eth: fbnic: unlink NAPIs from queues on error to open

[ Upstream commit 4b31bcb025cb497da2b01f87173108ff32d350d2 ]

CI hit a UaF in fbnic in the AF_XDP portion of the queues.py test.
The UaF is in the __sk_mark_napi_id_once() call in xsk_bind(),
NAPI has been freed. Looks like the device failed to open earlier,
and we lack clearing the NAPI pointer from the queue.

Fixes: 557d02238e05 ("eth: fbnic: centralize the queue count and NAPI<>queue setting")
Reviewed-by: Alexander Duyck <alexanderduyck@fb.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20250728163129.117360-1-kuba@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/drivers/net/ethernet/meta/fbnic/fbnic_netdev.c b/drivers/net/ethernet/meta/fbnic/fbnic_netdev.c
index aa812c63d5afac960b2e101ffc82a08ca89ec9ca..93717cf5bd8f47efd80aae87583a0b12f336beb5 100644 (file)
--- a/drivers/net/ethernet/meta/fbnic/fbnic_netdev.c
+++ b/drivers/net/ethernet/meta/fbnic/fbnic_netdev.c
@@ -33,7 +33,7 @@ int __fbnic_open(struct fbnic_net *fbn)
                dev_warn(fbd->dev,
                         "Error %d sending host ownership message to the firmware\n",
                         err);
-               goto free_resources;
+               goto err_reset_queues;
        }
 
        err = fbnic_time_start(fbn);
@@ -57,6 +57,8 @@ time_stop:
        fbnic_time_stop(fbn);
 release_ownership:
        fbnic_fw_xmit_ownership_msg(fbn->fbd, false);
+err_reset_queues:
+       fbnic_reset_netif_queues(fbn);
 free_resources:
        fbnic_free_resources(fbn);
 free_napi_vectors: