linux/net/xdp
Tirthendu Sarkar 9d0a67b9d4 xsk: Fix xsk_build_skb() error: 'skb' dereferencing possible ERR_PTR()
Currently, xsk_build_skb() is a function that builds skb in two possible
ways and then is ended with common error handling.

We can distinguish four possible error paths and handling in xsk_build_skb():

 1. sock_alloc_send_skb fails: Retry (skb is NULL).
 2. skb_store_bits fails : Free skb and retry.
 3. MAX_SKB_FRAGS exceeded: Free skb, cleanup and drop packet.
 4. alloc_page fails for frag: Retry page allocation w/o freeing skb

1] and 3] can happen in xsk_build_skb_zerocopy(), which is one of the
two code paths responsible for building skb. Common error path in
xsk_build_skb() assumes that in case errno != -EAGAIN, skb is a valid
pointer, which is wrong as kernel test robot reports that in
xsk_build_skb_zerocopy() other errno values are returned for skb being
NULL.

To fix this, set -EOVERFLOW as error when MAX_SKB_FRAGS are exceeded
and packet needs to be dropped in both xsk_build_skb() and
xsk_build_skb_zerocopy() and use this to distinguish against all other
error cases. Also, add explicit kfree_skb() for 3] so that handling
of 1], 2], and 3] becomes identical where allocation needs to be retried.

Fixes: cf24f5a5fe ("xsk: add support for AF_XDP multi-buffer on Tx path")
Reported-by: kernel test robot <lkp@intel.com>
Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
Signed-off-by: Tirthendu Sarkar <tirthendu.sarkar@intel.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Magnus Karlsson <magnus.karlsson@intel.com>
Closes: https://lore.kernel.org/r/202307210434.OjgqFcbB-lkp@intel.com
Link: https://lore.kernel.org/bpf/20230823144713.2231808-1-tirthendu.sarkar@intel.com
2023-08-30 08:41:23 +02:00
..
Kconfig treewide: Add SPDX license identifier - Makefile/Kconfig 2019-05-21 10:50:46 +02:00
Makefile xsk: Introduce AF_XDP buffer allocation API 2020-05-21 17:31:26 -07:00
xdp_umem.c mm/gup: remove vmas parameter from pin_user_pages() 2023-06-09 16:25:26 -07:00
xdp_umem.h xsk: Fix umem cleanup bug at socket destruct 2020-11-20 15:52:39 +01:00
xsk_buff_pool.c xsk: support mbuf on ZC RX 2023-07-19 09:56:49 -07:00
xsk_diag.c xsk: Fix possible segfault in xsk umem diagnostics 2020-09-02 16:49:40 +02:00
xsk_queue.c xsk: support use vaddr as ring 2023-02-20 08:22:12 +00:00
xsk_queue.h xsk: support ZC Tx multi-buffer in batch API 2023-07-19 09:56:50 -07:00
xsk.c xsk: Fix xsk_build_skb() error: 'skb' dereferencing possible ERR_PTR() 2023-08-30 08:41:23 +02:00
xsk.h xdp: Add proper __rcu annotations to redirect map entries 2021-06-24 19:41:15 +02:00
xskmap.c bpf: Centralize permissions checks for all BPF map types 2023-06-19 14:04:04 +02:00