netdev - Re: [PATCH v1 net] netdevsim: Fix wild pointer access in nsim_queue

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CANn89iJKYPAMR+ofaJLsQpew2E-0DH4eLh5-QF7tB56-8BfWxg@mail.gmail.com>
Date: Fri, 1 Aug 2025 00:35:14 -0700
From: Eric Dumazet <edumazet@...gle.com>
To: Kuniyuki Iwashima <kuniyu@...gle.com>
Cc: Andrew Lunn <andrew+netdev@...n.ch>, "David S. Miller" <davem@...emloft.net>, 
	Jakub Kicinski <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>, Breno Leitao <leitao@...ian.org>, 
	Kuniyuki Iwashima <kuni1840@...il.com>, netdev@...r.kernel.org, 
	syzbot+8aa80c6232008f7b957d@...kaller.appspotmail.com
Subject: Re: [PATCH v1 net] netdevsim: Fix wild pointer access in nsim_queue_free().

On Thu, Jul 31, 2025 at 11:48 AM Kuniyuki Iwashima <kuniyu@...gle.com> wrote:
>
> syzbot reported the splat below. [0]
>
> When nsim_queue_uninit() is called from nsim_init_netdevsim(),
> register_netdevice() has not been called, thus dev->dstats has
> not been allocated.
>
> Let's not call dev_dstats_rx_dropped_add() in such a case.
>
>
> Fixes: 2a68a22304f9 ("netdevsim: account dropped packet length in stats on queue free")
> Reported-by: syzbot+8aa80c6232008f7b957d@...kaller.appspotmail.com
> Closes: https://lore.kernel.org/netdev/688bb9ca.a00a0220.26d0e1.0050.GAE@google.com/
> Signed-off-by: Kuniyuki Iwashima <kuniyu@...gle.com>
> ---
>  drivers/net/netdevsim/netdev.c | 10 +++++++---
>  1 file changed, 7 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/net/netdevsim/netdev.c b/drivers/net/netdevsim/netdev.c
> index 39fe28af48b9..5cbc005136d8 100644
> --- a/drivers/net/netdevsim/netdev.c
> +++ b/drivers/net/netdevsim/netdev.c
> @@ -710,9 +710,13 @@ static struct nsim_rq *nsim_queue_alloc(void)
>  static void nsim_queue_free(struct net_device *dev, struct nsim_rq *rq)
>  {
>         hrtimer_cancel(&rq->napi_timer);
> -       local_bh_disable();
> -       dev_dstats_rx_dropped_add(dev, rq->skb_queue.qlen);
> -       local_bh_enable();
> +
> +       if (likely(dev->reg_state != NETREG_UNINITIALIZED)) {

I find this test about reg_state a bit fragile...

I probably would have made dev_dstats_rx_dropped_add() a bit stronger,
it is not used in a fast path.

diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index 5e5de4b0a433c6613224b53750921ab9f5a39c85..0b7ad5ae4b85d480aee8531e821027e6ebe7119b
100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -3021,11 +3021,13 @@ static inline void
dev_dstats_rx_dropped(struct net_device *dev)
 static inline void dev_dstats_rx_dropped_add(struct net_device *dev,
                                             unsigned int packets)
 {
-       struct pcpu_dstats *dstats = this_cpu_ptr(dev->dstats);
+       if (dev->dstats) {
+               struct pcpu_dstats *dstats = this_cpu_ptr(dev->dstats);

-       u64_stats_update_begin(&dstats->syncp);
-       u64_stats_add(&dstats->rx_drops, packets);
-       u64_stats_update_end(&dstats->syncp);
+               u64_stats_update_begin(&dstats->syncp);
+               u64_stats_add(&dstats->rx_drops, packets);
+               u64_stats_update_end(&dstats->syncp);
+       }
 }

 static inline void dev_dstats_tx_add(struct net_device *dev,