mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-30 06:10:56 +00:00
xsk: Fix registration of Rx-only sockets
[ Upstream commit2afd23f78f
] Having Rx-only AF_XDP sockets can potentially lead to a crash in the system by a NULL pointer dereference in xsk_umem_consume_tx(). This function iterates through a list of all sockets tied to a umem and checks if there are any packets to send on the Tx ring. Rx-only sockets do not have a Tx ring, so this will cause a NULL pointer dereference. This will happen if you have registered one or more Rx-only sockets to a umem and the driver is checking the Tx ring even on Rx, or if the XDP_SHARED_UMEM mode is used and there is a mix of Rx-only and other sockets tied to the same umem. Fixed by only putting sockets with a Tx component on the list that xsk_umem_consume_tx() iterates over. Fixes:ac98d8aab6
("xsk: wire upp Tx zero-copy functions") Reported-by: Kal Cutter Conley <kal.conley@dectris.com> Signed-off-by: Magnus Karlsson <magnus.karlsson@intel.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Acked-by: Jonathan Lemon <jonathan.lemon@gmail.com> Link: https://lore.kernel.org/bpf/1571645818-16244-1-git-send-email-magnus.karlsson@intel.com Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
parent
5e59a74d48
commit
f6dfebc9ed
1 changed files with 6 additions and 0 deletions
|
@ -23,6 +23,9 @@ void xdp_add_sk_umem(struct xdp_umem *umem, struct xdp_sock *xs)
|
|||
{
|
||||
unsigned long flags;
|
||||
|
||||
if (!xs->tx)
|
||||
return;
|
||||
|
||||
spin_lock_irqsave(&umem->xsk_list_lock, flags);
|
||||
list_add_rcu(&xs->list, &umem->xsk_list);
|
||||
spin_unlock_irqrestore(&umem->xsk_list_lock, flags);
|
||||
|
@ -32,6 +35,9 @@ void xdp_del_sk_umem(struct xdp_umem *umem, struct xdp_sock *xs)
|
|||
{
|
||||
unsigned long flags;
|
||||
|
||||
if (!xs->tx)
|
||||
return;
|
||||
|
||||
spin_lock_irqsave(&umem->xsk_list_lock, flags);
|
||||
list_del_rcu(&xs->list);
|
||||
spin_unlock_irqrestore(&umem->xsk_list_lock, flags);
|
||||
|
|
Loading…
Reference in a new issue