kernel/linux.git/drivers/net/netdevsim/dev.c, branch v5.15.209

netdevsim: zero initialize struct iphdr in dummy sk_buff

2026-06-01T15:35:42+00:00

[ Upstream commit 35eaa6d8d6c2ee65e96f507add856e0eacf24591 ] Syzbot reports a KMSAN uninit-value originating from nsim_dev_trap_skb_build, with the allocation also being performed in the same function. Fix this by calling skb_put_zero instead of skb_put to guarantee zero initialization of the whole IP header. Closes: https://syzkaller.appspot.com/bug?extid=23d7fcd204e3837866ff Fixes: da58f90f11f5 ("netdevsim: Add devlink-trap support") Signed-off-by: Nikola Z. Ivanov Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20260426201434.742030-1-zlatistiv@gmail.com Signed-off-by: Jakub Kicinski Signed-off-by: Sasha Levin

netdevsim: Fix memory leak of nsim_dev->fa_cookie

2026-06-01T15:35:08+00:00

[ Upstream commit 064bc7312bd09a48798418663090be0c776183db ] kmemleak reports this issue: unreferenced object 0xffff8881bac872d0 (size 8): comm "sh", pid 58603, jiffies 4481524462 (age 68.065s) hex dump (first 8 bytes): 04 00 00 00 de ad be ef ........ backtrace: [<00000000c80b8577>] __kmalloc+0x49/0x150 [<000000005292b8c6>] nsim_dev_trap_fa_cookie_write+0xc1/0x210 [netdevsim] [<0000000093d78e77>] full_proxy_write+0xf3/0x180 [<000000005a662c16>] vfs_write+0x1c5/0xaf0 [<000000007aabf84a>] ksys_write+0xed/0x1c0 [<000000005f1d2e47>] do_syscall_64+0x3b/0x90 [<000000006001c6ec>] entry_SYSCALL_64_after_hwframe+0x63/0xcd The issue occurs in the following scenarios: nsim_dev_trap_fa_cookie_write() kmalloc() fa_cookie nsim_dev->fa_cookie = fa_cookie .. nsim_drv_remove() The fa_cookie allocked in nsim_dev_trap_fa_cookie_write() is not freed. To fix, add kfree(nsim_dev->fa_cookie) to nsim_drv_remove(). Fixes: d3cbb907ae57 ("netdevsim: add ACL trap reporting cookie as a metadata") Signed-off-by: Wang Yufen Cc: Jiri Pirko Link: https://lore.kernel.org/r/1668504625-14698-1-git-send-email-wangyufen@huawei.com Signed-off-by: Jakub Kicinski [ The context change is due to the commit 5e388f3dc38c ("netdevsim: move vfconfig to nsim_dev") in v5.16 which is irrelevant to the logic of this patch. ] Signed-off-by: Johnny Hao Signed-off-by: Greg Kroah-Hartman

netdevsim: fix uninitialized data in nsim_dev_trap_fa_cookie_write()

2023-07-23T11:47:45+00:00

[ Upstream commit f72207a5c0dbaaf6921cf9a6c0d2fd0bc249ea78 ] The simple_write_to_buffer() function is designed to handle partial writes. It returns negatives on error, otherwise it returns the number of bytes that were able to be copied. This code doesn't check the return properly. We only know that the first byte is written, the rest of the buffer might be uninitialized. There is no need to use the simple_write_to_buffer() function. Partial writes are prohibited by the "if (*ppos != 0)" check at the start of the function. Just use memdup_user() and copy the whole buffer. Fixes: d3cbb907ae57 ("netdevsim: add ACL trap reporting cookie as a metadata") Signed-off-by: Dan Carpenter Reviewed-by: Pavan Chebbi Reviewed-by: Ido Schimmel Link: https://lore.kernel.org/r/7c1f950b-3a7d-4252-82a6-876e53078ef7@moroto.mountain Signed-off-by: Jakub Kicinski Signed-off-by: Sasha Levin

netdevsim: remove dir in nsim_dev_debugfs_init() when creating ports dir failed

2022-11-03T14:59:19+00:00

[ Upstream commit a6aa8d0ce2cfba57ac0f23293fcb3be0b9f53fba ] Remove dir in nsim_dev_debugfs_init() when creating ports dir failed. Otherwise, the netdevsim device will not be created next time. Kernel reports an error: debugfs: Directory 'netdevsim1' with parent 'netdevsim' already present! Fixes: ab1d0cc004d7 ("netdevsim: change debugfs tree topology") Signed-off-by: Zhengchao Shao Signed-off-by: Jakub Kicinski Signed-off-by: Sasha Levin

devlink: Set device as early as possible

2021-08-09T09:21:40+00:00

All kernel devlink implementations call to devlink_alloc() during initialization routine for specific device which is used later as a parent device for devlink_register(). Such late device assignment causes to the situation which requires us to call to device_register() before setting other parameters, but that call opens devlink to the world and makes accessible for the netlink users. Any attempt to move devlink_register() to be the last call generates the following error due to access to the devlink->dev pointer. [ 8.758862] devlink_nl_param_fill+0x2e8/0xe50 [ 8.760305] devlink_param_notify+0x6d/0x180 [ 8.760435] __devlink_params_register+0x2f1/0x670 [ 8.760558] devlink_params_register+0x1e/0x20 The simple change of API to set devlink device in the devlink_alloc() instead of devlink_register() fixes all this above and ensures that prior to call to devlink_register() everything already set. Signed-off-by: Leon Romanovsky Reviewed-by: Jiri Pirko Signed-off-by: David S. Miller

netdevsim: Protect both reload_down and reload_up paths

2021-08-06T09:36:36+00:00

Don't progress with adding and deleting ports as long as devlink reload is running. Fixes: 23809a726c0d ("netdevsim: Forbid devlink reload when adding or deleting ports") Signed-off-by: Leon Romanovsky Signed-off-by: David S. Miller

netdevsim: Forbid devlink reload when adding or deleting ports

2021-08-05T12:31:24+00:00

In order to remove complexity in devlink core related to devlink_reload_enable/disable, let's rewrite new_port/del_port logic to rely on internal to netdevsim lcok. We should protect only reload_down flow because it destroys nsim_dev, which is needed for nsim_dev_port_add/nsim_dev_port_del to hold port_list_lock. Signed-off-by: Leon Romanovsky Signed-off-by: David S. Miller

devlink: Allocate devlink directly in requested net namespace

2021-07-30T20:16:38+00:00

There is no need in extra call indirection and check from impossible flow where someone tries to set namespace without prior call to devlink_alloc(). Instead of this extra logic and additional EXPORT_SYMBOL, use specialized devlink allocation function that receives net namespace as an argument. Such specialized API allows clear view when devlink initialized in wrong net namespace and/or kernel users don't try to change devlink namespace under the hood. Reviewed-by: Jiri Pirko Signed-off-by: Leon Romanovsky Signed-off-by: Jakub Kicinski

drivers: net: netdevsim: fix devlink_trap selftests failing

2021-06-18T18:28:27+00:00

devlink_trap tests for the netdevsim fail due to misspelled debugfs file name. Change this name, as well as name of callback function, to match the naming as in the devlink itself - 'trap_drop_counter'. Test-results: selftests: drivers/net/netdevsim: devlink_trap.sh TEST: Initialization [ OK ] TEST: Trap action [ OK ] TEST: Trap metadata [ OK ] TEST: Non-existing trap [ OK ] TEST: Non-existing trap action [ OK ] TEST: Trap statistics [ OK ] TEST: Trap group action [ OK ] TEST: Non-existing trap group [ OK ] TEST: Trap group statistics [ OK ] TEST: Trap policer [ OK ] TEST: Trap policer binding [ OK ] TEST: Port delete [ OK ] TEST: Device delete [ OK ] Fixes: a7b3527a43fe ("drivers: net: netdevsim: add devlink trap_drop_counter_get implementation") Signed-off-by: Oleksandr Mazur Reviewed-by: Ido Schimmel Tested-by: Ido Schimmel Signed-off-by: David S. Miller

drivers: net: netdevsim: add devlink trap_drop_counter_get implementation

2021-06-14T20:04:25+00:00

Whenever query statistics is issued for trap with DROP action, devlink subsystem would also fill-in statistics 'dropped' field. In case if device driver did't register callback for hard drop statistics querying, 'dropped' field will be omitted and not filled. Add trap_drop_counter_get callback implementation to the netdevsim. Add new test cases for netdevsim, to test both the callback functionality, as well as drop statistics alteration check. Signed-off-by: Oleksandr Mazur Signed-off-by: David S. Miller