Re: [PATCH net] netconsole: harden the enablement through configfs.

[Gustavo Luiz Duarte]

On Thu, Nov 12, 2026 at 2:05 PM Breno Leitao <leitao@xxxxxxxxxx> wrote:
>
> There is a possible race when enabling/disabling the target through
> configfs with netdev events that can call a null pointer dereference.
>
> My robot was able to come up with a reproducer by adding a bunch of
> msleeps() around.
>
> The race is basically this one:
>
>   CPU 0 (enabled_store)             CPU 1 (netconsole_netdev_event)
>   current_enabled = true
>                                     nt->state = STATE_DEACTIVATED
>                                     do_netpoll_cleanup()
>                                       np->dev = NULL
>   nt->state = STATE_DISABLED
>   list_move(&nt->list, &target_cleanup_list)
>   do_netpoll_cleanup()
>     __netpoll_cleanup(): np->dev->npinfo
>
> And kasan reports:
>
>   KASAN: null-ptr-deref in range [0x0000000000000108-0x000000000000010f]
>   RIP: 0010:__netpoll_cleanup
>   Call Trace:
>    do_netpoll_cleanup
>    netconsole_process_cleanups_core
>    enabled_store
>    configfs_write_iter
>
> The disable path used to call netpoll_cleanup(), which skips a netpoll
> without a device, until it started deferring the release to
> target_cleanup_list.
>
> Re-check the state under target_list_lock, which the notifier holds when
> it stops a target, and queue the target only if it is still enabled.
> Mark it disabled either way, as before.
>
> Signed-off-by: Breno Leitao <leitao@xxxxxxxxxx>

Good catch!
Reviewed-by: Gustavo Luiz Duarte <gustavold@xxxxxxxxx>