Re: [PATCH v1 net] netdevsim: Fix wild pointer access in nsim_queue_free().

[Kuniyuki Iwashima <kuniyu@google.com>]

On Fri, Aug 1, 2025 at 12:35 AM Eric Dumazet <edumazet@google.com> wrote:
>
> On Thu, Jul 31, 2025 at 11:48 AM Kuniyuki Iwashima <kuniyu@google.com> wrote:
> >
> > syzbot reported the splat below. [0]
> >
> > When nsim_queue_uninit() is called from nsim_init_netdevsim(),
> > register_netdevice() has not been called, thus dev->dstats has
> > not been allocated.
> >
> > Let's not call dev_dstats_rx_dropped_add() in such a case.
> >
> >
> > Fixes: 2a68a22304f9 ("netdevsim: account dropped packet length in stats on queue free")
> > Reported-by: syzbot+8aa80c6232008f7b957d@syzkaller.appspotmail.com
> > Closes: https://lore.kernel.org/netdev/688bb9ca.a00a0220.26d0e1.0050.GAE@google.com/
> > Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
> > ---
> >  drivers/net/netdevsim/netdev.c | 10 +++++++---
> >  1 file changed, 7 insertions(+), 3 deletions(-)
> >
> > diff --git a/drivers/net/netdevsim/netdev.c b/drivers/net/netdevsim/netdev.c
> > index 39fe28af48b9..5cbc005136d8 100644
> > --- a/drivers/net/netdevsim/netdev.c
> > +++ b/drivers/net/netdevsim/netdev.c
> > @@ -710,9 +710,13 @@ static struct nsim_rq *nsim_queue_alloc(void)
> >  static void nsim_queue_free(struct net_device *dev, struct nsim_rq *rq)
> >  {
> >         hrtimer_cancel(&rq->napi_timer);
> > -       local_bh_disable();
> > -       dev_dstats_rx_dropped_add(dev, rq->skb_queue.qlen);
> > -       local_bh_enable();
> > +
> > +       if (likely(dev->reg_state != NETREG_UNINITIALIZED)) {
>
> I find this test about reg_state a bit fragile...
>
> I probably would have made dev_dstats_rx_dropped_add() a bit stronger,
> it is not used in a fast path.

I thought I should avoid local_bh_disable() too, but yes,
it's unlikely and in the slow path.

I'll use the blow diff in v2.

Thank you Eric!

>
> diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
> index 5e5de4b0a433c6613224b53750921ab9f5a39c85..0b7ad5ae4b85d480aee8531e821027e6ebe7119b
> 100644
> --- a/include/linux/netdevice.h
> +++ b/include/linux/netdevice.h
> @@ -3021,11 +3021,13 @@ static inline void
> dev_dstats_rx_dropped(struct net_device *dev)
>  static inline void dev_dstats_rx_dropped_add(struct net_device *dev,
>                                              unsigned int packets)
>  {
> -       struct pcpu_dstats *dstats = this_cpu_ptr(dev->dstats);
> +       if (dev->dstats) {
> +               struct pcpu_dstats *dstats = this_cpu_ptr(dev->dstats);
>
> -       u64_stats_update_begin(&dstats->syncp);
> -       u64_stats_add(&dstats->rx_drops, packets);
> -       u64_stats_update_end(&dstats->syncp);
> +               u64_stats_update_begin(&dstats->syncp);
> +               u64_stats_add(&dstats->rx_drops, packets);
> +               u64_stats_update_end(&dstats->syncp);
> +       }
>  }
>
>  static inline void dev_dstats_tx_add(struct net_device *dev,