eth: fbnic: unlink NAPIs from queues on error to open
authorJakub Kicinski <kuba@kernel.org>
Mon, 28 Jul 2025 16:31:29 +0000 (09:31 -0700)
committerJakub Kicinski <kuba@kernel.org>
Tue, 5 Aug 2025 00:14:35 +0000 (17:14 -0700)
commit4b31bcb025cb497da2b01f87173108ff32d350d2
tree912e2f9517352ea1b2c04c179565731fc7db8678
parent1dbf1d590d10a6d1978e8184f8dfe20af22d680a
eth: fbnic: unlink NAPIs from queues on error to open

CI hit a UaF in fbnic in the AF_XDP portion of the queues.py test.
The UaF is in the __sk_mark_napi_id_once() call in xsk_bind(),
NAPI has been freed. Looks like the device failed to open earlier,
and we lack clearing the NAPI pointer from the queue.

Fixes: 557d02238e05 ("eth: fbnic: centralize the queue count and NAPI<>queue setting")
Reviewed-by: Alexander Duyck <alexanderduyck@fb.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20250728163129.117360-1-kuba@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
drivers/net/ethernet/meta/fbnic/fbnic_netdev.c