linux/net/xdp
Magnus Karlsson 199d983bc0 xsk: Fix crash on double free in buffer pool
Fix a crash in the buffer pool allocator when a buffer is double
freed. It is possible to trigger this behavior not only from a faulty
driver, but also from user space like this: Create a zero-copy AF_XDP
socket. Load an XDP program that will issue XDP_DROP for all
packets. Put the same umem buffer into the fill ring multiple times,
then bind the socket and send some traffic. This will crash the kernel
as the XDP_DROP action triggers one call to xsk_buff_free()/xp_free()
for every packet dropped. Each call will add the corresponding buffer
entry to the free_list and increase the free_list_cnt. Some entries
will have been added multiple times due to the same buffer being
freed. The buffer allocation code will then traverse this broken list
and since the same buffer is in the list multiple times, it will try
to delete the same buffer twice from the list leading to a crash.

The fix for this is just to test that the buffer has not been added
before in xp_free(). If it has been, just return from the function and
do not put it in the free_list a second time.

Note that this bug was not present in the code before the commit
referenced in the Fixes tag. That code used one list entry per
allocated buffer, so multiple frees did not have any side effects. But
the commit below optimized the usage of the pool and only uses a
single entry per buffer in the umem, meaning that multiple
allocations/frees of the same buffer will also only use one entry,
thus leading to the problem.

Fixes: 47e4075df3 ("xsk: Batched buffer allocation for the pool")
Signed-off-by: Magnus Karlsson <magnus.karlsson@intel.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Björn Töpel <bjorn@kernel.org>
Link: https://lore.kernel.org/bpf/20211111075707.21922-1-magnus.karlsson@gmail.com
2021-11-12 15:55:27 +01:00
..
Kconfig treewide: Add SPDX license identifier - Makefile/Kconfig 2019-05-21 10:50:46 +02:00
Makefile xsk: Introduce AF_XDP buffer allocation API 2020-05-21 17:31:26 -07:00
xdp_umem.c xsk: Use kvcalloc to support large umems 2021-05-25 13:11:50 +02:00
xdp_umem.h xsk: Fix umem cleanup bug at socket destruct 2020-11-20 15:52:39 +01:00
xsk_buff_pool.c xsk: Fix crash on double free in buffer pool 2021-11-12 15:55:27 +01:00
xsk_diag.c xsk: Fix possible segfault in xsk umem diagnostics 2020-09-02 16:49:40 +02:00
xsk_queue.c xsk: Remove MEM_TYPE_ZERO_COPY and corresponding code 2020-05-21 17:31:27 -07:00
xsk_queue.h xsk: Batched buffer allocation for the pool 2021-09-28 00:18:34 +02:00
xsk.c xsk: Optimize for aligned case 2021-09-28 00:18:35 +02:00
xsk.h xdp: Add proper __rcu annotations to redirect map entries 2021-06-24 19:41:15 +02:00
xskmap.c xdp: Add proper __rcu annotations to redirect map entries 2021-06-24 19:41:15 +02:00