On Thu, Oct 24, 2019 at 12:47 PM Jonathan Lemon
<jonathan.lemon@xxxxxxxxx> wrote:
>
> On 21 Oct 2019, at 1:16, Magnus Karlsson wrote:
>
> > Having Rx-only AF_XDP sockets can potentially lead to a crash in the
> > system by a NULL pointer dereference in xsk_umem_consume_tx(). This
> > function iterates through a list of all sockets tied to a umem and
> > checks if there are any packets to send on the Tx ring. Rx-only
> > sockets do not have a Tx ring, so this will cause a NULL pointer
> > dereference. This will happen if you have registered one or more
> > Rx-only sockets to a umem and the driver is checking the Tx ring even
> > on Rx, or if the XDP_SHARED_UMEM mode is used and there is a mix of
> > Rx-only and other sockets tied to the same umem.
> >
> > Fixed by only putting sockets with a Tx component on the list that
> > xsk_umem_consume_tx() iterates over.
>
> A future improvement might be renaming umem->xsk_list to umem->xsk_tx_list
> or similar, in order to make it clear that the list is only used on the
> TX path.
Agreed. Had that exact name in my first internal version of the patch
:-), but that rename touched a lot of places so it obfuscated the fix
and therefore I removed it to make it clearer. But I can submit a
patch with the rename to bpf-next.
> >
> > Fixes: ac98d8aab61b ("xsk: wire upp Tx zero-copy functions")
> > Reported-by: Kal Cutter Conley <kal.conley@xxxxxxxxxxx>
> > Signed-off-by: Magnus Karlsson <magnus.karlsson@xxxxxxxxx>
>
> Acked-by: Jonathan Lemon <jonathan.lemon@xxxxxxxxx>
>
> --
> Jonathan
