From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-yx1-f50.google.com (mail-yx1-f50.google.com [74.125.224.50]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C10D243B6C5 for ; Thu, 13 Aug 2026 21:53:32 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.224.50 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786658014; cv=none; b=VTFMzvbVdiGlnxJI/o/iLBkLds6B5SvXtw6b9ddrBkWXQVyxcEJaiazfBA6g44MYHmRjV7TJSQORY5mJFlCXZgzIki4vbCVmWl4166AR7Nj2Y9vErEIGvTn8ZcutP9fcQnMvJohgQIh39G+xvPpoVph6o3EqzLiLQUWwExtxrxo= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786658014; c=relaxed/simple; bh=fYLwZrvNlQxGwlPI0UQmca6Rp4m8wQ6Bkf8LJPqH324=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=FeY6jNn8cASpX1I7nEsi6DZ/EvJzMHs82WFa4X/QSBNtZa5mFjhB8pWMu9QYf0A7vNTHJ7cRAWGnXxWPxYIAYQN0gEZAc4gYsLYqPEDmp8Y9cznPtU9x96i2/FU2UXPTb/aJ09jYt6Miy0zgvKITYoi2VE251qD0nXepOvy9zGk= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=bcK4nnLA; arc=none smtp.client-ip=74.125.224.50 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="bcK4nnLA" Received: by mail-yx1-f50.google.com with SMTP id 956f58d0204a3-669944f60b3so505965d50.1 for ; Thu, 13 Aug 2026 14:53:32 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1786658012; x=1787262812; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=cPTXEYegZPPH2jkQqlfi+zU8F5mdAL4ScUHPzIFB1i4=; b=bcK4nnLAToE/MFDRAU3Es48wA9EbUq8MoE31OpsRD6WD4haSk6YZNJ04e4BvjJ6guB A+IxM8uHAO9GjGBCyL+b44lIHiNLGzk42teqJnD1LO9xGg811yX3zfIKBFjRBn2nUZWP OgMdSJcSYarFZOCjM8RUtTUjmZvrPlWqbN/zxUij7TUudCXYvZCTL8jCxRBb2sKwnvsI bvz61FJUhJa1cttS3gwQ84a1c+BWJf+5xV8CO0EnbHGqVeBGwxQguh2PbvHsgzL181W6 5dPAkzpkAiH07W/pXyLJxdxuU+Lqq2fBbelsuIiv6vkavL9uSgS1A12MoeIvylOaXnD6 5XSA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786658012; x=1787262812; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=cPTXEYegZPPH2jkQqlfi+zU8F5mdAL4ScUHPzIFB1i4=; b=G21LPOKNY19nDTzXniqZHCckV6GbcEQP9RjRrnJo5qgxM2jyDI+5Fg6rWd6QE1hYf0 6eoghhRa/yD3Wz1efYDDEjwDo36ncOnEZpvg9WiBhBLT9h5lav87JZM/jomQVyOFHXvT IViX3QAl4mMdIXf2F6O6DzqJEvcdz3M8sp72rqY06ZH40NXIG7gv6kUclVIDWWLZuUSz 3WXdAbcz2OmT55Z2VWKmqQdS7VwA3buju1NDa/FmHe/sRBM9CTAfL8SD/CC85cBYHFjK CEuoECFs5AJLoK7D+WpS8r/zAPAty8m7aSmO7cgcA+MK7d49yd+gltl/9Q0HW0MovmpS BVWQ== X-Forwarded-Encrypted: i=1; AHgh+RqFUoBOavoINQ8U1O3D48L2FBiiHFIXjgLNDBDzpfX8nAW0hMJcAPmCUH86UzJlMbrZW01sYVXI6+2K8/k=@vger.kernel.org X-Gm-Message-State: AOJu0YyAFwfQviuWyhkfVp7Q8TB5GKMqBjLnQh9T1zdA8cmUhUiMhbGc uMd7EzZr7AaGSeYcf+NImRepkmIj+rvA7CDGb+IRALZ5+pQ9y3Gl+Mfc X-Gm-Gg: AR+sD13axsbD3LYA+qwgxepZW1FKfHATr1BZ8P/mgT96TlB9AbuhXe/0g0AVdBPLLJv xAAPKE/IH2nBXQmGTEodrXLsGz8atm6B8kL41c14nf4EYR70IQcRQXuTymPlGn1wjwILRpiIlqH uXwSkBXJcLlMkLbaFiEqOICyOD1la2bHtxEziMymRwXN8v07ygdC7Qqr0So0tQWBPDKGXWj20YT 9O9eIfVzhHGuyZ358lHhBP50Wo3SGoQzgJHNwpOQTMaKW9FTuLWM6IQZNTKH7P+sriXaO9xvJ+6 hWZpK3TpdHNbJNIyrzmCgkuTj6Ohmfmlk0lshtNbrFS9Kv598CxS0SO3b/Kj8C1rm8CsZUETwgM m2KvZ4vpnjk7iCroPxlVJ/yb7Bun7vS+Q7g7/2tdYy8ILbSNVW/cjiDBvlGZRLsv7QMgDslY7NT 9AHRS5o1GWAfnMLWgTO+3boqBxgIH3MODECUK0CW809ZRa+tKcIU2JpYkFt4frn+U3+sUC X-Received: by 2002:a05:690e:1c08:b0:664:dbd0:23b7 with SMTP id 956f58d0204a3-66c72b1cdedmr612953d50.9.1786658011698; Thu, 13 Aug 2026 14:53:31 -0700 (PDT) Received: from mac.lan ([136.55.173.105]) by smtp.gmail.com with ESMTPSA id 956f58d0204a3-66c573c46d3sm1458852d50.10.2026.08.13.14.53.30 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 13 Aug 2026 14:53:31 -0700 (PDT) From: "Cen Zhang (Microsoft)" To: magnus.karlsson@intel.com, kerneljasonxing@gmail.com, maciej.fijalkowski@intel.com, sdf@fomichev.me, davem@davemloft.net, edumazet@google.com, kuba@kernel.org, pabeni@redhat.com, horms@kernel.org Cc: netdev@vger.kernel.org, bpf@vger.kernel.org, linux-kernel@vger.kernel.org, AutonomousCodeSecurity@microsoft.com, tgopinath@linux.microsoft.com, kys@microsoft.com, blbllhy@gmail.com Subject: [PATCH net v4] xsk: fix NULL pointer dereference in __xsk_rcv() Date: Thu, 13 Aug 2026 17:53:28 -0400 Message-ID: <20260813215328.99311-1-blbllhy@gmail.com> X-Mailer: git-send-email 2.52.