linux/net/xdp
Magnus Karlsson 1fd17c8cd0 xsk: Fix possible crash in socket_release when out-of-memory
Fix possible crash in socket_release when an out-of-memory error has
occurred in the bind call. If a socket using the XDP_SHARED_UMEM flag
encountered an error in xp_create_and_assign_umem, the bind code
jumped to the exit routine but erroneously forgot to set the err value
before jumping. This meant that the exit routine thought the setup
went well and set the state of the socket to XSK_BOUND. The xsk socket
release code will then, at application exit, think that this is a
properly setup socket, when it is not, leading to a crash when all
fields in the socket have in fact not been initialized properly. Fix
this by setting the err variable in xsk_bind so that the socket is not
set to XSK_BOUND which leads to the clean-up in xsk_release not being
triggered.

Fixes: 1c1efc2af1 ("xsk: Create and free buffer pool independently from umem")
Reported-by: syzbot+ddc7b4944bc61da19b81@syzkaller.appspotmail.com
Signed-off-by: Magnus Karlsson <magnus.karlsson@intel.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/bpf/1601112373-10595-1-git-send-email-magnus.karlsson@gmail.com
2020-09-28 21:18:01 +02:00
..
Kconfig treewide: Add SPDX license identifier - Makefile/Kconfig 2019-05-21 10:50:46 +02:00
Makefile xsk: Introduce AF_XDP buffer allocation API 2020-05-21 17:31:26 -07:00
xdp_umem.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2020-09-22 16:45:34 -07:00
xdp_umem.h xsk: Move xsk_tx_list and its lock to buffer pool 2020-08-31 21:15:04 +02:00
xsk_buff_pool.c xsk: Fix refcount warning in xp_dma_map 2020-09-14 18:43:25 -07:00
xsk_diag.c xsk: Fix possible segfault in xsk umem diagnostics 2020-09-02 16:49:40 +02:00
xsk_queue.c xsk: Remove MEM_TYPE_ZERO_COPY and corresponding code 2020-05-21 17:31:27 -07:00
xsk_queue.h xsk: Create and free buffer pool independently from umem 2020-08-31 21:15:04 +02:00
xsk.c xsk: Fix possible crash in socket_release when out-of-memory 2020-09-28 21:18:01 +02:00
xsk.h xsk: Fix possible segfault at xskmap entry insertion 2020-09-02 16:52:59 +02:00
xskmap.c xsk: Fix possible segfault at xskmap entry insertion 2020-09-02 16:52:59 +02:00