> virtio-net uses a boolean to gate rx_mode_work during device teardown.
> The flag is changed under RTNL, but ndo_set_rx_mode checks it under the
> address-list lock. A callback can therefore pass the check and enqueue work
> after teardown has flushed it. The work is also enabled before late
> probe operations that can fail, allowing probe unwind to free the netdev
> with work still queued.
>
> KASAN reports the worker using a virtqueue that probe unwind already freed:
>
> BUG: KASAN: slab-use-after-free in virtqueue_add_split
> Workqueue: events virtnet_rx_mode_work
> Call Trace:
> virtqueue_add_split (drivers/virtio/virtio_ring.c:706)
> virtqueue_add_sgs (drivers/virtio/virtio_ring.c:2839)
> virtnet_send_command_reply (drivers/net/virtio_net.c:3565)
> [ ... ]
> Fixes: b9f7425239a0 ("virtio-net: convert rx mode setting to use workqueue")
> Cc: [email protected]
> Reported-by: <[email protected]>
> Assisted-by: LLM
> Signed-off-by: Weiming Shi <[email protected]>
Sashiko has reviewed this patch and found no issues.
--
Sashiko AI review ยท
https://sashiko.dev/#/patchset/[email protected]?part=1
