From: Magnus Karlsson magnus.karlsson@intel.com
[ Upstream commit 2afd23f78f39da84937006ecd24aa664a4ab052b ]
Having Rx-only AF_XDP sockets can potentially lead to a crash in the system by a NULL pointer dereference in xsk_umem_consume_tx(). This function iterates through a list of all sockets tied to a umem and checks if there are any packets to send on the Tx ring. Rx-only sockets do not have a Tx ring, so this will cause a NULL pointer dereference. This will happen if you have registered one or more Rx-only sockets to a umem and the driver is checking the Tx ring even on Rx, or if the XDP_SHARED_UMEM mode is used and there is a mix of Rx-only and other sockets tied to the same umem.
Fixed by only putting sockets with a Tx component on the list that xsk_umem_consume_tx() iterates over.
Fixes: ac98d8aab61b ("xsk: wire upp Tx zero-copy functions") Reported-by: Kal Cutter Conley kal.conley@dectris.com Signed-off-by: Magnus Karlsson magnus.karlsson@intel.com Signed-off-by: Alexei Starovoitov ast@kernel.org Acked-by: Jonathan Lemon jonathan.lemon@gmail.com Link: https://lore.kernel.org/bpf/1571645818-16244-1-git-send-email-magnus.karlsso... Signed-off-by: Sasha Levin sashal@kernel.org --- net/xdp/xdp_umem.c | 6 ++++++ 1 file changed, 6 insertions(+)
diff --git a/net/xdp/xdp_umem.c b/net/xdp/xdp_umem.c index d9117ab035f7..556a649512b6 100644 --- a/net/xdp/xdp_umem.c +++ b/net/xdp/xdp_umem.c @@ -23,6 +23,9 @@ void xdp_add_sk_umem(struct xdp_umem *umem, struct xdp_sock *xs) { unsigned long flags;
+ if (!xs->tx) + return; + spin_lock_irqsave(&umem->xsk_list_lock, flags); list_add_rcu(&xs->list, &umem->xsk_list); spin_unlock_irqrestore(&umem->xsk_list_lock, flags); @@ -32,6 +35,9 @@ void xdp_del_sk_umem(struct xdp_umem *umem, struct xdp_sock *xs) { unsigned long flags;
+ if (!xs->tx) + return; + spin_lock_irqsave(&umem->xsk_list_lock, flags); list_del_rcu(&xs->list); spin_unlock_irqrestore(&umem->xsk_list_lock, flags);