Skip to content
Commit 37d01039 authored by Toke Høiland-Jørgensen's avatar Toke Høiland-Jørgensen Committed by Jakub Kicinski
Browse files

net: atlantic: Fix crash when XDP is enabled but no program is loaded



The aq_xdp_run_prog() function falls back to the XDP_ABORTED action
handler (using a goto) if the operations for any of the other actions fail.
The XDP_ABORTED handler in turn calls the bpf_warn_invalid_xdp_action()
tracepoint. However, the function also jumps into the XDP_PASS helper if no
XDP program is loaded on the device, which means the XDP_ABORTED handler
can be run with a NULL program pointer. This results in a NULL pointer
deref because the tracepoint dereferences the 'prog' pointer passed to it.

This situation can happen in multiple ways:
- If a packet arrives between the removal of the program from the interface
  and the static_branch_dec() in aq_xdp_setup()
- If there are multiple devices using the same driver in the system and
  one of them has an XDP program loaded and the other does not.

Fix this by refactoring the aq_xdp_run_prog() function to remove the 'goto
pass' handling if there is no XDP program loaded. Instead, factor out the
skb building in a separate small helper function.

Fixes: 26efaef7 ("net: atlantic: Implement xdp data plane")
Reported-by: default avatarFreysteinn Alfredsson <Freysteinn.Alfredsson@kau.se>
Tested-by: default avatarFreysteinn Alfredsson <Freysteinn.Alfredsson@kau.se>
Signed-off-by: default avatarToke Høiland-Jørgensen <toke@redhat.com>
Link: https://lore.kernel.org/r/20230315125539.103319-1-toke@redhat.com


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parent 43ffe6ca
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment