From 0630560dd79f1a37158f9cd5bc70607044b8438a Mon Sep 17 00:00:00 2001 From: Henry Barreto Date: Wed, 27 May 2026 18:35:24 -0300 Subject: [PATCH] um: vector: avoid NULL queue dereference in legacy RX mode Bringing a UML vector netdev up can panic in vector_net_open() with a fault in _raw_spin_lock(). vector_net_open() calls vector_reset_stats(), which takes the RX and TX queue locks. However, queue allocation depends on runtime transport options. With tap transport, vector RX/TX queues are not created and the legacy header buffers are used instead. Taking a queue lock then dereferences a NULL queue pointer. Take the queue locks in vector_reset_stats() only when the corresponding queue exists. Also move the RX queue lock in vector_poll() into the VECTOR_RX path, so legacy RX does not touch rx_queue. Signed-off-by: Henry Barreto Acked-By: Anton Ivanov Link: https://patch.msgid.link/20260527213524.45903-1-contato@henrybarreto.dev Signed-off-by: Johannes Berg --- arch/um/drivers/vector_kern.c | 26 ++++++++++++++++++-------- 1 file changed, 18 insertions(+), 8 deletions(-) diff --git a/arch/um/drivers/vector_kern.c b/arch/um/drivers/vector_kern.c index a66764f752bb..e902e78c5ff6 100644 --- a/arch/um/drivers/vector_kern.c +++ b/arch/um/drivers/vector_kern.c @@ -111,19 +111,26 @@ static void vector_reset_stats(struct vector_private *vp) * in vector_poll. */ - spin_lock(&vp->rx_queue->head_lock); + if (vp->rx_queue) + spin_lock(&vp->rx_queue->head_lock); + vp->estats.rx_queue_max = 0; vp->estats.rx_queue_running_average = 0; vp->estats.rx_encaps_errors = 0; vp->estats.sg_ok = 0; vp->estats.sg_linearized = 0; - spin_unlock(&vp->rx_queue->head_lock); + + if (vp->rx_queue) + spin_unlock(&vp->rx_queue->head_lock); + /* TX stats are modified with TX head_lock held * in vector_send. */ - spin_lock(&vp->tx_queue->head_lock); + if (vp->tx_queue) + spin_lock(&vp->tx_queue->head_lock); + vp->estats.tx_timeout_count = 0; vp->estats.tx_restart_queue = 0; vp->estats.tx_kicks = 0; @@ -131,7 +138,10 @@ static void vector_reset_stats(struct vector_private *vp) vp->estats.tx_flow_control_xoff = 0; vp->estats.tx_queue_max = 0; vp->estats.tx_queue_running_average = 0; - spin_unlock(&vp->tx_queue->head_lock); + + if (vp->tx_queue) + spin_unlock(&vp->tx_queue->head_lock); + } static int get_mtu(struct arglist *def) @@ -1164,15 +1174,15 @@ static int vector_poll(struct napi_struct *napi, int budget) if ((vp->options & VECTOR_TX) != 0) tx_enqueued = (vector_send(vp->tx_queue) > 0); - spin_lock(&vp->rx_queue->head_lock); - if ((vp->options & VECTOR_RX) > 0) + if ((vp->options & VECTOR_RX) > 0) { + spin_lock(&vp->rx_queue->head_lock); err = vector_mmsg_rx(vp, budget); - else { + spin_unlock(&vp->rx_queue->head_lock); + } else { err = vector_legacy_rx(vp); if (err > 0) err = 1; } - spin_unlock(&vp->rx_queue->head_lock); if (err > 0) work_done += err;