Maciej Fijalkowski ba3beec2ec xsk: Fix possible crash when multiple sockets are created ... Fix a crash that happens if an Rx only socket is created first, then a second socket is created that is Tx only and bound to the same umem as the first socket and also the same netdev and queue_id together with the XDP_SHARED_UMEM flag. In this specific case, the tx_descs array page pool was not created by the first socket as it was an Rx only socket. When the second socket is bound it needs this tx_descs array of this shared page pool as it has a Tx component, but unfortunately it was never allocated, leading to a crash. Note that this array is only used for zero-copy drivers using the batched Tx APIs, currently only ice and i40e. [ 5511.150360] BUG: kernel NULL pointer dereference, address: 0000000000000008 [ 5511.158419] #PF: supervisor write access in kernel mode [ 5511.164472] #PF: error_code(0x0002) - not-present page [ 5511.170416] PGD 0 P4D 0 [ 5511.173347] Oops: 0002 [#1] PREEMPT SMP PTI [ 5511.178186] CPU: 0 PID: 0 Comm: swapper/0 Tainted: G E 5.18.0-rc1+ #97 [ 5511.187245] Hardware name: Intel Corp. GRANTLEY/GRANTLEY, BIOS GRRFCRB1.86B.0276.D07.1605190235 05/19/2016 [ 5511.198418] RIP: 0010:xsk_tx_peek_release_desc_batch+0x198/0x310 [ 5511.205375] Code: c0 83 c6 01 84 c2 74 6d 8d 46 ff 23 07 44 89 e1 48 83 c0 14 48 c1 e1 04 48 c1 e0 04 48 03 47 10 4c 01 c1 48 8b 50 08 48 8b 00 <48> 89 51 08 48 89 01 41 80 bd d7 00 00 00 00 75 82 48 8b 19 49 8b [ 5511.227091] RSP: 0018:ffffc90000003dd0 EFLAGS: 00010246 [ 5511.233135] RAX: 0000000000000000 RBX: ffff88810c8da600 RCX: 0000000000000000 [ 5511.241384] RDX: 000000000000003c RSI: 0000000000000001 RDI: ffff888115f555c0 [ 5511.249634] RBP: ffffc90000003e08 R08: 0000000000000000 R09: ffff889092296b48 [ 5511.257886] R10: 0000ffffffffffff R11: ffff889092296800 R12: 0000000000000000 [ 5511.266138] R13: ffff88810c8db500 R14: 0000000000000040 R15: 0000000000000100 [ 5511.274387] FS: 0000000000000000(0000) GS:ffff88903f800000(0000) knlGS:0000000000000000 [ 5511.283746] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 5511.290389] CR2: 0000000000000008 CR3: 00000001046e2001 CR4: 00000000003706f0 [ 5511.298640] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 5511.306892] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 5511.315142] Call Trace: [ 5511.317972] <IRQ> [ 5511.320301] ice_xmit_zc+0x68/0x2f0 [ice] [ 5511.324977] ? ktime_get+0x38/0xa0 [ 5511.328913] ice_napi_poll+0x7a/0x6a0 [ice] [ 5511.333784] __napi_poll+0x2c/0x160 [ 5511.337821] net_rx_action+0xdd/0x200 [ 5511.342058] __do_softirq+0xe6/0x2dd [ 5511.346198] irq_exit_rcu+0xb5/0x100 [ 5511.350339] common_interrupt+0xa4/0xc0 [ 5511.354777] </IRQ> [ 5511.357201] <TASK> [ 5511.359625] asm_common_interrupt+0x1e/0x40 [ 5511.364466] RIP: 0010:cpuidle_enter_state+0xd2/0x360 [ 5511.370211] Code: 49 89 c5 0f 1f 44 00 00 31 ff e8 e9 00 7b ff 45 84 ff 74 12 9c 58 f6 c4 02 0f 85 72 02 00 00 31 ff e8 02 0c 80 ff fb 45 85 f6 <0f> 88 11 01 00 00 49 63 c6 4c 2b 2c 24 48 8d 14 40 48 8d 14 90 49 [ 5511.391921] RSP: 0018:ffffffff82a03e60 EFLAGS: 00000202 [ 5511.397962] RAX: ffff88903f800000 RBX: 0000000000000001 RCX: 000000000000001f [ 5511.406214] RDX: 0000000000000000 RSI: ffffffff823400b9 RDI: ffffffff8234c046 [ 5511.424646] RBP: ffff88810a384800 R08: 000005032a28c046 R09: 0000000000000008 [ 5511.443233] R10: 000000000000000b R11: 0000000000000006 R12: ffffffff82bcf700 [ 5511.461922] R13: 000005032a28c046 R14: 0000000000000001 R15: 0000000000000000 [ 5511.480300] cpuidle_enter+0x29/0x40 [ 5511.494329] do_idle+0x1c7/0x250 [ 5511.507610] cpu_startup_entry+0x19/0x20 [ 5511.521394] start_kernel+0x649/0x66e [ 5511.534626] secondary_startup_64_no_verify+0xc3/0xcb [ 5511.549230] </TASK> Detect such case during bind() and allocate this memory region via newly introduced xp_alloc_tx_descs(). Also, use kvcalloc instead of kcalloc as for other buffer pool allocations, so that it matches the kvfree() from xp_destroy(). Fixes: d1bc532e99 ("i40e: xsk: Move tmp desc array from driver to pool") Signed-off-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Acked-by: Magnus Karlsson <magnus.karlsson@intel.com> Link: https://lore.kernel.org/bpf/20220425153745.481322-1-maciej.fijalkowski@intel.com		2022-04-26 16:19:54 +02:00
..
9p	net/p9: load default transports	2022-01-10 10:00:09 +09:00
bluetooth	Networking changes for 5.18.	2022-03-24 13:13:26 -07:00
caif	net: remove the caif_hsi driver	2021-07-01 13:19:48 -07:00
iucv	net/af_iucv: Use struct_group() to zero struct iucv_sock region	2021-11-19 11:52:25 +00:00
netfilter	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2022-03-23 10:53:49 -07:00
netns	Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/	2022-03-19 14:49:08 +00:00
nfc	NFC: add NCI_UNREG flag to eliminate the race	2021-11-17 20:17:05 -08:00
phonet
sctp	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2022-01-05 14:36:10 -08:00
tc_act	net/sched: fix incorrect vlan_push_eth dest field	2022-03-23 10:32:48 -07:00
6lowpan.h
act_api.h	flow_offload: validate flags of filter and actions	2021-12-19 14:08:48 +00:00
addrconf.h	net: Add new protocol attribute to IP addresses	2022-02-18 21:20:06 -08:00
af_ieee802154.h
af_rxrpc.h	afs: Don't truncate iter during data fetch	2021-04-23 10:17:26 +01:00
af_unix.h	af_unix: Replace the big lock with small locks.	2021-11-26 18:01:58 -08:00
af_vsock.h	vsock: each transport cycles only on its own sockets	2022-03-11 23:14:19 -08:00
ah.h
amt.h	amt: add mld report message handler	2021-11-01 13:36:09 +00:00
arp.h	ipv4: Invalidate neighbour for broadcast address upon address addition	2022-02-21 11:44:30 +00:00
atmclip.h
ax25.h	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2022-02-03 17:36:16 -08:00
ax88796.h	ax88796: export ax_NS8390_init() hook	2021-08-03 13:05:25 +01:00
bareudp.h	bareudp: Move definition of struct bareudp_conf to bareudp.c	2021-12-13 12:34:09 +00:00
bond_3ad.h	bonding: fix data-races around agg_select_timer	2022-02-15 14:35:18 +00:00
bond_alb.h	bonding: make tx_rebalance_counter an atomic	2021-12-03 14:16:48 +00:00
bond_options.h	bonding: add new option ns_ip6_target	2022-02-21 12:13:45 +00:00