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit In the __xsk_rcv() multi-buffer path, xsk_buff_alloc() is called in a loop without checking its return value. xsk_buff_can_alloc() only counts fill queue entries without validating their addresses, so it can succeed while xsk_buff_alloc() rejects all remaining entries and returns NULL. Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000 KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] RIP: 0010:__xsk_rcv+0x426/0xc20 (net/xdp/xsk.c:350) Call Trace: xsk_generic_rcv+0x26d/0x5f0 xdp_do_generic_redirect+0x3c5/0xcf0 do_xdp_generic+0x92f/0xe70 __netif_receive_skb_core.constprop.0+0xf7e/0x2b30 Fix this with a two-stage transaction. First allocate and stage all buffers required for the packet, recycling all staged buffers with xsk_buff_free() if any allocation fails. Only after this stage succeeds, copy the data, reserve the RX descriptors, and release the buffers in an error-free loop. Fixes: 804627751b42 ("xsk: add support for AF_XDP multi-buffer on Rx path") Reported-by: AutonomousCodeSecurity@microsoft.com Signed-off-by: Cen Zhang (Microsoft) --- net/xdp/xsk.c | 30 +++++++++++++++++++++++++++--- 1 file changed, 27 insertions(+), 3 deletions(-) diff --git a/net/xdp/xsk.c b/net/xdp/xsk.c index 7855ee09c4b6..33475b180ea6 100644 --- a/net/xdp/xsk.c +++ b/net/xdp/xsk.c @@ -298,9 +298,11 @@ static int __xsk_rcv(struct xdp_sock *xs, struct xdp_buff *xdp, u32 len) u32 frame_size = __xsk_pool_get_rx_frame_size(xs->pool); void *copy_from = xsk_copy_xdp_start(xdp), *copy_to; u32 from_len, meta_len, rem, num_desc; - struct xdp_buff_xsk *xskb; + struct xdp_buff_xsk *xskb, *tmp; struct xdp_buff *xsk_xdp; + LIST_HEAD(xsk_buffs); skb_frag_t *frag; + u32 i; from_len = xdp->data_end - copy_from; meta_len = xdp->data - copy_from; @@ -343,23 +345,45 @@ static int __xsk_rcv(struct xdp_sock *xs, struct xdp_buff *xdp, u32 len) frag = &sinfo->frags[0]; } + for (i = 0; i < num_desc; i++) { + xsk_xdp = xsk_buff_alloc(xs->pool); + if (!xsk_xdp) + goto err_alloc; + + xskb = container_of(xsk_xdp, struct xdp_buff_xsk, xdp); + if (unlikely(!list_empty(&xskb->list_node))) + goto err_alloc; + + list_add_tail(&xskb->list_node, &xsk_buffs); + } + do { u32 to_len = frame_size + meta_len; u32 copied; - xsk_xdp = xsk_buff_alloc(xs->pool); + xskb = list_first_entry(&xsk_buffs, struct xdp_buff_xsk, + list_node); + list_del_init(&xskb->list_node); + xsk_xdp = &xskb->xdp; copy_to = xsk_xdp->data - meta_len; copied = xsk_copy_xdp(copy_to, ©_from, to_len, &from_len, &frag, rem); rem -= copied; - xskb = container_of(xsk_xdp, struct xdp_buff_xsk, xdp); __xsk_rcv_zc_safe(xs, xskb, copied - meta_len, rem ? XDP_PKT_CONTD : 0); meta_len = 0; } while (rem); return 0; + +err_alloc: + list_for_each_entry_safe(xskb, tmp, &xsk_buffs, list_node) { + list_del_init(&xskb->list_node); + xsk_buff_free(&xskb->xdp); + } + xs->rx_dropped++; + return -ENOMEM; } static bool xsk_tx_writeable(struct xdp_sock *xs) -- 2.52.0