From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from www.kot-begemot.co.uk (ns1.kot-begemot.co.uk [217.160.28.25]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 761C235E1BA for ; Thu, 28 May 2026 08:02:38 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=217.160.28.25 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779955360; cv=none; b=IbPyeYYwuBqEydqtUbQ/04311SqWk8u9ZkYkdPTEyOXBt0JjwPYzRtzx133pk0E3OgIdT6DKPDvf8ZbzRUg9WtiDvnygb+92D55tI1C2vro1J6OkfYHtwLdfCe65WqqC8RJzG7MixBUO0HhH+HN0X69eAVawOKUryAPuaOwKzEQ= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779955360; c=relaxed/simple; bh=x50FaI86DFLyPrLZvRa3H7XTRBkK4LjTc8ZgdUqSpPs=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=S2OK2k5wMpYfnOkZCC7kuj5FLlpzODfFJZtqP+t5861lK5eDt5p4YiV0GKxIqaHujKGVhX1sf3jqAewLxrrpqC0zuFlctC0nLAsbgwiQhvHIjIa2WJ/1jUOtBffO49YnNVwlczKA0+Xf/n2nbrBeIesrmT8PVlPhR80E+AWUwV0= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=cambridgegreys.com; spf=pass smtp.mailfrom=cambridgegreys.com; arc=none smtp.client-ip=217.160.28.25 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=cambridgegreys.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=cambridgegreys.com Received: from [192.168.17.6] (helo=jain.kot-begemot.co.uk) by www.kot-begemot.co.uk with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from ) id 1wSVhG-000QAt-MD; Thu, 28 May 2026 08:02:30 +0000 Received: from [192.168.21.56] by jain.kot-begemot.co.uk with esmtp (Exim 4.98.2) (envelope-from ) id 1wSUDC-00000001dG3-3ZRq; Thu, 28 May 2026 09:02:29 +0100 Message-ID: <5318a8f9-eadf-4cc5-978b-8749d44d0acb@cambridgegreys.com> Date: Thu, 28 May 2026 09:02:28 +0100 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH] um: vector: avoid NULL queue dereference in legacy RX mode To: Henry Barreto , Richard Weinberger Cc: Johannes Berg , Tiwei Bie , linux-um@lists.infradead.org, linux-kernel@vger.kernel.org, Henry Barreto References: <20260527213524.45903-1-contato@henrybarreto.dev> Content-Language: en-US From: Anton Ivanov In-Reply-To: <20260527213524.45903-1-contato@henrybarreto.dev> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit X-Spam-Score: -1.0 X-Spam-Score: -1.0 X-Clacks-Overhead: GNU Terry Pratchett On 27/05/2026 22:35, Henry Barreto wrote: > From: Henry Barreto > > Bringing a UML vector netdev up can panic in vector_net_open() with a > fault in _raw_spin_lock(). > > vector_net_open() calls vector_reset_stats(), which takes the RX and TX > queue locks. However, queue allocation depends on runtime transport > options. With tap transport, vector RX/TX queues are not created and the > legacy header buffers are used instead. Taking a queue lock then > dereferences a NULL queue pointer. > > Take the queue locks in vector_reset_stats() only when the corresponding > queue exists. Also move the RX queue lock in vector_poll() into the > VECTOR_RX path, so legacy RX does not touch rx_queue. > > Fixes: 612a8c8e0b43 ("um: vector: Replace locks guarding queue depth with atomics") > Signed-off-by: Henry Barreto > --- > arch/um/drivers/vector_kern.c | 26 ++++++++++++++++++-------- > 1 file changed, 18 insertions(+), 8 deletions(-) > > diff --git a/arch/um/drivers/vector_kern.c b/arch/um/drivers/vector_kern.c > index 25d9258fa592..70762f15d093 100644 > --- a/arch/um/drivers/vector_kern.c > +++ b/arch/um/drivers/vector_kern.c > @@ -110,19 +110,26 @@ static void vector_reset_stats(struct vector_private *vp) > * in vector_poll. > */ > > - spin_lock(&vp->rx_queue->head_lock); > + if (vp->rx_queue) > + spin_lock(&vp->rx_queue->head_lock); > + > vp->estats.rx_queue_max = 0; > vp->estats.rx_queue_running_average = 0; > vp->estats.rx_encaps_errors = 0; > vp->estats.sg_ok = 0; > vp->estats.sg_linearized = 0; > - spin_unlock(&vp->rx_queue->head_lock); > + > + if (vp->rx_queue) > + spin_unlock(&vp->rx_queue->head_lock); > + > > /* TX stats are modified with TX head_lock held > * in vector_send. > */ > > - spin_lock(&vp->tx_queue->head_lock); > + if (vp->tx_queue) > + spin_lock(&vp->tx_queue->head_lock); > + > vp->estats.tx_timeout_count = 0; > vp->estats.tx_restart_queue = 0; > vp->estats.tx_kicks = 0; > @@ -130,7 +137,10 @@ static void vector_reset_stats(struct vector_private *vp) > vp->estats.tx_flow_control_xoff = 0; > vp->estats.tx_queue_max = 0; > vp->estats.tx_queue_running_average = 0; > - spin_unlock(&vp->tx_queue->head_lock); > + > + if (vp->tx_queue) > + spin_unlock(&vp->tx_queue->head_lock); > + > } > > static int get_mtu(struct arglist *def) > @@ -1168,15 +1178,15 @@ static int vector_poll(struct napi_struct *napi, int budget) > > if ((vp->options & VECTOR_TX) != 0) > tx_enqueued = (vector_send(vp->tx_queue) > 0); > - spin_lock(&vp->rx_queue->head_lock); > - if ((vp->options & VECTOR_RX) > 0) > + if ((vp->options & VECTOR_RX) > 0) { > + spin_lock(&vp->rx_queue->head_lock); > err = vector_mmsg_rx(vp, budget); > - else { > + spin_unlock(&vp->rx_queue->head_lock); > + } else { > err = vector_legacy_rx(vp); > if (err > 0) > err = 1; > } > - spin_unlock(&vp->rx_queue->head_lock); > if (err > 0) > work_done += err; > Acked-By: Anton Ivanov -- Anton R. Ivanov Cambridgegreys Limited. Registered in England. Company Number 10273661 https://www.cambridgegreys.com/