915905f8b1
Fixes two typos in xsk_diag_put_umem()
syzbot reported the following crash :
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 7641 Comm: syz-executor946 Not tainted 5.0.0-rc7+ #95
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:xsk_diag_put_umem net/xdp/xsk_diag.c:71 [inline]
RIP: 0010:xsk_diag_fill net/xdp/xsk_diag.c:113 [inline]
RIP: 0010:xsk_diag_dump+0xdcb/0x13a0 net/xdp/xsk_diag.c:143
Code: 8d be c0 04 00 00 48 89 f8 48 c1 e8 03 42 80 3c 20 00 0f 85 39 04 00 00 49 8b 96 c0 04 00 00 48 8d 7a 14 48 89 f8 48 c1 e8 03 <42> 0f b6 0c 20 48 89 f8 83 e0 07 83 c0 03 38 c8 7c 08 84 c9 0f 85
RSP: 0018:ffff888090bcf2d8 EFLAGS: 00010203
RAX: 0000000000000002 RBX: ffff8880a0aacbc0 RCX: ffffffff86ffdc3c
RDX: 0000000000000000 RSI: ffffffff86ffdc70 RDI: 0000000000000014
RBP: ffff888090bcf438 R08: ffff88808e04a700 R09: ffffed1011c74174
R10: ffffed1011c74173 R11: ffff88808e3a0b9f R12: dffffc0000000000
R13: ffff888093a6d818 R14: ffff88808e365240 R15: ffff88808e3a0b40
FS: 00000000011ea880(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020000080 CR3: 000000008fa13000 CR4: 00000000001406e0
Call Trace:
netlink_dump+0x55d/0xfb0 net/netlink/af_netlink.c:2252
__netlink_dump_start+0x5b4/0x7e0 net/netlink/af_netlink.c:2360
netlink_dump_start include/linux/netlink.h:226 [inline]
xsk_diag_handler_dump+0x1b2/0x250 net/xdp/xsk_diag.c:170
__sock_diag_cmd net/core/sock_diag.c:232 [inline]
sock_diag_rcv_msg+0x322/0x410 net/core/sock_diag.c:263
netlink_rcv_skb+0x17a/0x460 net/netlink/af_netlink.c:2485
sock_diag_rcv+0x2b/0x40 net/core/sock_diag.c:274
netlink_unicast_kernel net/netlink/af_netlink.c:1310 [inline]
netlink_unicast+0x536/0x720 net/netlink/af_netlink.c:1336
netlink_sendmsg+0x8ae/0xd70 net/netlink/af_netlink.c:1925
sock_sendmsg_nosec net/socket.c:622 [inline]
sock_sendmsg+0xdd/0x130 net/socket.c:632
sock_write_iter+0x27c/0x3e0 net/socket.c:923
call_write_iter include/linux/fs.h:1863 [inline]
do_iter_readv_writev+0x5e0/0x8e0 fs/read_write.c:680
do_iter_write fs/read_write.c:956 [inline]
do_iter_write+0x184/0x610 fs/read_write.c:937
vfs_writev+0x1b3/0x2f0 fs/read_write.c:1001
do_writev+0xf6/0x290 fs/read_write.c:1036
__do_sys_writev fs/read_write.c:1109 [inline]
__se_sys_writev fs/read_write.c:1106 [inline]
__x64_sys_writev+0x75/0xb0 fs/read_write.c:1106
do_syscall_64+0x103/0x610 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x440139
Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 fb 13 fc ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007ffcc966cc18 EFLAGS: 00000246 ORIG_RAX: 0000000000000014
RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 0000000000440139
RDX: 0000000000000001 RSI: 0000000020000080 RDI: 0000000000000003
RBP: 00000000006ca018 R08: 00000000004002c8 R09: 00000000004002c8
R10: 0000000000000004 R11: 0000000000000246 R12: 00000000004019c0
R13: 0000000000401a50 R14: 0000000000000000 R15: 0000000000000000
Modules linked in:
---[ end trace 460a3c24d0a656c9 ]---
RIP: 0010:xsk_diag_put_umem net/xdp/xsk_diag.c:71 [inline]
RIP: 0010:xsk_diag_fill net/xdp/xsk_diag.c:113 [inline]
RIP: 0010:xsk_diag_dump+0xdcb/0x13a0 net/xdp/xsk_diag.c:143
