linux-stable/net/xdp
Magnus Karlsson 3e019d8a05 xsk: Fix xsk_diag use-after-free error during socket cleanup
Fix a use-after-free error that is possible if the xsk_diag interface
is used after the socket has been unbound from the device. This can
happen either due to the socket being closed or the device
disappearing. In the early days of AF_XDP, the way we tested that a
socket was not bound to a device was to simply check if the netdevice
pointer in the xsk socket structure was NULL. Later, a better system
was introduced by having an explicit state variable in the xsk socket
struct. For example, the state of a socket that is on the way to being
closed and has been unbound from the device is XSK_UNBOUND.

The commit in the Fixes tag below deleted the old way of signalling
that a socket is unbound, setting dev to NULL. This in the belief that
all code using the old way had been exterminated. That was
unfortunately not true as the xsk diagnostics code was still using the
old way and thus does not work as intended when a socket is going
down. Fix this by introducing a test against the state variable. If
the socket is in the state XSK_UNBOUND, simply abort the diagnostic's
netlink operation.

Fixes: 18b1ab7aa7 ("xsk: Fix race at socket teardown")
Reported-by: syzbot+822d1359297e2694f873@syzkaller.appspotmail.com
Signed-off-by: Magnus Karlsson <magnus.karlsson@intel.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Tested-by: syzbot+822d1359297e2694f873@syzkaller.appspotmail.com
Tested-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com>
Reviewed-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com>
Link: https://lore.kernel.org/bpf/20230831100119.17408-1-magnus.karlsson@gmail.com
2023-08-31 13:21:11 +02:00
..
Kconfig treewide: Add SPDX license identifier - Makefile/Kconfig 2019-05-21 10:50:46 +02:00
Makefile xsk: Introduce AF_XDP buffer allocation API 2020-05-21 17:31:26 -07:00
xdp_umem.c mm/gup: remove vmas parameter from pin_user_pages() 2023-06-09 16:25:26 -07:00
xdp_umem.h xsk: Fix umem cleanup bug at socket destruct 2020-11-20 15:52:39 +01:00
xsk.c xsk: Fix xsk_build_skb() error: 'skb' dereferencing possible ERR_PTR() 2023-08-30 08:41:23 +02:00
xsk.h xdp: Add proper __rcu annotations to redirect map entries 2021-06-24 19:41:15 +02:00
xsk_buff_pool.c xsk: support mbuf on ZC RX 2023-07-19 09:56:49 -07:00
xsk_diag.c xsk: Fix xsk_diag use-after-free error during socket cleanup 2023-08-31 13:21:11 +02:00
xsk_queue.c xsk: support use vaddr as ring 2023-02-20 08:22:12 +00:00
xsk_queue.h xsk: support ZC Tx multi-buffer in batch API 2023-07-19 09:56:50 -07:00
xskmap.c bpf: Centralize permissions checks for all BPF map types 2023-06-19 14:04:04 +02:00