| Message ID | 1599036743-26454-1-git-send-email-magnus.karlsson@intel.com |
|---|---|
| State | Accepted |
| Delegated to: | BPF Maintainers |
| Headers | show |
| Series | [bpf-next] xsk: fix possible segfault in xsk umem diagnostics | expand |
On 9/2/20 10:52 AM, Magnus Karlsson wrote: > Fix possible segfault in the xsk diagnostics code when dumping > information about the umem. This can happen when a umem has been > created, but the socket has not been bound yet. In this case, the xsk > buffer pool does not exist yet and we cannot dump the information > that was moved from the umem to the buffer pool. Fix this by testing > for the existence of the buffer pool and if not there, do not dump any > of that information. > > Signed-off-by: Magnus Karlsson <magnus.karlsson@intel.com> > Reported-by: syzbot+3f04d36b7336f7868066@syzkaller.appspotmail.com > Fixes: c2d3d6a47462 ("xsk: Move queue_id, dev and need_wakeup to buffer pool") > Fixes: 7361f9c3d719 ("xsk: Move fill and completion rings to buffer pool") Applied, thanks!
diff --git a/net/xdp/xsk_diag.c b/net/xdp/xsk_diag.c index 5bd8ea9..3cf6435 100644 --- a/net/xdp/xsk_diag.c +++ b/net/xdp/xsk_diag.c @@ -59,8 +59,8 @@ static int xsk_diag_put_umem(const struct xdp_sock *xs, struct sk_buff *nlskb) du.num_pages = umem->npgs; du.chunk_size = umem->chunk_size; du.headroom = umem->headroom; - du.ifindex = pool->netdev ? pool->netdev->ifindex : 0; - du.queue_id = pool->queue_id; + du.ifindex = (pool && pool->netdev) ? pool->netdev->ifindex : 0; + du.queue_id = pool ? pool->queue_id : 0; du.flags = 0; if (umem->zc) du.flags |= XDP_DU_F_ZEROCOPY; @@ -68,10 +68,10 @@ static int xsk_diag_put_umem(const struct xdp_sock *xs, struct sk_buff *nlskb) err = nla_put(nlskb, XDP_DIAG_UMEM, sizeof(du), &du); - if (!err && pool->fq) + if (!err && pool && pool->fq) err = xsk_diag_put_ring(pool->fq, XDP_DIAG_UMEM_FILL_RING, nlskb); - if (!err && pool->cq) { + if (!err && pool && pool->cq) { err = xsk_diag_put_ring(pool->cq, XDP_DIAG_UMEM_COMPLETION_RING, nlskb); }
Fix possible segfault in the xsk diagnostics code when dumping information about the umem. This can happen when a umem has been created, but the socket has not been bound yet. In this case, the xsk buffer pool does not exist yet and we cannot dump the information that was moved from the umem to the buffer pool. Fix this by testing for the existence of the buffer pool and if not there, do not dump any of that information. Signed-off-by: Magnus Karlsson <magnus.karlsson@intel.com> Reported-by: syzbot+3f04d36b7336f7868066@syzkaller.appspotmail.com Fixes: c2d3d6a47462 ("xsk: Move queue_id, dev and need_wakeup to buffer pool") Fixes: 7361f9c3d719 ("xsk: Move fill and completion rings to buffer pool") --- net/xdp/xsk_diag.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)