bonding.h	net: add per-cpu storage and net->core_stats	2022-03-11 23:17:24 -08:00
bpf_sk_storage.h
busy_poll.h	tcp: fix another uninit-value (sk_rx_queue_mapping)	2021-12-03 14:15:49 +00:00
calipso.h
cfg80211-wext.h
cfg80211.h	cfg80211: Support configuration of station EHT capabilities	2022-02-16 15:43:25 +01:00
cfg802154.h	net: ieee802154: Provide a kdoc to the address structure	2022-02-01 21:03:48 +01:00
checksum.h	powerpc/net: Implement powerpc specific csum_shift() to remove branch	2022-03-11 10:57:22 +00:00
cipso_ipv4.h
cls_cgroup.h
codel_impl.h	codel: remove unnecessary sock.h include	2021-12-22 15:03:47 -08:00
codel_qdisc.h	codel: remove unnecessary pkt_sched.h include	2021-12-22 15:03:51 -08:00
codel.h	codel: remove unnecessary pkt_sched.h include	2021-12-22 15:03:51 -08:00
compat.h	net/ipv4/ipv6: Replace one-element arraya with flexible-array members	2021-08-05 11:46:42 +01:00
datalink.h	llc/snap: constify dev_addr passing	2021-10-13 09:40:46 -07:00
dcbevent.h
dcbnl.h
devlink.h	devlink: add explicitly locked flavor of the rate node APIs	2022-03-21 14:11:38 +00:00
dn_dev.h
dn_fib.h	net: convert fib_treeref from int to refcount_t	2021-07-30 15:33:24 +02:00
dn_neigh.h
dn_nsp.h
dn_route.h
dn.h	decnet: constify dev_addr passing	2021-10-13 09:40:46 -07:00
dsa.h	net: dsa: pass extack to dsa_switch_ops :: port_mirror_add()	2022-03-17 17:42:47 -07:00
dsfield.h
dst_cache.h	wireguard: device: reset peer src endpoint when netns exits	2021-11-29 19:50:45 -08:00
dst_metadata.h	net: fix a memleak when uncloning an skb dst and its metadata	2022-02-09 11:41:47 +00:00
dst_ops.h
dst.h	net: dst: add net device refcount tracking to dst_entry	2021-12-06 16:05:10 -08:00
erspan.h
esp.h	esp: Fix possible buffer overflow in ESP transformation	2022-03-07 13:14:03 +01:00
espintcp.h
ethoc.h
failover.h	net: failover: add net device refcount tracker	2021-12-06 16:06:02 -08:00
fib_notifier.h
fib_rules.h	fib: expand fib_rule_policy	2021-12-16 07:18:35 -08:00
firewire.h
flow_dissector.h	cls_flower: Fix inability to match GRE/IPIP packets	2021-10-29 14:03:22 +01:00
flow_offload.h	net/sched: add vlan push_eth and pop_eth action to the hardware IR	2022-03-16 19:59:36 -07:00
flow.h	net: Add l3mdev index to flow struct and avoid oif reset for port devices	2022-03-15 20:20:02 -07:00
fou.h
fq_impl.h
fq.h
garp.h
gen_stats.h	net: sched: Remove Qdisc::running sequence counter	2021-10-18 12:54:41 +01:00
genetlink.h
geneve.h
gre.h
gro_cells.h
gro.h	net: gro: Fix a 'directive in macro's argument list' sparse warning	2022-02-18 11:00:25 +00:00
gtp.h	gtp: Add support for checking GTP device type	2022-03-11 08:28:27 -08:00
gue.h
hwbm.h
icmp.h	ipv6: ICMPV6: add response to ICMPV6 RFC 8335 PROBE messages	2021-06-28 14:29:45 -07:00
ieee80211_radiotap.h	ieee80211: radiotap: fix -Wcast-qual warnings	2022-02-04 16:25:21 +01:00
ieee802154_netdev.h
if_inet6.h	net: Add new protocol attribute to IP addresses	2022-02-18 21:20:06 -08:00
ife.h
ila.h
inet6_connection_sock.h
inet6_hashtables.h
inet_common.h
inet_connection_sock.h	tcp: Use BPF timeout setting for SYN ACK RTO	2022-02-02 14:45:18 +00:00
