Re: [PATCH] netdevsim: update rxq->napi pointer during queue reset

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] The patch clears `rxq->napi` in `nsim_queue_stop()` but fails to restore it in `nsim_queue_start()` when `rq_reset_mode == 1`, breaking NAPI-dependent features.
--

--- Patch [1]: [PATCH] netdevsim: update rxq->napi pointer during queue reset ---
commit a7e8e5d48bb567359bb7891a0b39d7f888c35d27
Author: Subasri S <[email protected]>

netdevsim: update rxq->napi pointer during queue reset

This commit addresses a use-after-free issue by properly clearing and setting
the rxq->napi pointer during a queue reset. It modifies nsim_queue_stop() to
clear the pointer and nsim_queue_start() to set it to the new napi instance.

Closes: https://syzkaller.appspot.com/bug?extid=c06674caba265dc61d46

> diff --git a/drivers/net/netdevsim/netdev.c b/drivers/net/netdevsim/netdev.c
> index 4e9d7e10b527e..c18f9f540084a 100644
> --- a/drivers/net/netdevsim/netdev.c
> +++ b/drivers/net/netdevsim/netdev.c

[ ... ]

> @@ -826,6 +826,8 @@ nsim_queue_start(struct net_device *dev, struct netdev_queue_config *qcfg,
>  	}
>  
>  	ns->rq[idx] = qmem->rq;
> +	netif_queue_set_napi(dev, idx, NETDEV_QUEUE_TYPE_RX,
> +			     &ns->rq[idx]->napi);

[Severity: Medium]
Will this leave rxq->napi as NULL when ns->rq_reset_mode == 1?

Since nsim_queue_stop() now unconditionally sets the pointer to NULL:

drivers/net/netdevsim/netdev.c:nsim_queue_stop() {
	...
	netif_queue_set_napi(dev, idx, NETDEV_QUEUE_TYPE_RX, NULL);
	...
}

Earlier in this function (nsim_queue_start), there is an early return
for rq_reset_mode == 1 that bypasses the new restoration code:

drivers/net/netdevsim/netdev.c:nsim_queue_start() {
	...
	if (ns->rq_reset_mode == 1) {
		ns->rq[idx]->page_pool = qmem->pp;
		napi_enable_locked(&ns->rq[idx]->napi);
		return 0;
	}
	...
}

Does this skip restoring rxq->napi, leaving it NULL and preventing XSK busy
polling from working after a reset in mode 1?

>  	napi_enable_locked(&ns->rq[idx]->napi);
>  
>  	return 0;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=1