 @@ nsim_queue_start(struct net_device *dev, struct netdev_queue_config *qcfg,
 	}
 
 	ns->rq[idx] = qmem->rq;
+	netif_queue_set_napi(dev, idx, NETDEV_QUEUE_TYPE_RX, &ns->rq[idx]->napi);
 	napi_enable_locked(&ns->rq[idx]->napi);
 
 	return 0;
-- 
2.55.0.699.gb54405d56f-goog

Re: [PATCH net] netdevsim: update queue NAPI association on queue reset

[Vadim Fedorenko]

On 17/08/2026 09:25, Eric Dumazet wrote:
> In netdevsim, receive queues (struct nsim_rq) embed their own struct
> napi_struct. When queue reset is performed (e.g. via queue_reset
> debugfs), nsim_queue_start() swaps in a newly allocated struct nsim_rq,
> and nsim_queue_mem_free() later deletes and frees the old one.
> 
> However, nsim_queue_start() failed to update the queue-to-NAPI mapping
> via netif_queue_set_napi(). As a result, dev->_rx[idx].napi continued to
> point to the old NAPI struct. After the old queue was freed, a subsequent
> queue dump via Netlink (NETDEV_CMD_QUEUE_GET) triggered a KASAN
> slab-use-after-free read in nla_put_napi_id() when accessing
> rxq->napi->napi_id.
> 
> Fix this by calling netif_queue_set_napi() in nsim_queue_start() to
> associate the new NAPI with the RX queue, and clear the association
> with netif_queue_set_napi(..., NULL) in nsim_del_napi() during teardown.
> 
> Fixes: 5bc8e8dbef27 ("netdevsim: add queue management API support")
> Reported-by: syzbot+483a6efbc4882c1201ee@syzkaller.appspotmail.com
> Closes: https://lore.kernel.org/netdev/6a82c3d4.f7a79266.2f965f.0024.GAE@google.com/T/#u
> Signed-off-by: Eric Dumazet <edumazet@google.com>
> ---
>   drivers/net/netdevsim/netdev.c | 2 ++
>   1 file changed, 2 insertions(+)
> 
> diff --git a/drivers/net/netdevsim/netdev.c b/drivers/net/netdevsim/netdev.c
> index 4e9d7e10b527e5e4127331c141e4197afe0efa07..b4a99f3ceac60b66db4b30280db403d4e4319c99 100644
> --- a/drivers/net/netdevsim/netdev.c
> +++ b/drivers/net/netdevsim/netdev.c
> @@ -529,6 +529,7 @@ static void nsim_del_napi(struct netdevsim *ns)
>   	for (i = 0; i < dev->num_rx_queues; i++) {
>   		struct nsim_rq *rq = ns->rq[i];
>   
> +		netif_queue_set_napi(dev, i, NETDEV_QUEUE_TYPE_RX, NULL);
>   		napi_disable_locked(&rq->napi);
>   		__netif_napi_del_locked(&rq->napi);
>   	}
> @@ -826,6 +827,7 @@ nsim_queue_start(struct net_device *dev, struct netdev_queue_config *qcfg,
>   	}
>   
>   	ns->rq[idx] = qmem->rq;
> +	netif_queue_set_napi(dev, idx, NETDEV_QUEUE_TYPE_RX, &ns->rq[idx]->napi);
>   	napi_enable_locked(&ns->rq[idx]->napi);
>   
>   	return 0;

Reviewed-by: Vadim Fedorenko <vadim.fedorenko@linux.dev>