linux/net/xdp
Magnus Karlsson 2afd23f78f xsk: Fix registration of Rx-only sockets
Having Rx-only AF_XDP sockets can potentially lead to a crash in the
system by a NULL pointer dereference in xsk_umem_consume_tx(). This
function iterates through a list of all sockets tied to a umem and
checks if there are any packets to send on the Tx ring. Rx-only
sockets do not have a Tx ring, so this will cause a NULL pointer
dereference. This will happen if you have registered one or more
Rx-only sockets to a umem and the driver is checking the Tx ring even
on Rx, or if the XDP_SHARED_UMEM mode is used and there is a mix of
Rx-only and other sockets tied to the same umem.

Fixed by only putting sockets with a Tx component on the list that
xsk_umem_consume_tx() iterates over.

Fixes: ac98d8aab6 ("xsk: wire upp Tx zero-copy functions")
Reported-by: Kal Cutter Conley <kal.conley@dectris.com>
Signed-off-by: Magnus Karlsson <magnus.karlsson@intel.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Acked-by: Jonathan Lemon <jonathan.lemon@gmail.com>
Link: https://lore.kernel.org/bpf/1571645818-16244-1-git-send-email-magnus.karlsson@intel.com
2019-10-23 20:22:11 -07:00
..
Kconfig treewide: Add SPDX license identifier - Makefile/Kconfig 2019-05-21 10:50:46 +02:00
Makefile treewide: Add SPDX license identifier - Makefile/Kconfig 2019-05-21 10:50:46 +02:00
xdp_umem.c xsk: Fix registration of Rx-only sockets 2019-10-23 20:22:11 -07:00
xdp_umem.h xdp: fix hang while unregistering device bound to xdp socket 2019-07-03 15:10:55 +02:00
xsk_diag.c xsk: lock the control mutex in sock_diag interface 2019-09-05 14:11:52 +02:00
xsk_queue.c net: xsk: add a simple buffer reuse queue 2018-09-25 13:13:15 -07:00
xsk_queue.h xsk: add support to allow unaligned chunk placement 2019-08-31 01:08:26 +02:00
xsk.c xsk: Fix crash in poll when device does not support ndo_xsk_wakeup 2019-10-03 16:34:27 +02:00
xsk.h xsk: add support for need_wakeup flag in AF_XDP rings 2019-08-17 23:07:32 +02:00