From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-yx1-f44.google.com (mail-yx1-f44.google.com [74.125.224.44]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1315D35C6BA for ; Sat, 25 Jul 2026 03:42:49 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.224.44 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784950972; cv=none; b=ZInBtO35gd+tBfOhErcWdhVNzYwLU/Z4leOCDdhrwKlRLF3QVH1hBModhhtJuyho0P6Nz69IMXhw+bRoMjQTEDC599N59xzjDt3H8bWXA6o1vhw5X4q5Xf3VfbCHhLjIwZ2R1eU70LVjk3G+cImHWZs67C1gPSABKnismQzTEjM= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784950972; c=relaxed/simple; bh=qdCRc3nJ771x3VQVRjLBimIKuM3JuBDSq8fvXhd8+lg=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=juNt0PC+JIF6XEKkQ4T4MmT7SFtup2MJfvgvGlfLW+VQozOFfIUq0Y4kSRIv1m6C/Hfzhd4NygFz2NHoiZ6cZ9ut1KzqRNWyoubDs4Wre8dAShR1L0qHMtwUZutvCzKlh2MOKvl5lZuzaf4jdG1wa/0RgVYio8oGzxhTqxcnQbg= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=MggFcivc; arc=none smtp.client-ip=74.125.224.44 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="MggFcivc" Received: by mail-yx1-f44.google.com with SMTP id 956f58d0204a3-667b0ced2d3so1062850d50.2 for ; Fri, 24 Jul 2026 20:42:49 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1784950969; x=1785555769; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=1D+KDOADjt6pawjgxVvSFGUpDqaxbR+onKq6lqxxAIs=; b=MggFcivcs7UIMn2oCbsyBCnkC/3LvLjriyxTo/aSy3epy75U+FKbEN7YxJ4TpxymSm G0enEL6dOAB6VHX4Jytt+OnlKnACYWERlZArBNRlms3EpIxw/XryRl+/24xlxWPYLjmN Mn4wQ3c83hvNu2deF0PhQ0MCcYBe+Mp3+8ypJ4YY2GEqj4n6XjbGQhHITgwf9Ybbdq9J xotbWH1ctVpJdDYnpK1baCOC4jVf9fzyCdhp9BpJGJCuaS7wHDPjwt+z+6mztzTQBSBS +fxHLZOe4MKHH3PaUB3ZZV6NRyyJGwG4RoqXXVI4j7Q+KuKrFtNUtfaBmq7hlVGHrBfA CF4A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784950969; x=1785555769; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=1D+KDOADjt6pawjgxVvSFGUpDqaxbR+onKq6lqxxAIs=; b=LqgLzKJy7hnYcIAoAZRO8KXd534w8NeH96YrlyqoETKrbXZ+Mo/dsxVRtC7yl64xlc aSrDZrOVEvxfLxV+LPtm80oIyBBzg8Ugj+Z/QbOLj0aUNBTdPg3lfL631XK4UrUJf2oa cTKbDLDF/anzH5Ahy+2ouZ8aLB3TckmrKXs6S5JIR0oGYLRJ3zk1QPnn2myXh1wvN8wP Pblfb2IjWVGy6LZnpi5gO7Tq6kUanbC0QC5Mfnce36uXFxN5q0SMSIuhj63pKVNv9V51 TySIqausJuFkzUrHE8K/MaDdoj2DAquPdxNdARb1HR8r2JJ0crSCOpwFRcanUlGMPBHV McjQ== X-Forwarded-Encrypted: i=1; AHgh+RqmuqXcuEtQgweocpKadqBx04b75DSjnoxfsgZiy8HJPAvxoQ7t2G+5MtpkUg7/7xxviDxpNMl189qiB5M=@vger.kernel.org X-Gm-Message-State: AOJu0Yz4iaWi5HuXOpHJO8XzRkijU+U/LfCBK5Mi/8GmBTac8tEzph88 KeDS6WK2Y7Ba0bSz9eALtHsC7L2WFxsb+81KcXCFGnLnEaFZtiwpXZvW X-Gm-Gg: AR+sD11fadkl04eR/xEOH8F0QyG0ky/ZxTBBj4+lStKBI1s0TVGc44BuI1zL+fxGD+B yg9ioTCD/Idp8h0NHVzTCjNKLZ19P37m/GvNYZ5cmuL4wBdP5uf0SWdDsTwdL3LgNNeg5Hw5t/l R5SSpAvMyLghEgMJDztrJ18E9R0Ah1+7LElXD8oaRzG03rNny4z2tP+bD6lNkGzg/wgWKkdy6cV 5KDme4zMvjM6EtnjYoyUBk5wKQ81azJQLxRxnGhj9cROTvw0irTbXA9PrJzOSFdOY16fQvndw0+ Z9TzdezLriLnhXKCOPAs+4AP5hQ16vqTbp3LH9smImd+aQ4JMF50iwQDB4uYMUgxY/0go0Jw9zM /pzxcB+OQSXVKZrXj6LX0+Woubrlww0jodXgD8eHn8QIOeP1ZDVH4yPy+Yh+AvbkOvB/4etvIX2 P0PH7Tr9JDrlc/Goo99m9R4NIKz2Qt9IHOC5pif9EBhIAy9AaD/hzpXKR8uzVkOAoB3nnLkzgvO JR+EY/EP8VMiQ== X-Received: by 2002:a53:ca8c:0:b0:667:9481:5b37 with SMTP id 956f58d0204a3-668c7a3c507mr214817d50.2.1784950968851; Fri, 24 Jul 2026 20:42:48 -0700 (PDT) Received: from LAPTOP-83ECOPAB.f7a5e5c3-cab1-4810-bdbb-207cdd06de9e.globalsecureaccess.local ([136.55.173.105]) by smtp.gmail.com with ESMTPSA id 00721157ae682-81f65770059sm8525917b3.7.2026.07.24.20.42.48 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 24 Jul 2026 20:42:48 -0700 (PDT) From: "Cen Zhang (Microsoft)" To: magnus.karlsson@intel.com, maciej.fijalkowski@intel.com, sdf@fomichev.me, davem@davemloft.net, edumazet@google.com, kuba@kernel.org, pabeni@redhat.com, horms@kernel.org Cc: netdev@vger.kernel.org, bpf@vger.kernel.org, linux-kernel@vger.kernel.org, AutonomousCodeSecurity@microsoft.com, tgopinath@linux.microsoft.com, kys@microsoft.com, blbllhy@gmail.com Subject: [PATCH net v2] xsk: fix NULL pointer dereference in __xsk_rcv() Date: Fri, 24 Jul 2026 23:42:46 -0400 Message-ID: <20260725034246.192091-1-blbllhy@gmail.com> X-Mailer: git-send-email 2.53.