This is an AI-generated review of your patch. The human sending this email has considered the AI review valid, or at least plausible. Full review at: https://sashiko.dev/#/patchset/[email protected]?part=3 --- hv_netvsc: Leak send/recv buffers if GPADL teardown fails
This commit addresses a bug where send/recv buffers were improperly freed if GPADL teardown failed. It introduces calls to vmbus_leak_buffer() to safely leak the buffers instead of freeing them when they might still be accessed by the host. Closes: https://lore.kernel.org/linux-hyperv/[email protected]/ > diff --git a/drivers/net/hyperv/netvsc.c b/drivers/net/hyperv/netvsc.c > index 5cd084e5696cd..e9292c3fac925 100644 > --- a/drivers/net/hyperv/netvsc.c > +++ b/drivers/net/hyperv/netvsc.c > @@ -316,9 +316,11 @@ static void netvsc_teardown_recv_gpadl(struct hv_device > *device, > * rather than continue and a bugchk > */ > if (ret != 0) { > + vmbus_leak_buffer(&net_device->recv_buf, > + &net_device->recv_buf_chunks, > + &net_device->recv_buf_chunk_cnt); [Severity: High] Could this lead to a NULL pointer dereference if NAPI is still polling concurrently? In netvsc_device_add(), NAPI is enabled and the VMBus channel is opened. If a subsequent initialization step fails (like send_buf setup), the error path calls netvsc_teardown_recv_gpadl(). If the GPADL teardown fails, vmbus_leak_buffer() will set net_device->recv_buf to NULL. Because NAPI is not synchronized with this teardown and is disabled later in the error path, a concurrent softirq could execute this path in netvsc_receive(): char *recv_buf = net_device->recv_buf; ... data = recv_buf + offset; ... ret = rndis_filter_receive(ndev, net_device, nvchan, data, buflen); Since the code does not check for NULL, it passes the faulty data pointer (NULL + offset) to rndis_filter_receive(). This would result in a kernel panic when trying to read from the pointer: memcpy(rndis_msg, data, RNDIS_HEADER_SIZE); Is there a way to defer setting recv_buf to NULL until after NAPI has been disabled? > netdev_err(ndev, > "unable to teardown receive buffer's > gpadl\n"); > - return; > } > } > }