inet_dscp.h	ipv6: Define dscp_t and stop taking ECN bits into account in fib6-rules	2022-02-07 20:12:45 -08:00
inet_ecn.h	net: add skb_get_dsfield() helper	2021-10-15 11:33:08 +01:00
inet_frag.h	net: ip: Handle delivery_time in ip defrag	2022-03-03 14:38:48 +00:00
inet_hashtables.h	tcp: seq_file: Replace listening_hash with lhash2	2021-07-23 16:44:57 -07:00
inet_sock.h	ipv4/raw: support binding to nonlocal addresses	2021-11-17 20:21:52 -08:00
inet_timewait_sock.h	tcp/dccp: get rid of inet_twsk_purge()	2022-01-25 11:25:21 +00:00
inetpeer.h
ioam6.h	treewide: Replace zero-length arrays with flexible-array members	2022-02-17 07:00:39 -06:00
ip6_checksum.h	net: move gro definitions to include/net/gro.h	2021-11-16 13:16:54 +00:00
ip6_fib.h	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2022-02-17 11:44:20 -08:00
ip6_route.h	ipv6: ip6_skb_dst_mtu() cleanups	2021-11-19 20:09:55 -08:00
ip6_tunnel.h	ipv6: add net device refcount tracker to struct ip6_tnl	2021-12-06 16:05:11 -08:00
ip_fib.h	ipv4: Reject routes specifying ECN bits in rtm_tos	2022-02-07 20:12:46 -08:00
ip_tunnels.h	sit: add net device refcount tracking to ip_tunnel	2021-12-06 16:05:11 -08:00
ip_vs.h	ipvs: add sysctl_run_estimation to support disable estimation	2021-10-07 19:52:58 +02:00
ip.h	ipv4: Make ip_idents_reserve static	2022-01-31 11:33:10 +00:00
ipcomp.h
ipconfig.h
ipv6_frag.h	net: don't include ndisc.h from ipv6.h	2022-02-04 14:15:11 -08:00
ipv6_stubs.h	net: ipv6: add fib6_nh_release_dsts stub	2021-11-22 15:44:49 +00:00
ipv6.h	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2022-02-17 11:44:20 -08:00
iw_handler.h
kcm.h
l3mdev.h
lag.h
lapb.h
lib80211.h
llc_c_ac.h
llc_c_ev.h
llc_c_st.h
llc_conn.h	llc: add net device refcount tracker	2021-12-07 20:44:59 -08:00
llc_if.h	llc/snap: constify dev_addr passing	2021-10-13 09:40:46 -07:00
llc_pdu.h	net: llc: fix skb_over_panic	2021-07-27 13:05:56 +01:00
llc_s_ac.h
llc_s_ev.h
llc_s_st.h
llc_sap.h
llc.h	llc: fix out-of-bound array index in llc_sk_dev_hash()	2021-11-07 19:25:29 +00:00
lwtunnel.h	netfilter: add netfilter hooks to SRv6 data plane	2021-08-30 01:51:36 +02:00
mac80211.h	mac80211: MBSSID beacon handling in AP mode	2022-03-15 11:36:26 +01:00
mac802154.h	net: mac802154: Explain the use of ieee802154_wake/stop_queue()	2022-01-28 11:23:41 +01:00
macsec.h	net: macsec: fix the length used to copy the key for offloading	2021-06-24 12:41:12 -07:00
mctp.h	mctp: Use output netdev to allocate skb headroom	2022-04-01 12:04:15 +01:00
mctpdevice.h	mctp: Pass flow data & flow release events to drivers	2021-10-29 13:23:51 +01:00
mip6.h
mld.h	mld: add new workqueues for process mld events	2021-03-26 15:14:56 -07:00
mpls_iptunnel.h
mpls.h
mptcp.h	mptcp: mptcp_parse_option is no longer exported	2022-02-16 20:52:04 -08:00
mrp.h
ncsi.h
ndisc.h	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2022-03-03 11:55:12 -08:00
neighbour.h	net, neigh: Do not trigger immediate probes on NUD_FAILED from neigh_managed_work	2022-02-02 20:30:18 -08:00
net_failover.h
net_namespace.h	net: make net->dev_unreg_count atomic	2022-02-10 15:30:26 +00:00
net_ratelimit.h
