Re: [PATCH bpf] xsk: fix crash on double free in buffer pool - patchwork-bot+netdevbpf

From: patchwork-bot+netdevbpf@kernel.org
To: Magnus Karlsson <magnus.karlsson@gmail.com>
Cc: magnus.karlsson@intel.com, bjorn@kernel.org, ast@kernel.org,
	daniel@iogearbox.net, netdev@vger.kernel.org,
	maciej.fijalkowski@intel.com, jonathan.lemon@gmail.com,
	bpf@vger.kernel.org
Subject: Re: [PATCH bpf] xsk: fix crash on double free in buffer pool
Date: Fri, 12 Nov 2021 15:00:07 +0000	[thread overview]
Message-ID: <163672920723.2811.854129217519334722.git-patchwork-notify@kernel.org> (raw)
In-Reply-To: <20211111075707.21922-1-magnus.karlsson@gmail.com>

Hello:

This patch was applied to bpf/bpf.git (master)
by Daniel Borkmann <daniel@iogearbox.net>:

On Thu, 11 Nov 2021 08:57:07 +0100 you wrote:
> From: Magnus Karlsson <magnus.karlsson@intel.com>
> 
> Fix a crash in the buffer pool allocator when a buffer is double
> freed. It is possible to trigger this behavior not only from a faulty
> driver, but also from user space like this: Create a zero-copy AF_XDP
> socket. Load an XDP program that will issue XDP_DROP for all
> packets. Put the same umem buffer into the fill ring multiple times,
> then bind the socket and send some traffic. This will crash the kernel
> as the XDP_DROP action triggers one call to xsk_buff_free()/xp_free()
> for every packet dropped. Each call will add the corresponding buffer
> entry to the free_list and increase the free_list_cnt. Some entries
> will have been added multiple times due to the same buffer being
> freed. The buffer allocation code will then traverse this broken list
> and since the same buffer is in the list multiple times, it will try
> to delete the same buffer twice from the list leading to a crash.
> 
> [...]

Here is the summary with links:
  - [bpf] xsk: fix crash on double free in buffer pool
    https://git.kernel.org/bpf/bpf/c/199d983bc015

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html