Re: [PATCH v1 net] netdevsim: Fix wild pointer access in nsim_queue_free().

[Eric Dumazet <edumazet@google.com>]

On Thu, Jul 31, 2025 at 11:48 AM Kuniyuki Iwashima <kuniyu@google.com> wrote:
>
> syzbot reported the splat below. [0]
>
> When nsim_queue_uninit() is called from nsim_init_netdevsim(),
> register_netdevice() has not been called, thus dev->dstats has
> not been allocated.
>
> Let's not call dev_dstats_rx_dropped_add() in such a case.
>
>
> Fixes: 2a68a22304f9 ("netdevsim: account dropped packet length in stats on queue free")
> Reported-by: syzbot+8aa80c6232008f7b957d@syzkaller.appspotmail.com
> Closes: https://lore.kernel.org/netdev/688bb9ca.a00a0220.26d0e1.0050.GAE@google.com/
> Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
> ---
>  drivers/net/netdevsim/netdev.c | 10 +++++++---
>  1 file changed, 7 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/net/netdevsim/netdev.c b/drivers/net/netdevsim/netdev.c
> index 39fe28af48b9..5cbc005136d8 100644
> --- a/drivers/net/netdevsim/netdev.c
> +++ b/drivers/net/netdevsim/netdev.c
> @@ -710,9 +710,13 @@ static struct nsim_rq *nsim_queue_alloc(void)
>  static void nsim_queue_free(struct net_device *dev, struct nsim_rq *rq)
>  {
>         hrtimer_cancel(&rq->napi_timer);
> -       local_bh_disable();
> -       dev_dstats_rx_dropped_add(dev, rq->skb_queue.qlen);
> -       local_bh_enable();
> +
> +       if (likely(dev->reg_state != NETREG_UNINITIALIZED)) {

I find this test about reg_state a bit fragile...

I probably would have made dev_dstats_rx_dropped_add() a bit stronger,
it is not used in a fast path.

diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index 5e5de4b0a433c6613224b53750921ab9f5a39c85..0b7ad5ae4b85d480aee8531e821027e6ebe7119b
100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -3021,11 +3021,13 @@ static inline void
dev_dstats_rx_dropped(struct net_device *dev)
 static inline void dev_dstats_rx_dropped_add(struct net_device *dev,
                                             unsigned int packets)
 {
-       struct pcpu_dstats *dstats = this_cpu_ptr(dev->dstats);
+       if (dev->dstats) {
+               struct pcpu_dstats *dstats = this_cpu_ptr(dev->dstats);

-       u64_stats_update_begin(&dstats->syncp);
-       u64_stats_add(&dstats->rx_drops, packets);
-       u64_stats_update_end(&dstats->syncp);
+               u64_stats_update_begin(&dstats->syncp);
+               u64_stats_add(&dstats->rx_drops, packets);
+               u64_stats_update_end(&dstats->syncp);
+       }
 }

 static inline void dev_dstats_tx_add(struct net_device *dev,