net_trackers.h	net: add networking namespace refcount tracker	2021-12-10 06:38:26 -08:00
netevent.h
netlabel.h
netlink.h	net: netlink: add the case when nlh is NULL	2021-07-27 11:43:50 +01:00
netprio_cgroup.h
netrom.h
nexthop.h	net: ipv4: Fix rtnexthop len when RTA_FLOW is present	2021-09-24 14:07:10 +01:00
nl802154.h	net: ieee802154: handle iftypes as u32	2021-11-16 18:02:46 +01:00
nsh.h
p8022.h
page_pool.h	page_pool: Add function to batch and return stats	2022-03-03 09:55:28 +00:00
pie.h
ping.h
pkt_cls.h	net/sched: Enable tc skb ext allocation on chain miss only when needed	2022-02-05 10:12:53 +00:00
pkt_sched.h	net: sched: remove psched_tdiff_bounded()	2022-01-27 13:53:27 +00:00
pptp.h
protocol.h	net: Remove the member netns_ok	2021-05-17 15:29:35 -07:00
psample.h	psample: Add a fwd declaration for skbuff	2021-08-09 15:34:21 -07:00
psnap.h
raw.h
rawv6.h
red.h
regulatory.h
request_sock.h	tcp: Use BPF timeout setting for SYN ACK RTO	2022-02-02 14:45:18 +00:00
rose.h	rose: constify dev_addr passing	2021-10-13 09:40:45 -07:00
route.h	ipv4: remove sparse error in ip_neigh_gw4()	2022-01-27 08:38:33 -08:00
rpl.h
rsi_91x.h
rtnetlink.h	net: add extack arg for link ops	2021-08-04 10:01:26 +01:00
rtnh.h
sch_generic.h	net: sched: remove qdisc_qlen_cpu()	2022-01-27 13:53:27 +00:00
scm.h
secure_seq.h
seg6_hmac.h
seg6_local.h
seg6.h	udp6: Use Segment Routing Header for dest address if present	2022-01-04 12:17:35 +00:00
selftests.h	net: selftest: fix build issue if INET is disabled	2021-04-28 14:06:45 -07:00
slhc_vj.h
smc.h
snmp.h
sock_reuseport.h	tcp: Add reuseport_migrate_sock() to select a new listener.	2021-06-15 18:01:05 +02:00
sock.h	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2022-02-24 17:54:25 -08:00
Space.h	wan: remove sbni/granch driver	2021-08-03 13:05:26 +01:00
stp.h
strparser.h	bpf, sockmap: sk_skb data_end access incorrect when src_reg = dst_reg	2021-11-09 01:05:34 +01:00
switchdev.h	net: bridge: mst: Notify switchdev drivers of MST state changes	2022-03-17 16:49:58 -07:00
tcp_states.h
tcp.h	net: tcp: fix shim definition of tcp_inbound_md5_hash	2022-03-09 08:44:40 -08:00
timewait_sock.h
tipc.h
tls_toe.h
tls.h	net/tls: Provide {__,}tls_driver_ctx() unconditionally	2022-03-09 20:01:14 -08:00
transp_v6.h
tso.h
tun_proto.h
udp_tunnel.h
udp.h	net: move gro definitions to include/net/gro.h	2021-11-16 13:16:54 +00:00
udplite.h	udplite: remove udplite_csum_outgoing()	2022-01-27 13:53:27 +00:00
vsock_addr.h
vxlan.h	drivers: vxlan: vnifilter: per vni stats	2022-03-01 08:38:02 +00:00
wext.h
x25.h
x25device.h
xdp_priv.h	xsk: Wipe out dead zero_copy_allocator declarations	2021-12-14 00:24:24 +01:00
xdp_sock_drv.h	i40e: xsk: Move tmp desc array from driver to pool	2022-01-27 17:25:32 +01:00
xdp_sock.h	net: Don't include filter.h from net/sock.h	2021-12-29 08:48:14 -08:00
xdp.h	net: veth: Account total xdp_frame len running ndo_xdp_xmit	2022-03-17 20:33:52 +01:00
xfrm.h	Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/	2022-03-19 14:49:08 +00:00
xsk_buff_pool.h	xsk: Fix possible crash when multiple sockets are created	2022-04-26 16:19:54 +02:00