[PATCH net-next 1/4] netconsole: finish enabling the target before releasing RTNL
From: Gustavo Luiz Duarte <hidden>
Date: 2026-09-28 18:01:11
Also in:
lkml
Subsystem:
netconsole, networking drivers, the rest · Maintainers:
Breno Leitao, Andrew Lunn, "David S. Miller", Eric Dumazet, Jakub Kicinski, Paolo Abeni, Linus Torvalds
netcons_netpoll_setup() publishes nt->np.dev inside __netpoll_setup(),
then releases the RTNL and waits for an RCU grace period before
returning. Only after that does its caller store STATE_ENABLED:
A NETDEV_UNREGISTER event landing in that window tears the target down
and we end up storing STATE_ENABLED with a NULL np->dev, leading to a
null-ptr-deref in netconsole_write():
BUG: KASAN: null-ptr-deref in netconsole_write+0xb9/0x7f0
Read of size 8 at addr 00000000000000a8 by task pr/netcon_ext0/135
netconsole_write+0xb9/0x7f0
nbcon_emit_next_record+0x501/0x550
nbcon_emit_one+0x10e/0x170
nbcon_kthread_func+0x2ff/0x3b0
kthread+0x199/0x1e0
Store STATE_ENABLED before dropping the RTNL lock to avoid racing with
netconsole_netdev_event().
Fixes: 2382b15bcc39 ("netconsole: take care of NETDEV_UNREGISTER event")
Signed-off-by: Gustavo Luiz Duarte <redacted>
---
drivers/net/netconsole.c | 11 +++++------
1 file changed, 5 insertions(+), 6 deletions(-)
diff --git a/drivers/net/netconsole.c b/drivers/net/netconsole.c
index 267254f046de..7dde00eb8e98 100644
--- a/drivers/net/netconsole.c
+++ b/drivers/net/netconsole.c@@ -552,13 +552,16 @@ static int netcons_netpoll_setup(struct netconsole_target *nt) err = __netpoll_setup(np, ndev); if (err) goto put; - rtnl_unlock(); /* Make sure all NAPI polls which started before dev->npinfo * was visible have exited before we start calling NAPI poll. * NAPI skips locking if dev->npinfo is NULL. + * Hold RTNL until enable is finished so we don't race with + * netconsole_netdev_event() */ - synchronize_rcu(); + synchronize_net(); + nt->state = STATE_ENABLED; + rtnl_unlock(); return 0;
@@ -589,7 +592,6 @@ static void resume_target(struct netconsole_target *nt) return; } - nt->state = STATE_ENABLED; pr_info("network logging resumed on interface %s\n", nt->np.dev_name); }
@@ -1079,7 +1081,6 @@ static ssize_t enabled_store(struct config_item *item, goto out_unlock; } - nt->state = STATE_ENABLED; pr_info("network logging started\n"); } else { /* false */ /* We need to disable the netconsole before cleaning it up
@@ -2667,8 +2668,6 @@ static struct netconsole_target *alloc_param_target(char *target_config, * otherwise, keep the target in the list, but disabled. */ goto fail; - } else { - nt->state = STATE_ENABLED; } populate_configfs_item(nt, cmdline_count);
--
2.55.0