Magnus Karlsson 6436973164 xsk: Fix xsk_diag use-after-free error during socket cleanup ... [ Upstream commit 3e019d8a05 ] Fix a use-after-free error that is possible if the xsk_diag interface is used after the socket has been unbound from the device. This can happen either due to the socket being closed or the device disappearing. In the early days of AF_XDP, the way we tested that a socket was not bound to a device was to simply check if the netdevice pointer in the xsk socket structure was NULL. Later, a better system was introduced by having an explicit state variable in the xsk socket struct. For example, the state of a socket that is on the way to being closed and has been unbound from the device is XSK_UNBOUND. The commit in the Fixes tag below deleted the old way of signalling that a socket is unbound, setting dev to NULL. This in the belief that all code using the old way had been exterminated. That was unfortunately not true as the xsk diagnostics code was still using the old way and thus does not work as intended when a socket is going down. Fix this by introducing a test against the state variable. If the socket is in the state XSK_UNBOUND, simply abort the diagnostic's netlink operation. Fixes: 18b1ab7aa7 ("xsk: Fix race at socket teardown") Reported-by: syzbot+822d1359297e2694f873@syzkaller.appspotmail.com Signed-off-by: Magnus Karlsson <magnus.karlsson@intel.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Tested-by: syzbot+822d1359297e2694f873@syzkaller.appspotmail.com Tested-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com> Reviewed-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com> Link: https://lore.kernel.org/bpf/20230831100119.17408-1-magnus.karlsson@gmail.com Signed-off-by: Sasha Levin <sashal@kernel.org>		2023-09-19 12:28:01 +02:00
..
Kconfig	treewide: Add SPDX license identifier - Makefile/Kconfig	2019-05-21 10:50:46 +02:00
Makefile	xsk: Introduce AF_XDP buffer allocation API	2020-05-21 17:31:26 -07:00
xdp_umem.c	xsk: Add missing overflow check in xdp_umem_reg	2023-03-30 12:49:02 +02:00
xdp_umem.h	xsk: Fix umem cleanup bug at socket destruct	2020-11-20 15:52:39 +01:00
xsk.c	xsk: fix refcount underflow in error path	2023-08-16 18:27:27 +02:00
xsk.h	xdp: Add proper __rcu annotations to redirect map entries	2021-06-24 19:41:15 +02:00
xsk_buff_pool.c	xsk: Inherit need_wakeup flag for shared sockets	2022-09-22 17:16:22 +02:00
xsk_diag.c	xsk: Fix xsk_diag use-after-free error during socket cleanup	2023-09-19 12:28:01 +02:00
xsk_queue.c	xsk: Remove MEM_TYPE_ZERO_COPY and corresponding code	2020-05-21 17:31:27 -07:00
xsk_queue.h	xsk: Fix unaligned descriptor validation	2023-05-11 23:03:21 +09:00
xskmap.c	bpf: Compute map_btf_id during build time	2022-04-26 11:35:21 -07:00