| Message ID | 1571645818-16244-1-git-send-email-magnus.karlsson@intel.com |
|---|---|
| State | Accepted |
| Delegated to: | BPF Maintainers |
| Headers | show |
| Series | [bpf] xsk: fix registration of Rx-only sockets | expand |
On 21 Oct 2019, at 1:16, Magnus Karlsson wrote: > Having Rx-only AF_XDP sockets can potentially lead to a crash in the > system by a NULL pointer dereference in xsk_umem_consume_tx(). This > function iterates through a list of all sockets tied to a umem and > checks if there are any packets to send on the Tx ring. Rx-only > sockets do not have a Tx ring, so this will cause a NULL pointer > dereference. This will happen if you have registered one or more > Rx-only sockets to a umem and the driver is checking the Tx ring even > on Rx, or if the XDP_SHARED_UMEM mode is used and there is a mix of > Rx-only and other sockets tied to the same umem. > > Fixed by only putting sockets with a Tx component on the list that > xsk_umem_consume_tx() iterates over. A future improvement might be renaming umem->xsk_list to umem->xsk_tx_list or similar, in order to make it clear that the list is only used on the TX path. > > Fixes: ac98d8aab61b ("xsk: wire upp Tx zero-copy functions") > Reported-by: Kal Cutter Conley <kal.conley@dectris.com> > Signed-off-by: Magnus Karlsson <magnus.karlsson@intel.com> Acked-by: Jonathan Lemon <jonathan.lemon@gmail.com>
On Wed, Oct 23, 2019 at 4:03 PM Jonathan Lemon <jonathan.lemon@gmail.com> wrote: > > On 21 Oct 2019, at 1:16, Magnus Karlsson wrote: > > > Having Rx-only AF_XDP sockets can potentially lead to a crash in the > > system by a NULL pointer dereference in xsk_umem_consume_tx(). This > > function iterates through a list of all sockets tied to a umem and > > checks if there are any packets to send on the Tx ring. Rx-only > > sockets do not have a Tx ring, so this will cause a NULL pointer > > dereference. This will happen if you have registered one or more > > Rx-only sockets to a umem and the driver is checking the Tx ring even > > on Rx, or if the XDP_SHARED_UMEM mode is used and there is a mix of > > Rx-only and other sockets tied to the same umem. > > > > Fixed by only putting sockets with a Tx component on the list that > > xsk_umem_consume_tx() iterates over. > > A future improvement might be renaming umem->xsk_list to umem->xsk_tx_list > or similar, in order to make it clear that the list is only used on the > TX path. > > > > > Fixes: ac98d8aab61b ("xsk: wire upp Tx zero-copy functions") > > Reported-by: Kal Cutter Conley <kal.conley@dectris.com> > > Signed-off-by: Magnus Karlsson <magnus.karlsson@intel.com> > > Acked-by: Jonathan Lemon <jonathan.lemon@gmail.com> Applied. Thanks
On Thu, Oct 24, 2019 at 12:47 PM Jonathan Lemon <jonathan.lemon@gmail.com> wrote: > > On 21 Oct 2019, at 1:16, Magnus Karlsson wrote: > > > Having Rx-only AF_XDP sockets can potentially lead to a crash in the > > system by a NULL pointer dereference in xsk_umem_consume_tx(). This > > function iterates through a list of all sockets tied to a umem and > > checks if there are any packets to send on the Tx ring. Rx-only > > sockets do not have a Tx ring, so this will cause a NULL pointer > > dereference. This will happen if you have registered one or more > > Rx-only sockets to a umem and the driver is checking the Tx ring even > > on Rx, or if the XDP_SHARED_UMEM mode is used and there is a mix of > > Rx-only and other sockets tied to the same umem. > > > > Fixed by only putting sockets with a Tx component on the list that > > xsk_umem_consume_tx() iterates over. > > A future improvement might be renaming umem->xsk_list to umem->xsk_tx_list > or similar, in order to make it clear that the list is only used on the > TX path. Agreed. Had that exact name in my first internal version of the patch :-), but that rename touched a lot of places so it obfuscated the fix and therefore I removed it to make it clearer. But I can submit a patch with the rename to bpf-next. > > > > Fixes: ac98d8aab61b ("xsk: wire upp Tx zero-copy functions") > > Reported-by: Kal Cutter Conley <kal.conley@dectris.com> > > Signed-off-by: Magnus Karlsson <magnus.karlsson@intel.com> > > Acked-by: Jonathan Lemon <jonathan.lemon@gmail.com> > > -- > Jonathan