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit In the __xsk_rcv() multi-buffer path, xsk_buff_alloc() is called in a loop without checking its return value. xsk_buff_can_alloc() only counts fill queue entries without validating their addresses, so it can succeed while xsk_buff_alloc() rejects all remaining entries and returns NULL. Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000 KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] RIP: 0010:__xsk_rcv+0x426/0xc20 (net/xdp/xsk.c:350) Call Trace: xsk_generic_rcv+0x26d/0x5f0 xdp_do_generic_redirect+0x3c5/0xcf0 do_xdp_generic+0x92f/0xe70 __netif_receive_skb_core.constprop.0+0xf7e/0x2b30 Fix this with a two-stage transaction. First allocate and stage all buffers required for the packet, recycling all staged buffers with xsk_buff_free() if any allocation fails. Only after this stage succeeds, copy the data, reserve the RX descriptors, and release the buffers in an error-free loop. Fixes: 804627751b42 ("xsk: add support for AF_XDP multi-buffer on Rx path") Reported-by: AutonomousCodeSecurity@microsoft.com Signed-off-by: Cen Zhang (Microsoft) --- v2: - Allocate all packet buffers before reserving RX descriptors. - Recycle partially allocated buffers instead of only cancelling the RX producer reservations. Link: https://lore.kernel.org/netdev/20260724164719.99563-1-blbllhy@gmail.com net/xdp/xsk.c | 29 ++++++++++++++++++++++++++--- 1 file changed, 26 insertions(+), 3 deletions(-) diff --git a/net/xdp/xsk.c b/net/xdp/xsk.c index f906d51b6699..383fc2b1de48 100644 --- a/net/xdp/xsk.c +++ b/net/xdp/xsk.c @@ -298,9 +298,11 @@ static int __xsk_rcv(struct xdp_sock *xs, struct xdp_buff *xdp, u32 len) u32 frame_size = __xsk_pool_get_rx_frame_size(xs->pool); void *copy_from = xsk_copy_xdp_start(xdp), *copy_to; u32 from_len, meta_len, rem, num_desc; - struct xdp_buff_xsk *xskb; + struct xdp_buff_xsk *xskb, *tmp; struct xdp_buff *xsk_xdp; + LIST_HEAD(xsk_buffs); skb_frag_t *frag; + u32 i; from_len = xdp->data_end - copy_from; meta_len = xdp->data - copy_from; @@ -343,23 +345,44 @@ static int __xsk_rcv(struct xdp_sock *xs, struct xdp_buff *xdp, u32 len) frag = &sinfo->frags[0]; } + for (i = 0; i < num_desc; i++) { + xsk_xdp = xsk_buff_alloc(xs->pool); + if (!xsk_xdp) + goto err_alloc; + + xskb = container_of(xsk_xdp, struct xdp_buff_xsk, xdp); + if (unlikely(!list_empty(&xskb->list_node))) + goto err_alloc; + list_add_tail(&xskb->list_node, &xsk_buffs); + } + do { u32 to_len = frame_size + meta_len; u32 copied; - xsk_xdp = xsk_buff_alloc(xs->pool); + xskb = list_first_entry(&xsk_buffs, struct xdp_buff_xsk, + list_node); + list_del_init(&xskb->list_node); + xsk_xdp = &xskb->xdp; copy_to = xsk_xdp->data - meta_len; copied = xsk_copy_xdp(copy_to, ©_from, to_len, &from_len, &frag, rem); rem -= copied; - xskb = container_of(xsk_xdp, struct xdp_buff_xsk, xdp); __xsk_rcv_zc_safe(xs, xskb, copied - meta_len, rem ? XDP_PKT_CONTD : 0); meta_len = 0; } while (rem); return 0; + +err_alloc: + list_for_each_entry_safe(xskb, tmp, &xsk_buffs, list_node) { + list_del_init(&xskb->list_node); + xsk_buff_free(&xskb->xdp); + } + xs->rx_dropped++; + return -ENOMEM; } static bool xsk_tx_writeable(struct xdp_sock *xs) -- 2.53.0