Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider: - [High] netdevsim: NULL pointer dereference in nsim_pp_hold_write() for VF --
commit d75afa7b1b5f97be20adbad5ccb5b51d01ca5219 Author: Mina Almasry <[email protected]> Date: Wed Oct 14 16:17:53 2026 +0000 netdevsim: support devmem RX and TX bindings This commit enables NETMEM_TX_DMA and configures page_pool instances to support devmem bind-rx and bind-tx operations in netdevsim software tests. It updates the pp_hold debugfs file to allocate pages from queue 0, adds a netdev instance lock to prevent concurrent binding swaps, and checks if the pool is backed by a memory provider. > diff --git a/drivers/net/netdevsim/netdev.c b/drivers/net/netdevsim/netdev.c > index b4a99f3ceac60..357ea9e5623b3 100644 > --- a/drivers/net/netdevsim/netdev.c > +++ b/drivers/net/netdevsim/netdev.c [ ... ] > @@ -929,12 +939,15 @@ nsim_pp_hold_write(struct file *file, const char __user > *data, > return ret; > > rtnl_lock(); > + netdev_lock(ns->netdev); > ret = count; > if (val == !!ns->page) > goto exit; > > if (!netif_running(ns->netdev) && val) { > ret = -ENETDOWN; > + } else if (val && page_pool_is_unreadable(ns->rq[0]->page_pool)) { [Severity: High] Does this code dereference a NULL pointer for Virtual Function (VF) interfaces? When a VF interface is created and brought up (e.g., via ip link set dev ethX up, setting netif_running() to true), nsim_queue_init() is skipped during VF creation, which leaves ns->rq as NULL. If a user with debugfs write permissions then writes to the VF's pp_hold file, this condition attempts to evaluate ns->rq[0], dereferencing NULL and causing a kernel panic. > + ret = -EOPNOTSUPP; > } else if (val) { > ns->page = page_pool_dev_alloc_pages(ns->rq[0]->page_pool); > if (!ns->page) [ ... ] -- Sashiko AI review ยท https://sashiko.dev/#/patchset/[email protected]?part=3
