From: Jason Xing <kerneljasonxing@gmail.com>
To: davem@davemloft.net, edumazet@google.com, kuba@kernel.org,
pabeni@redhat.com, bjorn@kernel.org, magnus.karlsson@intel.com,
maciej.fijalkowski@intel.com, jonathan.lemon@gmail.com,
sdf@fomichev.me, ast@kernel.org, daniel@iogearbox.net,
hawk@kernel.org, john.fastabend@gmail.com, horms@kernel.org,
andrew+netdev@lunn.ch
Cc: bpf@vger.kernel.org, netdev@vger.kernel.org,
Jason Xing <kernelxing@tencent.com>
Subject: [PATCH net 0/4] xsk: fix bugs around xsk skb allocation
Date: Sat, 18 Apr 2026 12:56:40 +0800 [thread overview]
Message-ID: <20260418045644.28612-1-kerneljasonxing@gmail.com> (raw)
From: Jason Xing <kernelxing@tencent.com>
There are four extremely rare issues around xsk_build_skb(). Two of them
were founded by Sashiko[1].
[1]: https://lore.kernel.org/all/20260415082654.21026-1-kerneljasonxing@gmail.com/
Jason Xing (4):
xsk: avoid skb leak in XDP_TX_METADATA case
xsk: free the skb when hitting the upper bound MAX_SKB_FRAGS
xsk: handle NULL dereference of the skb without frags issue
xsk: fix use-after-free of xs->skb in xsk_build_skb() free_err path
net/xdp/xsk.c | 22 ++++++++++++++++------
1 file changed, 16 insertions(+), 6 deletions(-)
--
2.41.3
next reply other threads:[~2026-04-18 4:57 UTC|newest]
Thread overview: 18+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-04-18 4:56 Jason Xing [this message]
2026-04-18 4:56 ` [PATCH net 1/4] xsk: avoid skb leak in XDP_TX_METADATA case Jason Xing
2026-04-19 4:58 ` sashiko-bot
2026-04-19 13:05 ` Jason Xing
2026-04-20 15:22 ` Stanislav Fomichev
2026-04-20 15:42 ` Stanislav Fomichev
2026-04-20 16:27 ` Stanislav Fomichev
2026-04-21 0:55 ` Jason Xing
2026-04-18 4:56 ` [PATCH net 2/4] xsk: free the skb when hitting the upper bound MAX_SKB_FRAGS Jason Xing
2026-04-19 4:58 ` sashiko-bot
2026-04-19 14:03 ` Jason Xing
2026-04-20 15:44 ` Stanislav Fomichev
2026-04-18 4:56 ` [PATCH net 3/4] xsk: handle NULL dereference of the skb without frags issue Jason Xing
2026-04-19 4:58 ` sashiko-bot
2026-04-19 14:09 ` Jason Xing
2026-04-18 4:56 ` [PATCH net 4/4] xsk: fix use-after-free of xs->skb in xsk_build_skb() free_err path Jason Xing
2026-04-19 4:58 ` sashiko-bot
2026-04-19 14:23 ` Jason Xing
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260418045644.28612-1-kerneljasonxing@gmail.com \
--to=kerneljasonxing@gmail.com \
--cc=andrew+netdev@lunn.ch \
--cc=ast@kernel.org \
--cc=bjorn@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=hawk@kernel.org \
--cc=horms@kernel.org \
--cc=john.fastabend@gmail.com \
--cc=jonathan.lemon@gmail.com \
--cc=kernelxing@tencent.com \
--cc=kuba@kernel.org \
--cc=maciej.fijalkowski@intel.com \
--cc=magnus.karlsson@intel.com \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=sdf@fomichev.me \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.