]> Git Repo - linux.git/commit
net: netpoll: ensure skb_pool list is always initialized
authorJohn Sperbeck <[email protected]>
Tue, 14 Jan 2025 01:13:54 +0000 (17:13 -0800)
committerJakub Kicinski <[email protected]>
Wed, 15 Jan 2025 01:45:14 +0000 (17:45 -0800)
commitf0d0277796db613c124206544b6dbe95b520ab6c
tree2d2e842b4b1f3475ce8691cfd62ca17422f3603f
parentc17ff476f53afb30f90bb3c2af77de069c81a622
net: netpoll: ensure skb_pool list is always initialized

When __netpoll_setup() is called directly, instead of through
netpoll_setup(), the np->skb_pool list head isn't initialized.
If skb_pool_flush() is later called, then we hit a NULL pointer
in skb_queue_purge_reason().  This can be seen with this repro,
when CONFIG_NETCONSOLE is enabled as a module:

    ip tuntap add mode tap tap0
    ip link add name br0 type bridge
    ip link set dev tap0 master br0
    modprobe netconsole [email protected]/br0,[email protected]/
    rmmod netconsole

The backtrace is:

    BUG: kernel NULL pointer dereference, address: 0000000000000008
    #PF: supervisor write access in kernel mode
    #PF: error_code(0x0002) - not-present page
    ... ... ...
    Call Trace:
     <TASK>
     __netpoll_free+0xa5/0xf0
     br_netpoll_cleanup+0x43/0x50 [bridge]
     do_netpoll_cleanup+0x43/0xc0
     netconsole_netdev_event+0x1e3/0x300 [netconsole]
     unregister_netdevice_notifier+0xd9/0x150
     cleanup_module+0x45/0x920 [netconsole]
     __se_sys_delete_module+0x205/0x290
     do_syscall_64+0x70/0x150
     entry_SYSCALL_64_after_hwframe+0x76/0x7e

Move the skb_pool list setup and initial skb fill into __netpoll_setup().

Fixes: 221a9c1df790 ("net: netpoll: Individualize the skb pool")
Signed-off-by: John Sperbeck <[email protected]>
Reviewed-by: Breno Leitao <[email protected]>
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Jakub Kicinski <[email protected]>
net/core/netpoll.c
This page took 0.046267 seconds and 4 git commands to generate.