From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from www.kot-begemot.co.uk (ns1.kot-begemot.co.uk [217.160.28.25]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 26F9E365A00 for ; Thu, 28 May 2026 08:01:46 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=217.160.28.25 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779955309; cv=none; b=ThCBg/EyV9nHVDeHhZmP0UQvTVbXz2AxGAkWbZ7hrbjyi15XPqOjd829Jr1iInUqRjM+PLPVECtAOVyrOICwadduUScQ258Pv2K8gy1nOodxeBDF8Q/EbGs3OvOEGCx6KI/w3huCY0+a/XpoNFMXCnP2SsxKSSdcz89Mc71+Gak= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779955309; c=relaxed/simple; bh=b1BGEthMRihLM9755xsRfAox8DMFTyu1Ps2Oloou7SY=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=Hm6FzhijSrtWsIIS/Hh9u1Mm/THE/7C7kzQUe5tJwZXYZCR9bdoEsMv9fF8rWn7T9TIPc7u8gSnUsYpz7hnBO01i73fKYmCdDsJPFsHOmSvy89mzlMofVj3zwOddACUVw1jh3lzPfE7Xl34+rV+r9oXqe6OcA7ddWgsJ4b/56oo= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=cambridgegreys.com; spf=pass smtp.mailfrom=cambridgegreys.com; arc=none smtp.client-ip=217.160.28.25 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=cambridgegreys.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=cambridgegreys.com Received: from [192.168.17.6] (helo=jain.kot-begemot.co.uk) by www.kot-begemot.co.uk with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from ) id 1wSVCt-000Q6r-AE; Thu, 28 May 2026 07:31:07 +0000 Received: from [192.168.21.56] by jain.kot-begemot.co.uk with esmtp (Exim 4.98.2) (envelope-from ) id 1wSTiq-00000001bve-0das; Thu, 28 May 2026 08:31:06 +0100 Message-ID: Date: Thu, 28 May 2026 08:31:04 +0100 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH] um: vector: avoid NULL queue dereference in legacy RX mode To: Johannes Berg , Henry Barreto , Richard Weinberger Cc: Tiwei Bie , linux-um@lists.infradead.org, linux-kernel@vger.kernel.org, Henry Barreto References: <20260527213524.45903-1-contato@henrybarreto.dev> Content-Language: en-US From: Anton Ivanov In-Reply-To: Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit X-Spam-Score: -1.0 X-Spam-Score: -1.0 X-Clacks-Overhead: GNU Terry Pratchett On 28/05/2026 08:13, Johannes Berg wrote: > On Wed, 2026-05-27 at 18:35 -0300, Henry Barreto wrote: >> From: Henry Barreto >> >> Bringing a UML vector netdev up can panic in vector_net_open() with a >> fault in _raw_spin_lock(). >> >> vector_net_open() calls vector_reset_stats(), which takes the RX and TX >> queue locks. However, queue allocation depends on runtime transport >> options. With tap transport, vector RX/TX queues are not created and the >> legacy header buffers are used instead. Taking a queue lock then >> dereferences a NULL queue pointer. >> >> Take the queue locks in vector_reset_stats() only when the corresponding >> queue exists. Also move the RX queue lock in vector_poll() into the >> VECTOR_RX path, so legacy RX does not touch rx_queue. >> >> Fixes: 612a8c8e0b43 ("um: vector: Replace locks guarding queue depth with atomics") > > So ... you're effectively saying that the tap transport has been broken > since 6.12, released ~1.5 years ago. > > Maybe we should just remove that entirely since nobody complained? > > johannes > > More interesting while it was not observed in testing. The patch is OK otherwise. I will ack it. -- Anton R. Ivanov Cambridgegreys Limited. Registered in England. Company Number 10273661 https://www.cambridgegreys.com/