Skip to content

xsk: fix bugs around xsk skb allocation

Jason Xing bpf netdev sashiko 5 versions – Applied

Status from this message: This series was applied to netdev/net.git (main)

Get series with b4
b4 am [email protected]

Versions newest first · linked by author and title

  1. v5 Latest8 patches 10 repliesApplied 8/8
  2. v48 patches 12 repliesSuperseded
  3. v38 patches 15 repliesSuperseded
Earlier versions · 2
VersionPostedPatchesRepliesStatus
v28 patches18 repliesSuperseded
v14 patches9 repliesSuperseded

Patches in v5 All 8 applied

#Subject and filesSizeRepliesApplied
1/8xsk: reject sw-csum UMEM binding to IFF_TX_SKB_NO_LINEAR devicesnet/xdp/xsk_buff_pool.c+3 -01 replyApplied
2/8xsk: free the skb when hitting the upper bound MAX_SKB_FRAGSnet/xdp/xsk.c+4 -11 replyApplied
3/8xsk: handle NULL dereference of the skb without frags issuenet/xdp/xsk.c+8 -31 replyApplied
4/8xsk: fix use-after-free of xs->skb in xsk_build_skb() free_err pathnet/xdp/xsk.c+1 -11 replyApplied
5/8xsk: prevent CQ desync when freeing half-built skbs in xsk_build_skb()net/xdp/xsk.c+2 -31 replyApplied
6/8xsk: avoid skb leak in XDP_TX_METADATA casenet/xdp/xsk.c+3 -11 replyApplied
7/8xsk: fix xsk_addrs slab leak on multi-buffer error pathnet/xdp/xsk.c+2 -20 repliesApplied
8/8xsk: fix u64 descriptor address truncation on 32-bit architecturesnet/xdp/xsk.c+56 -322 repliesApplied

Reviews trailers per patch

All 8 patches have a Reviewed-by or Acked-by of their own; the series has one for all of them.

PatchStanislav FomichevAlexander Lobakin
SeriesR-b
1/8A-b
2/8A-b
3/8A-b
4/8A-b
5/8A-b
6/8A-b
7/8A-b
8/8A-b

Trailers given in replies are filled; those carried in the patches from earlier versions are outlined with dashes.

Read the v5 thread

Cover letter [PATCH net v5 0/8] xsk: fix bugs around xsk skb allocation

From: Jason Xing <[email protected]>

There are rare issues around xsk_build_skb(). Some of them were founded by Sashiko[1][2].

[1]: https://lore.kernel.org/all/[email protected]/
[2]: https://lore.kernel.org/all/[email protected]/

---
v5

1. reword patch 3
2. adjust the order of patch 6 that is now moved up to be patch 2)
3. use helper in patch (Stan)

v4

1. fix 32-bit arch issue in patch 8 (Alexander && Maciej)
2. add acked-by tags (Stan)

v3

1. use !xs->skb as the indicator of first frag in patch 3 (Stan)
2. move init skb after it's allocated successfully, so patch 4,5,6 have been adjusted accordingly (Stan)
3. do not support 32-bit arch (Stan)
4. add acked-by tags (Stan)

v2

1. add four patches spotted by sashiko to fix buggy pre-existing behavior
2. adjust the order of 8 patches.

Jason Xing (8):
xsk: reject sw-csum UMEM binding to IFF_TX_SKB_NO_LINEAR devices
xsk: free the skb when hitting the upper bound MAX_SKB_FRAGS
xsk: handle NULL dereference of the skb without frags issue
xsk: fix use-after-free of xs->skb in xsk_build_skb() free_err path
xsk: prevent CQ desync when freeing half-built skbs in xsk_build_skb()
xsk: avoid skb leak in XDP_TX_METADATA case
xsk: fix xsk_addrs slab leak on multi-buffer error path
xsk: fix u64 descriptor address truncation on 32-bit architectures

 net/xdp/xsk.c           | 115 ++++++++++++++++++++++++++--------------
 net/xdp/xsk_buff_pool.c |   3 ++
 2 files changed, 77 insertions(+), 41 deletions(-)
Signature · 1 line
2.41.3