Re: [PATCH net v2 2/3] virtio_net: Disable AF_XDP pools on queues above curr_queue_pairs

[sashiko-bot@kernel.org]

> With an XDP program attached, virtnet_xdp_set() adds nr_cpu_ids queue
> pairs for XDP_TX and raises curr_queue_pairs and real_num_rx_queues to
> match. virtnet_xsk_pool_enable() accepts any queue below
> curr_queue_pairs, so an AF_XDP zero-copy socket can be bound to one of
> them.
> 
> When the program is removed, the queue count goes down again while the
> pool stays bound to the driver. When the socket is closed afterwards,
> virtnet_xsk_pool_disable() rejects the queue with -EINVAL, and the core
> frees the pool anyway:
> 
>   WARNING: net/xdp/xsk_buff_pool.c:160 at xp_disable_drv_zc+0x1ee/0x260
>   BUG: KASAN: slab-use-after-free in xp_alloc_batch+0x930/0xb40
>   Read of size 8 at addr ffff8880028eb400 by task ksoftirqd/0/14
>    xp_alloc_batch+0x930/0xb40
>    try_fill_recv+0xb27/0x26e0
> 
> as rq->xsk_pool still points to it and the queue is refilled from it.
> 
> Removing XDP must not fail, so let virtnet_xsk_pool_disable() accept
> any queue the driver has, below max_queue_pairs. The receive and send
> queues above curr_queue_pairs still exist, so they are unbound as usual.
> 
> This was pointed out by the Sashiko review of v1 of this series, and
> reproduced in QEMU by binding a socket to an XDP queue, removing XDP
> and closing the socket.
> 
> Fixes: 09d2b3182c8e ("virtio_net: xsk: bind/unbind xsk for rx")
> Signed-off-by: Haishuang Yan <yanhaishuang@cmss.chinamobile.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261108193845.73621-1-yanhaishuang@cmss.chinamobile.com?part=2