github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-07 06:17:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

um: vector: avoid NULL queue dereference in legacy RX mode

Browse Source 
Bringing a UML vector netdev up can panic in vector_net_open() with a
fault in _raw_spin_lock().

vector_net_open() calls vector_reset_stats(), which takes the RX and TX
queue locks. However, queue allocation depends on runtime transport
options. With tap transport, vector RX/TX queues are not created and the
legacy header buffers are used instead. Taking a queue lock then
dereferences a NULL queue pointer.

Take the queue locks in vector_reset_stats() only when the corresponding
queue exists. Also move the RX queue lock in vector_poll() into the
VECTOR_RX path, so legacy RX does not touch rx_queue.

Signed-off-by: Henry Barreto <me@henrybarreto.dev>
Acked-By: Anton Ivanov <anton.ivanov@cambridgegreys.com>
Link: https://patch.msgid.link/20260527213524.45903-1-contato@henrybarreto.dev
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
This commit is contained in:
Henry Barreto 2026-05-27 18:35:24 -03:00 committed by Johannes Berg
parent ca6b181232
commit 0630560dd7
1 changed files with 18 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
arch/um/drivers/vector_kern.c
View File

@ -111,19 +111,26 @@ static void vector_reset_stats(struct vector_private *vp)
* in vector_poll.
*/
spin_lock(&vp->rx_queue->head_lock);
if (vp->rx_queue)
spin_lock(&vp->rx_queue->head_lock);
vp->estats.rx_queue_max = 0;
vp->estats.rx_queue_running_average = 0;
vp->estats.rx_encaps_errors = 0;
vp->estats.sg_ok = 0;
vp->estats.sg_linearized = 0;
spin_unlock(&vp->rx_queue->head_lock);
if (vp->rx_queue)
spin_unlock(&vp->rx_queue->head_lock);
/* TX stats are modified with TX head_lock held
* in vector_send.
*/
spin_lock(&vp->tx_queue->head_lock);
if (vp->tx_queue)
spin_lock(&vp->tx_queue->head_lock);
vp->estats.tx_timeout_count = 0;
vp->estats.tx_restart_queue = 0;
vp->estats.tx_kicks = 0;
@ -131,7 +138,10 @@ static void vector_reset_stats(struct vector_private *vp)
vp->estats.tx_flow_control_xoff = 0;
vp->estats.tx_queue_max = 0;
vp->estats.tx_queue_running_average = 0;
spin_unlock(&vp->tx_queue->head_lock);
if (vp->tx_queue)
spin_unlock(&vp->tx_queue->head_lock);
}
static int get_mtu(struct arglist *def)
@ -1164,15 +1174,15 @@ static int vector_poll(struct napi_struct *napi, int budget)
if ((vp->options & VECTOR_TX) != 0)
tx_enqueued = (vector_send(vp->tx_queue) > 0);
spin_lock(&vp->rx_queue->head_lock);
if ((vp->options & VECTOR_RX) > 0)
if ((vp->options & VECTOR_RX) > 0) {
spin_lock(&vp->rx_queue->head_lock);
err = vector_mmsg_rx(vp, budget);
else {
spin_unlock(&vp->rx_queue->head_lock);
} else {
err = vector_legacy_rx(vp);
if (err > 0)
err = 1;
}
spin_unlock(&vp->rx_queue->head_lock);
if (err > 0)
work_done += err;