bpf.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* [PATCH bpf] xsk: fix registration of Rx-only sockets
@ 2019-10-21  8:16 Magnus Karlsson
  2019-10-23 23:03 ` Jonathan Lemon
  0 siblings, 1 reply; 5+ messages in thread
From: Magnus Karlsson @ 2019-10-21  8:16 UTC (permalink / raw)
  To: magnus.karlsson, bjorn.topel, ast, daniel, netdev,
	jonathan.lemon, kal.conley
  Cc: bpf

Having Rx-only AF_XDP sockets can potentially lead to a crash in the
system by a NULL pointer dereference in xsk_umem_consume_tx(). This
function iterates through a list of all sockets tied to a umem and
checks if there are any packets to send on the Tx ring. Rx-only
sockets do not have a Tx ring, so this will cause a NULL pointer
dereference. This will happen if you have registered one or more
Rx-only sockets to a umem and the driver is checking the Tx ring even
on Rx, or if the XDP_SHARED_UMEM mode is used and there is a mix of
Rx-only and other sockets tied to the same umem.

Fixed by only putting sockets with a Tx component on the list that
xsk_umem_consume_tx() iterates over.

Fixes: ac98d8aab61b ("xsk: wire upp Tx zero-copy functions")
Reported-by: Kal Cutter Conley <kal.conley@dectris.com>
Signed-off-by: Magnus Karlsson <magnus.karlsson@intel.com>
---
 net/xdp/xdp_umem.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/net/xdp/xdp_umem.c b/net/xdp/xdp_umem.c
index 16d5f35..3049af2 100644
--- a/net/xdp/xdp_umem.c
+++ b/net/xdp/xdp_umem.c
@@ -27,6 +27,9 @@ void xdp_add_sk_umem(struct xdp_umem *umem, struct xdp_sock *xs)
 {
 	unsigned long flags;
 
+	if (!xs->tx)
+		return;
+
 	spin_lock_irqsave(&umem->xsk_list_lock, flags);
 	list_add_rcu(&xs->list, &umem->xsk_list);
 	spin_unlock_irqrestore(&umem->xsk_list_lock, flags);
@@ -36,6 +39,9 @@ void xdp_del_sk_umem(struct xdp_umem *umem, struct xdp_sock *xs)
 {
 	unsigned long flags;
 
+	if (!xs->tx)
+		return;
+
 	spin_lock_irqsave(&umem->xsk_list_lock, flags);
 	list_del_rcu(&xs->list);
 	spin_unlock_irqrestore(&umem->xsk_list_lock, flags);
-- 
2.7.4


^ permalink raw reply	[flat|nested] 5+ messages in thread

* Re: [PATCH bpf] xsk: fix registration of Rx-only sockets
  2019-10-21  8:16 [PATCH bpf] xsk: fix registration of Rx-only sockets Magnus Karlsson
@ 2019-10-23 23:03 ` Jonathan Lemon
  2019-10-24  3:22   ` Alexei Starovoitov
  2019-10-24 12:53   ` Magnus Karlsson
  0 siblings, 2 replies; 5+ messages in thread
From: Jonathan Lemon @ 2019-10-23 23:03 UTC (permalink / raw)
  To: Magnus Karlsson; +Cc: bjorn.topel, ast, daniel, netdev, kal.conley, bpf

On 21 Oct 2019, at 1:16, Magnus Karlsson wrote:

> Having Rx-only AF_XDP sockets can potentially lead to a crash in the
> system by a NULL pointer dereference in xsk_umem_consume_tx(). This
> function iterates through a list of all sockets tied to a umem and
> checks if there are any packets to send on the Tx ring. Rx-only
> sockets do not have a Tx ring, so this will cause a NULL pointer
> dereference. This will happen if you have registered one or more
> Rx-only sockets to a umem and the driver is checking the Tx ring even
> on Rx, or if the XDP_SHARED_UMEM mode is used and there is a mix of
> Rx-only and other sockets tied to the same umem.
>
> Fixed by only putting sockets with a Tx component on the list that
> xsk_umem_consume_tx() iterates over.

A future improvement might be renaming umem->xsk_list to umem->xsk_tx_list
or similar, in order to make it clear that the list is only used on the
TX path.

>
> Fixes: ac98d8aab61b ("xsk: wire upp Tx zero-copy functions")
> Reported-by: Kal Cutter Conley <kal.conley@dectris.com>
> Signed-off-by: Magnus Karlsson <magnus.karlsson@intel.com>

Acked-by: Jonathan Lemon <jonathan.lemon@gmail.com>

-- 
Jonathan

^ permalink raw reply	[flat|nested] 5+ messages in thread

* Re: [PATCH bpf] xsk: fix registration of Rx-only sockets
  2019-10-23 23:03 ` Jonathan Lemon
@ 2019-10-24  3:22   ` Alexei Starovoitov
  2019-10-24 12:53   ` Magnus Karlsson
  1 sibling, 0 replies; 5+ messages in thread
From: Alexei Starovoitov @ 2019-10-24  3:22 UTC (permalink / raw)
  To: Jonathan Lemon
  Cc: Magnus Karlsson, Björn Töpel, Alexei Starovoitov,
	Daniel Borkmann, Network Development, kal.conley, bpf

On Wed, Oct 23, 2019 at 4:03 PM Jonathan Lemon <jonathan.lemon@gmail.com> wrote:
>
> On 21 Oct 2019, at 1:16, Magnus Karlsson wrote:
>
> > Having Rx-only AF_XDP sockets can potentially lead to a crash in the
> > system by a NULL pointer dereference in xsk_umem_consume_tx(). This
> > function iterates through a list of all sockets tied to a umem and
> > checks if there are any packets to send on the Tx ring. Rx-only
> > sockets do not have a Tx ring, so this will cause a NULL pointer
> > dereference. This will happen if you have registered one or more
> > Rx-only sockets to a umem and the driver is checking the Tx ring even
> > on Rx, or if the XDP_SHARED_UMEM mode is used and there is a mix of
> > Rx-only and other sockets tied to the same umem.
> >
> > Fixed by only putting sockets with a Tx component on the list that
> > xsk_umem_consume_tx() iterates over.
>
> A future improvement might be renaming umem->xsk_list to umem->xsk_tx_list
> or similar, in order to make it clear that the list is only used on the
> TX path.
>
> >
> > Fixes: ac98d8aab61b ("xsk: wire upp Tx zero-copy functions")
> > Reported-by: Kal Cutter Conley <kal.conley@dectris.com>
> > Signed-off-by: Magnus Karlsson <magnus.karlsson@intel.com>
>
> Acked-by: Jonathan Lemon <jonathan.lemon@gmail.com>

Applied. Thanks

^ permalink raw reply	[flat|nested] 5+ messages in thread

* Re: [PATCH bpf] xsk: fix registration of Rx-only sockets
  2019-10-23 23:03 ` Jonathan Lemon
  2019-10-24  3:22   ` Alexei Starovoitov
@ 2019-10-24 12:53   ` Magnus Karlsson
  2019-10-24 15:19     ` Alexei Starovoitov
  1 sibling, 1 reply; 5+ messages in thread
From: Magnus Karlsson @ 2019-10-24 12:53 UTC (permalink / raw)
  To: Jonathan Lemon
  Cc: Magnus Karlsson, Björn Töpel, Alexei Starovoitov,
	Daniel Borkmann, Network Development, Kal Cutter Conley, bpf

On Thu, Oct 24, 2019 at 12:47 PM Jonathan Lemon
<jonathan.lemon@gmail.com> wrote:
>
> On 21 Oct 2019, at 1:16, Magnus Karlsson wrote:
>
> > Having Rx-only AF_XDP sockets can potentially lead to a crash in the
> > system by a NULL pointer dereference in xsk_umem_consume_tx(). This
> > function iterates through a list of all sockets tied to a umem and
> > checks if there are any packets to send on the Tx ring. Rx-only
> > sockets do not have a Tx ring, so this will cause a NULL pointer
> > dereference. This will happen if you have registered one or more
> > Rx-only sockets to a umem and the driver is checking the Tx ring even
> > on Rx, or if the XDP_SHARED_UMEM mode is used and there is a mix of
> > Rx-only and other sockets tied to the same umem.
> >
> > Fixed by only putting sockets with a Tx component on the list that
> > xsk_umem_consume_tx() iterates over.
>
> A future improvement might be renaming umem->xsk_list to umem->xsk_tx_list
> or similar, in order to make it clear that the list is only used on the
> TX path.

