)]}'
{
  "commit": "08f566e8f83bb70f04ad5aba5be352c490a01c8a",
  "tree": "675eeeb44f57a5c54254b4f8550b9872906bb99a",
  "parents": [
    "593dfd40a94ca0ab20297ea4629d94268deed0ed"
  ],
  "author": {
    "name": "Jesper Dangaard Brouer",
    "email": "hawk@kernel.org",
    "time": "Tue May 05 15:21:53 2026 +0200"
  },
  "committer": {
    "name": "Paolo Abeni",
    "email": "pabeni@redhat.com",
    "time": "Thu May 07 16:24:07 2026 +0200"
  },
  "message": "veth: fix OOB txq access in veth_poll() with asymmetric queue counts\n\nXDP redirect into a veth device (via bpf_redirect()) calls\nveth_xdp_xmit(), which enqueues frames into the peer\u0027s ptr_ring using\n  smp_processor_id() % peer-\u003ereal_num_rx_queues\nas the ring index.  With an asymmetric veth pair where the peer has\nfewer TX queues than RX queues, that index can exceed\npeer-\u003ereal_num_tx_queues.\n\nveth_poll() then resolves peer_txq for the ring via:\n\n  peer_txq \u003d peer_dev ? netdev_get_tx_queue(peer_dev, queue_idx) : NULL;\n\nwhere queue_idx \u003d rq-\u003exdp_rxq.queue_index.  When queue_idx exceeds\npeer_dev-\u003ereal_num_tx_queues this is an out-of-bounds (OOB) access\ninto the peer\u0027s netdev_queue array, triggering DEBUG_NET_WARN_ON_ONCE\nin netdev_get_tx_queue().\n\nThe normal ndo_start_xmit path is not affected: the stack clamps\nskb-\u003equeue_mapping via netdev_cap_txqueue() before invoking\nndo_start_xmit, so rxq in veth_xmit() never exceeds real_num_tx_queues.\n\nFix veth_poll() by clamping: only dereference peer_txq when queue_idx is\nwithin bounds, otherwise set it to NULL.  The out-of-range rings are fed\nexclusively via XDP redirect (veth_xdp_xmit), never via ndo_start_xmit\n(veth_xmit), so the peer txq was never stopped and there is nothing to\nwake; NULL is the correct fallback.\n\nReported-by: Sashiko \u003csashiko-bot@kernel.org\u003e\nCloses: https://lore.kernel.org/all/20260502071828.616C3C19425@smtp.kernel.org/\nFixes: dc82a33297fc (\"veth: apply qdisc backpressure on full ptr_ring to reduce TX drops\")\nSigned-off-by: Jesper Dangaard Brouer \u003chawk@kernel.org\u003e\nLink: https://patch.msgid.link/20260505132159.241305-2-hawk@kernel.org\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "e35df717e65e28757c27db019fccf1ce065c299a",
      "old_mode": 33188,
      "old_path": "drivers/net/veth.c",
      "new_id": "0cfb19b760dd54eb896f469c02bb02ecf5eef504",
      "new_mode": 33188,
      "new_path": "drivers/net/veth.c"
    }
  ]
}