Commit 4b31bcb0 authored by Jakub Kicinski's avatar Jakub Kicinski
Browse files

eth: fbnic: unlink NAPIs from queues on error to open 



CI hit a UaF in fbnic in the AF_XDP portion of the queues.py test.
The UaF is in the __sk_mark_napi_id_once() call in xsk_bind(),
NAPI has been freed. Looks like the device failed to open earlier,
and we lack clearing the NAPI pointer from the queue.

Fixes: 557d0223 ("eth: fbnic: centralize the queue count and NAPI<>queue setting")
Reviewed-by: default avatarAlexander Duyck <alexanderduyck@fb.com>
Reviewed-by: default avatarSimon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20250728163129.117360-1-kuba@kernel.org


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parent 1dbf1d59

drivers/net/ethernet/meta/fbnic/fbnic_netdev.c

+3 −1
Original line number Diff line number Diff line
@@ -33,7 +33,7 @@ int __fbnic_open(struct fbnic_net *fbn) 
		dev_warn(fbd->dev,

			 "Error %d sending host ownership message to the firmware\n",

			 err);

		goto free_resources;

		goto err_reset_queues;

	}



	err = fbnic_time_start(fbn);
@@ -57,6 +57,8 @@ int __fbnic_open(struct fbnic_net *fbn) 
	fbnic_time_stop(fbn);

release_ownership:

	fbnic_fw_xmit_ownership_msg(fbn->fbd, false);

err_reset_queues:

	fbnic_reset_netif_queues(fbn);

free_resources:

	fbnic_free_resources(fbn);

free_napi_vectors: