Commit bf6d507f authored by Linpu Yu's avatar Linpu Yu Committed by Alexei Starovoitov
Browse files

xskmap: reject TX-only AF_XDP sockets 



XSKMAP entries are used as redirect targets for incoming XDP frames.
A TX-only AF_XDP socket lacks an Rx ring and cannot handle redirected
traffic, but xsk_map_update_elem() currently allows such sockets to
be inserted into the map.

Redirecting packets to such a socket on the veth generic-XDP path
causes a kernel crash in xsk_generic_rcv().

This became possible after xsk_is_setup_for_bpf_map() was removed from
the XSKMAP update path, which allowed bound TX-only sockets to be
inserted into the map.

Reject TX-only sockets during XSKMAP updates to avoid the crash.
They remain fully operational for pure Tx purposes outside XSKMAP.

Fixes: 968be23c ("xsk: Fix possible segfault at xskmap entry insertion")
Reported-by: default avatarJuefei Pu <tomapufckgml@gmail.com>
Reported-by: default avatarYuan Tan <yuantan098@gmail.com>
Reported-by: default avatarXin Liu <bird@lzu.edu.cn>
Signed-off-by: default avatarYifan Wu <yifanwucs@gmail.com>
Signed-off-by: default avatarLinpu Yu <linpu5433@gmail.com>
Reviewed-by: default avatarJason Xing <kerneljasonxing@gmail.com>
Link: https://lore.kernel.org/r/20260508144344.694-1-linpu5433@gmail.com


Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
parent 512809bb

net/xdp/xskmap.c

+4 −0
Original line number Diff line number Diff line
@@ -184,6 +184,10 @@ static long xsk_map_update_elem(struct bpf_map *map, void *key, void *value, 
	}



	xs = (struct xdp_sock *)sock->sk;

	if (!READ_ONCE(xs->rx)) {

		sockfd_put(sock);

		return -ENOBUFS;

	}



	map_entry = &m->xsk_map[i];

	node = xsk_map_node_alloc(m, map_entry);