OSDN Git Service

net: atlantic: Fix crash when XDP is enabled but no program is loaded
authorToke Høiland-Jørgensen <toke@redhat.com>
Wed, 15 Mar 2023 12:55:38 +0000 (13:55 +0100)
committerJakub Kicinski <kuba@kernel.org>
Fri, 17 Mar 2023 00:31:47 +0000 (17:31 -0700)
commit37d010399f7552add2b68e2b347901c83562dab8
tree9dc9f6f69485bf58a51b562d802484a9608ff1f6
parent43ffe6caccc7a1bb9d7442fbab521efbf6c1378c
net: atlantic: Fix crash when XDP is enabled but no program is loaded

The aq_xdp_run_prog() function falls back to the XDP_ABORTED action
handler (using a goto) if the operations for any of the other actions fail.
The XDP_ABORTED handler in turn calls the bpf_warn_invalid_xdp_action()
tracepoint. However, the function also jumps into the XDP_PASS helper if no
XDP program is loaded on the device, which means the XDP_ABORTED handler
can be run with a NULL program pointer. This results in a NULL pointer
deref because the tracepoint dereferences the 'prog' pointer passed to it.

This situation can happen in multiple ways:
- If a packet arrives between the removal of the program from the interface
  and the static_branch_dec() in aq_xdp_setup()
- If there are multiple devices using the same driver in the system and
  one of them has an XDP program loaded and the other does not.

Fix this by refactoring the aq_xdp_run_prog() function to remove the 'goto
pass' handling if there is no XDP program loaded. Instead, factor out the
skb building in a separate small helper function.

Fixes: 26efaef759a1 ("net: atlantic: Implement xdp data plane")
Reported-by: Freysteinn Alfredsson <Freysteinn.Alfredsson@kau.se>
Tested-by: Freysteinn Alfredsson <Freysteinn.Alfredsson@kau.se>
Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com>
Link: https://lore.kernel.org/r/20230315125539.103319-1-toke@redhat.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
drivers/net/ethernet/aquantia/atlantic/aq_ring.c