[PATCH] um: vector: Possible underflow and races fixes

[Johannes Berg]

On Wed, 2026-10-21 at 14:05 +0100, anton.ivanov at cambridgegreys.com
wrote:
> From: Anton Ivanov <anton.ivanov at cambridgegreys.com>
> 
> Michael S. Tsirkin while working on net virtio checksum hardening
> discovered a number of issues in the uml vector driver. This patch
> addresses these issues.
> 
> 1. Use of header_size, not rx_header_size in some of the runt/underflow
> checks. IPV6 raw socket API for protocols like GRE or L2TPV2 is asymmetric -
> the header format and size in recv and send differ. All rx checks must use
> the rx specific size.
> 
> 2. Vector reuses rx and tx queue locks for stats. These queues are not
> always allocated as some transports do not use them and they can be
> disabled on the kernel command line. Resetting or accessing ethtool stats
> in this case could lead to a null pointer dereference.
> 
> 3. virtio_net_header processing was not up to date with all the GSO
> additions and changes and was skipping necessary processing.
> 
> 4. Missing barrier in vector_send().
> 
> 5. Incorrect timer destruction in net_close()

This doesn't apply, could you resend it?

Thanks,
johannes