mirror of
https://github.com/torvalds/linux.git
synced 2026-09-14 16:10:02 +02:00
07e98a4d5e
In netdevsim, receive queues (struct nsim_rq) embed their own struct
napi_struct. When queue reset is performed (e.g. via queue_reset
debugfs), nsim_queue_start() swaps in a newly allocated struct nsim_rq,
and nsim_queue_mem_free() later deletes and frees the old one.
However, nsim_queue_start() failed to update the queue-to-NAPI mapping
via netif_queue_set_napi(). As a result, dev->_rx[idx].napi continued to
point to the old NAPI struct. After the old queue was freed, a subsequent
queue dump via Netlink (NETDEV_CMD_QUEUE_GET) triggered a KASAN
slab-use-after-free read in nla_put_napi_id() when accessing
rxq->napi->napi_id.
Fix this by calling netif_queue_set_napi() in nsim_queue_start() to
associate the new NAPI with the RX queue, and clear the association
with netif_queue_set_napi(..., NULL) in nsim_del_napi() during teardown.
Fixes:
|
||
|---|---|---|
| .. | ||
| bpf.c | ||
| bus.c | ||
| dev.c | ||
| ethtool.c | ||
| fib.c | ||
| health.c | ||
| hwstats.c | ||
| ipsec.c | ||
| macsec.c | ||
| Makefile | ||
| netdev.c | ||
| netdevsim.h | ||
| psample.c | ||
| psp.c | ||
| tc.c | ||
| udp_tunnels.c | ||