Messages in this thread | | | Date | Wed, 21 Feb 2024 13:29:16 -0800 | From | Jakub Kicinski <> | Subject | Re: [syzbot] [kernel?] BUG: unable to handle kernel NULL pointer dereference in hrtimer_active |
| |
On Tue, 13 Feb 2024 00:01:03 +0100 Thomas Gleixner wrote: > So something in that syzbot test case manages to tear down a napi > context which has not yet been fully initialized. While the rest of > napi_disable() does not care much as long as neither NAPIF_STATE_SCHED > nor NAPIF_STATE_NPSVC are set in napi->state, hrtimer_cancel() pretty > much cares as demonstrated by the NULL pointer dereference. > > While it would be trivial to harden the hrtimer code for the case that a > non-initialized hrtimer is canceled, I wonder whether this invocation of > napi_disable() is harmless (aside of the hrtimer issue) or if there are > some hidden subtle issues with that.
Thanks for the forward, I stared at it for a bit and I can see one way to make veth disable unregistered NAPI. I'll send a fix shortly.
| |