Magnus Karlsson 9ad0375ed2 xsk: Fix race in SKB mode transmit with shared cq ... commit f09ced4053 upstream. Fix a race when multiple sockets are simultaneously calling sendto() when the completion ring is shared in the SKB case. This is the case when you share the same netdev and queue id through the XDP_SHARED_UMEM bind flag. The problem is that multiple processes can be in xsk_generic_xmit() and call the backpressure mechanism in xskq_prod_reserve(xs->pool->cq). As this is a shared resource in this specific scenario, a race might occur since the rings are single-producer single-consumer. Fix this by moving the tx_completion_lock from the socket to the pool as the pool is shared between the sockets that share the completion ring. (The pool is not shared when this is not the case.) And then protect the accesses to xskq_prod_reserve() with this lock. The tx_completion_lock is renamed cq_lock to better reflect that it protects accesses to the potentially shared completion ring. Fixes: 35fcde7f8d ("xsk: support for Tx") Reported-by: Xuan Zhuo <xuanzhuo@linux.alibaba.com> Signed-off-by: Magnus Karlsson <magnus.karlsson@intel.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Acked-by: Björn Töpel <bjorn.topel@intel.com> Link: https://lore.kernel.org/bpf/20201218134525.13119-2-magnus.karlsson@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2021-01-17 14:17:05 +01:00
..
Kconfig	treewide: Add SPDX license identifier - Makefile/Kconfig	2019-05-21 10:50:46 +02:00
Makefile	xsk: Introduce AF_XDP buffer allocation API	2020-05-21 17:31:26 -07:00
xdp_umem.c	xsk: Fix umem cleanup bug at socket destruct	2020-11-20 15:52:39 +01:00
xdp_umem.h	xsk: Fix umem cleanup bug at socket destruct	2020-11-20 15:52:39 +01:00
xsk.c	xsk: Fix race in SKB mode transmit with shared cq	2021-01-17 14:17:05 +01:00
xsk.h	xsk: Fix possible segfault at xskmap entry insertion	2020-09-02 16:52:59 +02:00
xsk_buff_pool.c	xsk: Fix race in SKB mode transmit with shared cq	2021-01-17 14:17:05 +01:00
xsk_diag.c	xsk: Fix possible segfault in xsk umem diagnostics	2020-09-02 16:49:40 +02:00
xsk_queue.c	xsk: Remove MEM_TYPE_ZERO_COPY and corresponding code	2020-05-21 17:31:27 -07:00
xsk_queue.h	xsk: Change the tx writeable condition	2020-12-03 01:14:38 +01:00
xskmap.c	bpf: Allow for map-in-map with dynamic inner array map entries	2020-10-11 10:21:04 -07:00