• Magnus Karlsson's avatar
    xsk: Fix possible segfault at xskmap entry insertion · 968be23c
    Magnus Karlsson authored
    Fix possible segfault when entry is inserted into xskmap. This can
    happen if the socket is in a state where the umem has been set up, the
    Rx ring created but it has yet to be bound to a device. In this case
    the pool has not yet been created and we cannot reference it for the
    existence of the fill ring. Fix this by removing the whole
    xsk_is_setup_for_bpf_map function. Once upon a time, it was used to
    make sure that the Rx and fill rings where set up before the driver
    could call xsk_rcv, since there are no tests for the existence of
    these rings in the data path. But these days, we have a state variable
    that we test instead. When it is XSK_BOUND, everything has been set up
    correctly and the socket has been bound. So no reason to have the
    xsk_is_setup_for_bpf_map function anymore.
    
    Fixes: 7361f9c3 ("xsk: Move fill and completion rings to buffer pool")
    Reported-by: syzbot+febe51d44243fbc564ee@syzkaller.appspotmail.com
    Signed-off-by: default avatarMagnus Karlsson <magnus.karlsson@intel.com>
    Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
    Link: https://lore.kernel.org/bpf/1599037569-26690-1-git-send-email-magnus.karlsson@intel.com
    968be23c
xsk.c 27.2 KB