* Re: [PATCH net V1] veth: prevent NULL pointer dereference in veth_xdp_rcv
2025-06-11 12:40 ` [PATCH net V1] veth: prevent NULL pointer dereference in veth_xdp_rcv Jesper Dangaard Brouer
@ 2025-06-11 16:00 ` Ihor Solodrai
2025-06-12 15:20 ` patchwork-bot+netdevbpf
1 sibling, 0 replies; 3+ messages in thread
From: Ihor Solodrai @ 2025-06-11 16:00 UTC (permalink / raw)
To: Jesper Dangaard Brouer, netdev
Cc: Eric Dumazet, David S. Miller, Jakub Kicinski, Paolo Abeni, bpf,
linux-kernel, kernel-team
On 6/11/25 5:40 AM, Jesper Dangaard Brouer wrote:
> The veth peer device is RCU protected, but when the peer device gets
> deleted (veth_dellink) then the pointer is assigned NULL (via
> RCU_INIT_POINTER).
>
> This patch adds a necessary NULL check in veth_xdp_rcv when accessing
> the veth peer net_device.
>
> This fixes a bug introduced in commit dc82a33297fc ("veth: apply qdisc
> backpressure on full ptr_ring to reduce TX drops"). The bug is a race
> and only triggers when having inflight packets on a veth that is being
> deleted.
>
> Reported-by: Ihor Solodrai <ihor.solodrai@linux.dev>
> Closes: https://lore.kernel.org/all/fecfcad0-7a16-42b8-bff2-66ee83a6e5c4@linux.dev/
> Reported-by: syzbot+c4c7bf27f6b0c4bd97fe@syzkaller.appspotmail.com
> Closes: https://lore.kernel.org/all/683da55e.a00a0220.d8eae.0052.GAE@google.com/
> Fixes: dc82a33297fc ("veth: apply qdisc backpressure on full ptr_ring to reduce TX drops")
> Signed-off-by: Jesper Dangaard Brouer <hawk@kernel.org>
> ---
> Commit dc82a33297fc have reached Linus'es tree in v6.16-rc1~132^2~208^2.
> Thus, we can correct this before the release of v6.16.
>
> drivers/net/veth.c | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/net/veth.c b/drivers/net/veth.c
> index e58a0f1b5c5b..a3046142cb8e 100644
> --- a/drivers/net/veth.c
> +++ b/drivers/net/veth.c
> @@ -909,7 +909,7 @@ static int veth_xdp_rcv(struct veth_rq *rq, int budget,
>
> /* NAPI functions as RCU section */
> peer_dev = rcu_dereference_check(priv->peer, rcu_read_lock_bh_held());
> - peer_txq = netdev_get_tx_queue(peer_dev, queue_idx);
> + peer_txq = peer_dev ? netdev_get_tx_queue(peer_dev, queue_idx) : NULL;
>
> for (i = 0; i < budget; i++) {
> void *ptr = __ptr_ring_consume(&rq->xdp_ring);
> @@ -959,7 +959,7 @@ static int veth_xdp_rcv(struct veth_rq *rq, int budget,
> rq->stats.vs.xdp_packets += done;
> u64_stats_update_end(&rq->stats.syncp);
>
> - if (unlikely(netif_tx_queue_stopped(peer_txq)))
> + if (peer_txq && unlikely(netif_tx_queue_stopped(peer_txq)))
> netif_tx_wake_queue(peer_txq);
>
> return done;
>
>
Acked-by: Ihor Solodrai <ihor.solodrai@linux.dev>
Thank you!
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [PATCH net V1] veth: prevent NULL pointer dereference in veth_xdp_rcv
2025-06-11 12:40 ` [PATCH net V1] veth: prevent NULL pointer dereference in veth_xdp_rcv Jesper Dangaard Brouer
2025-06-11 16:00 ` Ihor Solodrai
@ 2025-06-12 15:20 ` patchwork-bot+netdevbpf
1 sibling, 0 replies; 3+ messages in thread
From: patchwork-bot+netdevbpf @ 2025-06-12 15:20 UTC (permalink / raw)
To: Jesper Dangaard Brouer
Cc: netdev, ihor.solodrai, eric.dumazet, davem, kuba, pabeni, bpf,
linux-kernel, kernel-team
Hello:
This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:
On Wed, 11 Jun 2025 14:40:04 +0200 you wrote:
> The veth peer device is RCU protected, but when the peer device gets
> deleted (veth_dellink) then the pointer is assigned NULL (via
> RCU_INIT_POINTER).
>
> This patch adds a necessary NULL check in veth_xdp_rcv when accessing
> the veth peer net_device.
>
> [...]
Here is the summary with links:
- [net,V1] veth: prevent NULL pointer dereference in veth_xdp_rcv
https://git.kernel.org/netdev/net/c/9337c54401a5
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply [flat|nested] 3+ messages in thread