Agreed. Had that exact name in my first internal version of the patch
:-), but that rename touched a lot of places so it obfuscated the fix
and therefore I removed it to make it clearer. But I can submit a
patch with the rename to bpf-next.

> >
> > Fixes: ac98d8aab61b ("xsk: wire upp Tx zero-copy functions")
> > Reported-by: Kal Cutter Conley <kal.conley@dectris.com>
> > Signed-off-by: Magnus Karlsson <magnus.karlsson@intel.com>
>
> Acked-by: Jonathan Lemon <jonathan.lemon@gmail.com>
>
> --
> Jonathan

^ permalink raw reply	[flat|nested] 5+ messages in thread

* Re: [PATCH bpf] xsk: fix registration of Rx-only sockets
  2019-10-24 12:53   ` Magnus Karlsson
@ 2019-10-24 15:19     ` Alexei Starovoitov
  0 siblings, 0 replies; 5+ messages in thread
From: Alexei Starovoitov @ 2019-10-24 15:19 UTC (permalink / raw)
  To: Magnus Karlsson
  Cc: Jonathan Lemon, Magnus Karlsson, Björn Töpel,
	Alexei Starovoitov, Daniel Borkmann, Network Development,
	Kal Cutter Conley, bpf

On Thu, Oct 24, 2019 at 5:53 AM Magnus Karlsson
<magnus.karlsson@gmail.com> wrote:
>
> On Thu, Oct 24, 2019 at 12:47 PM Jonathan Lemon
> <jonathan.lemon@gmail.com> wrote:
> >
> > On 21 Oct 2019, at 1:16, Magnus Karlsson wrote:
> >
> > > Having Rx-only AF_XDP sockets can potentially lead to a crash in the
> > > system by a NULL pointer dereference in xsk_umem_consume_tx(). This
> > > function iterates through a list of all sockets tied to a umem and
> > > checks if there are any packets to send on the Tx ring. Rx-only
> > > sockets do not have a Tx ring, so this will cause a NULL pointer
> > > dereference. This will happen if you have registered one or more
> > > Rx-only sockets to a umem and the driver is checking the Tx ring even
> > > on Rx, or if the XDP_SHARED_UMEM mode is used and there is a mix of
> > > Rx-only and other sockets tied to the same umem.
> > >
> > > Fixed by only putting sockets with a Tx component on the list that
> > > xsk_umem_consume_tx() iterates over.
> >
> > A future improvement might be renaming umem->xsk_list to umem->xsk_tx_list
> > or similar, in order to make it clear that the list is only used on the
> > TX path.
>
> Agreed. Had that exact name in my first internal version of the patch
> :-), but that rename touched a lot of places so it obfuscated the fix
> and therefore I removed it to make it clearer. But I can submit a
> patch with the rename to bpf-next.

please do so after bpf fixes will travel to net->linus->net-next->bpf-next
Dealing with merge conflicts is not worth it otherwise.

^ permalink raw reply	[flat|nested] 5+ messages in thread

end of thread, other threads:[~2019-10-24 15:19 UTC | newest]

Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-10-21  8:16 [PATCH bpf] xsk: fix registration of Rx-only sockets Magnus Karlsson
2019-10-23 23:03 ` Jonathan Lemon
2019-10-24  3:22   ` Alexei Starovoitov
2019-10-24 12:53   ` Magnus Karlsson
2019-10-24 15:19     ` Alexei Starovoitov

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).