Commit 7fcf26b3 authored by Magnus Karlsson's avatar Magnus Karlsson Committed by Daniel Borkmann
Browse files

Revert "xsk: Support redirect to any socket bound to the same umem" 



This reverts commit 2863d665.

This patch introduced a potential kernel crash when multiple napi instances
redirect to the same AF_XDP socket. By removing the queue_index check, it is
possible for multiple napi instances to access the Rx ring at the same time,
which will result in a corrupted ring state which can lead to a crash when
flushing the rings in __xsk_flush(). This can happen when the linked list of
sockets to flush gets corrupted by concurrent accesses. A quick and small fix
is not possible, so let us revert this for now.

Reported-by: default avatarYuval El-Hanany <YuvalE@radware.com>
Signed-off-by: default avatarMagnus Karlsson <magnus.karlsson@intel.com>
Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/xdp-newbies/8100DBDC-0B7C-49DB-9995-6027F6E63147@radware.com
Link: https://lore.kernel.org/bpf/20240604122927.29080-2-magnus.karlsson@gmail.com
parent d0d1df8b

net/xdp/xsk.c

+1 −4
Original line number Diff line number Diff line
@@ -313,13 +313,10 @@ static bool xsk_is_bound(struct xdp_sock *xs) 


static int xsk_rcv_check(struct xdp_sock *xs, struct xdp_buff *xdp, u32 len)

{

	struct net_device *dev = xdp->rxq->dev;

	u32 qid = xdp->rxq->queue_index;



	if (!xsk_is_bound(xs))

		return -ENXIO;



	if (!dev->_rx[qid].pool || xs->umem != dev->_rx[qid].pool->umem)

	if (xs->dev != xdp->rxq->dev || xs->queue_id != xdp->rxq->queue_index)

		return -EINVAL;



	if (len > xsk_pool_get_rx_frame_size(xs->pool) && !xs->sg) {