On Thu, Oct 24, 2019 at 5:53 AM Magnus Karlsson <magnus.karlsson@gmail.com> wrote: > > On Thu, Oct 24, 2019 at 12:47 PM Jonathan Lemon > <jonathan.lemon@gmail.com> wrote: > > > > On 21 Oct 2019, at 1:16, Magnus Karlsson wrote: > > > > > Having Rx-only AF_XDP sockets can potentially lead to a crash in the > > > system by a NULL pointer dereference in xsk_umem_consume_tx(). This > > > function iterates through a list of all sockets tied to a umem and > > > checks if there are any packets to send on the Tx ring. Rx-only > > > sockets do not have a Tx ring, so this will cause a NULL pointer > > > dereference. This will happen if you have registered one or more > > > Rx-only sockets to a umem and the driver is checking the Tx ring even > > > on Rx, or if the XDP_SHARED_UMEM mode is used and there is a mix of > > > Rx-only and other sockets tied to the same umem. > > > > > > Fixed by only putting sockets with a Tx component on the list that > > > xsk_umem_consume_tx() iterates over. > > > > A future improvement might be renaming umem->xsk_list to umem->xsk_tx_list > > or similar, in order to make it clear that the list is only used on the > > TX path. > > Agreed. Had that exact name in my first internal version of the patch > :-), but that rename touched a lot of places so it obfuscated the fix > and therefore I removed it to make it clearer. But I can submit a > patch with the rename to bpf-next. please do so after bpf fixes will travel to net->linus->net-next->bpf-next Dealing with merge conflicts is not worth it otherwise.
diff --git a/net/xdp/xdp_umem.c b/net/xdp/xdp_umem.c index 16d5f35..3049af2 100644 --- a/net/xdp/xdp_umem.c +++ b/net/xdp/xdp_umem.c @@ -27,6 +27,9 @@ void xdp_add_sk_umem(struct xdp_umem *umem, struct xdp_sock *xs) { unsigned long flags; + if (!xs->tx) + return; + spin_lock_irqsave(&umem->xsk_list_lock, flags); list_add_rcu(&xs->list, &umem->xsk_list); spin_unlock_irqrestore(&umem->xsk_list_lock, flags); @@ -36,6 +39,9 @@ void xdp_del_sk_umem(struct xdp_umem *umem, struct xdp_sock *xs) { unsigned long flags; + if (!xs->tx) + return; + spin_lock_irqsave(&umem->xsk_list_lock, flags); list_del_rcu(&xs->list); spin_unlock_irqrestore(&umem->xsk_list_lock, flags);
Having Rx-only AF_XDP sockets can potentially lead to a crash in the system by a NULL pointer dereference in xsk_umem_consume_tx(). This function iterates through a list of all sockets tied to a umem and checks if there are any packets to send on the Tx ring. Rx-only sockets do not have a Tx ring, so this will cause a NULL pointer dereference. This will happen if you have registered one or more Rx-only sockets to a umem and the driver is checking the Tx ring even on Rx, or if the XDP_SHARED_UMEM mode is used and there is a mix of Rx-only and other sockets tied to the same umem. Fixed by only putting sockets with a Tx component on the list that xsk_umem_consume_tx() iterates over. Fixes: ac98d8aab61b ("xsk: wire upp Tx zero-copy functions") Reported-by: Kal Cutter Conley <kal.conley@dectris.com> Signed-off-by: Magnus Karlsson <magnus.karlsson@intel.com> --- net/xdp/xdp_umem.c | 6 ++++++ 1 file changed, 6 insertions(+)