Skip to content

net: avoid a kernel panic during sk_busy_loop

Josh Elsasser lkml netdev 1 version New

Get series with b4
b4 am [email protected]

Versions newest first

  1. v1 Latest0 of 1 patch 0 repliesNew

Patches in v1 No applies recorded yet

The patch the cover letter announces is not in this archive.

Reviews trailers per patch

PatchEric Dumazet
SeriesR-b

Trailers given in replies are filled; those carried in the patches from earlier versions are outlined with dashes.

Read the v1 thread

Cover letter [PATCH 0/1] net: avoid a kernel panic during sk_busy_loop

V2: just check napi->dev->netdev_ops instead of getting clever with the netdev registration state.

Original cover letter:

Hi Dave,

I stumbled across a reproducible kernel panic while playing around with busy_poll on a Linux 4.9.86 kernel. There's an unfortunate interaction between init_dummy_netdev, which doesn't bother to fill in netdev_ops, and sk_busy_loop, which assumed netdev_ops is a valid pointer.

To reproduce on the device under test (DUT), I did:

  $ ip addr show dev wlan0
  8: wlan0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq [...]
      inet 172.16.122.6/23 brd 172.16.123.255 scope global wlan0
  $ sysctl -w net.core.busy_read=50
  $ nc -l 172.16.122.6 5001

Then transmitted some data to this socket from a second host:

  $ echo "foo" | nc 172.16.122.6 5001

The DUT immediately hits a kernel panic.

I've attached a patch that applies cleanly to the 4.9.87 stable release. This fix isn't necessary for net/net-next (ndo_busy_poll was removed in linux-4.11), but a further backport of this commit is likely required for any stable releases older than linux-4.5.

I hope this is the right way to raise something like this. I couldn't find a clear answer from the -stable and netdev on how to handle bugs in features that no longer exist in mainline.

Thanks,
Josh