lkml.org 
[lkml]   [2020]   [Jan]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.19 611/639] xsk: Fix registration of Rx-only sockets
    Date
    From: Magnus Karlsson <magnus.karlsson@intel.com>

    [ Upstream commit 2afd23f78f39da84937006ecd24aa664a4ab052b ]

    Having Rx-only AF_XDP sockets can potentially lead to a crash in the
    system by a NULL pointer dereference in xsk_umem_consume_tx(). This
    function iterates through a list of all sockets tied to a umem and
    checks if there are any packets to send on the Tx ring. Rx-only
    sockets do not have a Tx ring, so this will cause a NULL pointer
    dereference. This will happen if you have registered one or more
    Rx-only sockets to a umem and the driver is checking the Tx ring even
    on Rx, or if the XDP_SHARED_UMEM mode is used and there is a mix of
    Rx-only and other sockets tied to the same umem.

    Fixed by only putting sockets with a Tx component on the list that
    xsk_umem_consume_tx() iterates over.

    Fixes: ac98d8aab61b ("xsk: wire upp Tx zero-copy functions")
    Reported-by: Kal Cutter Conley <kal.conley@dectris.com>
    Signed-off-by: Magnus Karlsson <magnus.karlsson@intel.com>
    Signed-off-by: Alexei Starovoitov <ast@kernel.org>
    Acked-by: Jonathan Lemon <jonathan.lemon@gmail.com>
    Link: https://lore.kernel.org/bpf/1571645818-16244-1-git-send-email-magnus.karlsson@intel.com
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    net/xdp/xdp_umem.c | 6 ++++++
    1 file changed, 6 insertions(+)

    diff --git a/net/xdp/xdp_umem.c b/net/xdp/xdp_umem.c
    index d9117ab035f7c..556a649512b60 100644
    --- a/net/xdp/xdp_umem.c
    +++ b/net/xdp/xdp_umem.c
    @@ -23,6 +23,9 @@ void xdp_add_sk_umem(struct xdp_umem *umem, struct xdp_sock *xs)
    {
    unsigned long flags;

    + if (!xs->tx)
    + return;
    +
    spin_lock_irqsave(&umem->xsk_list_lock, flags);
    list_add_rcu(&xs->list, &umem->xsk_list);
    spin_unlock_irqrestore(&umem->xsk_list_lock, flags);
    @@ -32,6 +35,9 @@ void xdp_del_sk_umem(struct xdp_umem *umem, struct xdp_sock *xs)
    {
    unsigned long flags;

    + if (!xs->tx)
    + return;
    +
    spin_lock_irqsave(&umem->xsk_list_lock, flags);
    list_del_rcu(&xs->list);
    spin_unlock_irqrestore(&umem->xsk_list_lock, flags);
    --
    2.20.1


    \
     
     \ /
      Last update: 2020-01-24 12:36    [W:2.572 / U:1.928 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site