netdevsim: fix panic when NETIF_F_LOOPBACK is set on a VF port

Browse source

A netdevsim VF port cannot process incoming data.  It never runs
nsim_queue_init(), so ns->rq is NULL, and nsim_vf_netdev_ops has no
->ndo_open, so its NAPI is never set up either.

nsim_setup() offers NETIF_F_LOOPBACK to both PF and VF ports.  Turning
it on for a VF makes nsim_start_xmit() take ns itself as peer_ns and
dereference peer_ns->rq[], which panics.

A VF cannot deliver packets at all: it can't be linked as a peer either,
since netdev_is_nsim() only matches the PF netdev_ops, so ns->peer is
always NULL and every skb ends up dropped.  Give VF ports a dedicated
xmit that just drops the traffic, so VFs no longer depend on PF-only
state in nsim_start_xmit().

Reproduce in qemu:
  modprobe netdevsim
  echo "90 1" > /sys/bus/netdevsim/new_device
  echo 2 > /sys/bus/netdevsim/devices/netdevsim90/sriov_numvfs
  devlink dev eswitch set netdevsim/netdevsim90 mode switchdev
  ethtool -K eth2 loopback on   # eth2 is the vfnum 0 port
  ip link set eth2 up

Panic:
  KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
  CPU: 0 UID: 0 PID: 141 Comm: kworker/0:3 Not tainted 7.2.0+ #338 PREEMPT
  Workqueue: mld mld_ifc_work
  RIP: 0010:nsim_start_xmit (drivers/net/netdevsim/netdev.c:159)
  dev_hard_start_xmit ( net/core/dev.c:3953)
  sch_direct_xmit (net/sched/sch_generic.c:372)
  __dev_queue_xmit (net/core/dev.c:4262 net/core/dev.c:4884)
  neigh_resolve_output (net/core/neighbour.c:1616)
  ip6_finish_output2 (net/ipv6/ip6_output.c:138)
  ip6_finish_output (net/ipv6/ip6_output.c:221)
  ip6_output (net/ipv6/ip6_output.c:248)
  ......

Cc: stable+noautosel@kernel.org # netdevsim is a test harness, it's never loaded on production systems
Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev>
Link: https://patch.msgid.link/20260901061851.61734-1-jiayuan.chen@linux.dev
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

...

This commit is contained in:

Jiayuan Chen 2026-09-01 14:18:50 +08:00 • committed by Jakub Kicinski

parent 25a477c8d9

commit 5add7c8d59

1 changed files with 9 additions and 1 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

10

drivers/net/netdevsim/netdev.c

View file