Code: 8d be c0 04 00 00 48 89 f8 48 c1 e8 03 42 80 3c 20 00 0f 85 39 04 00 00 49 8b 96 c0 04 00 00 48 8d 7a 14 48 89 f8 48 c1 e8 03 <42> 0f b6 0c 20 48 89 f8 83 e0 07 83 c0 03 38 c8 7c 08 84 c9 0f 85
RSP: 0018:ffff888090bcf2d8 EFLAGS: 00010203
RAX: 0000000000000002 RBX: ffff8880a0aacbc0 RCX: ffffffff86ffdc3c
RDX: 0000000000000000 RSI: ffffffff86ffdc70 RDI: 0000000000000014
RBP: ffff888090bcf438 R08: ffff88808e04a700 R09: ffffed1011c74174
R10: ffffed1011c74173 R11: ffff88808e3a0b9f R12: dffffc0000000000
R13: ffff888093a6d818 R14: ffff88808e365240 R15: ffff88808e3a0b40
FS: 00000000011ea880(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000001d22000 CR3: 000000008fa13000 CR4: 00000000001406f0
Fixes: a36b38aa2a
("xsk: add sock_diag interface for AF_XDP")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Cc: Björn Töpel <bjorn.topel@intel.com>
Cc: Daniel Borkmann <daniel@iogearbox.net>
Cc: Magnus Karlsson <magnus.karlsson@intel.com>
Acked-by: Björn Töpel <bjorn.topel@intel.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
192 lines
4.5 KiB
C
192 lines
4.5 KiB
C
// SPDX-License-Identifier: GPL-2.0
|
|
/* XDP sockets monitoring support
|
|
*
|
|
* Copyright(c) 2019 Intel Corporation.
|
|
*
|
|
* Author: Björn Töpel <bjorn.topel@intel.com>
|
|
*/
|
|
|
|
#include <linux/module.h>
|
|
#include <net/xdp_sock.h>
|
|
#include <linux/xdp_diag.h>
|
|
#include <linux/sock_diag.h>
|
|
|
|
#include "xsk_queue.h"
|
|
#include "xsk.h"
|
|
|
|
static int xsk_diag_put_info(const struct xdp_sock *xs, struct sk_buff *nlskb)
|
|
{
|
|
struct xdp_diag_info di = {};
|
|
|
|
di.ifindex = xs->dev ? xs->dev->ifindex : 0;
|
|
di.queue_id = xs->queue_id;
|
|
return nla_put(nlskb, XDP_DIAG_INFO, sizeof(di), &di);
|
|
}
|
|
|
|
static int xsk_diag_put_ring(const struct xsk_queue *queue, int nl_type,
|
|
struct sk_buff *nlskb)
|
|
{
|
|
struct xdp_diag_ring dr = {};
|
|
|
|
dr.entries = queue->nentries;
|
|
return nla_put(nlskb, nl_type, sizeof(dr), &dr);
|
|
}
|
|
|
|
static int xsk_diag_put_rings_cfg(const struct xdp_sock *xs,
|
|
struct sk_buff *nlskb)
|
|
{
|
|
int err = 0;
|
|
|
|
if (xs->rx)
|
|
err = xsk_diag_put_ring(xs->rx, XDP_DIAG_RX_RING, nlskb);
|
|
if (!err && xs->tx)
|
|
err = xsk_diag_put_ring(xs->tx, XDP_DIAG_TX_RING, nlskb);
|
|
return err;
|
|
}
|
|
|
|
static int xsk_diag_put_umem(const struct xdp_sock *xs, struct sk_buff *nlskb)
|
|
{
|
|
struct xdp_umem *umem = xs->umem;
|
|
struct xdp_diag_umem du = {};
|
|
int err;
|
|
|
|
if (!umem)
|
|
return 0;
|
|
|
|
du.id = umem->id;
|
|
du.size = umem->size;
|
|
du.num_pages = umem->npgs;
|
|
du.chunk_size = (__u32)(~umem->chunk_mask + 1);
|
|
du.headroom = umem->headroom;
|
|
du.ifindex = umem->dev ? umem->dev->ifindex : 0;
|
|
du.queue_id = umem->queue_id;
|
|
du.flags = 0;
|
|
if (umem->zc)
|
|
du.flags |= XDP_DU_F_ZEROCOPY;
|
|
du.refs = refcount_read(&umem->users);
|
|
|
|
err = nla_put(nlskb, XDP_DIAG_UMEM, sizeof(du), &du);
|
|
|
|
if (!err && umem->fq)
|
|
err = xsk_diag_put_ring(umem->fq, XDP_DIAG_UMEM_FILL_RING, nlskb);
|
|
if (!err && umem->cq) {
|
|
err = xsk_diag_put_ring(umem->cq, XDP_DIAG_UMEM_COMPLETION_RING,
|
|
nlskb);
|
|
}
|
|
return err;
|
|
}
|
|
|
|
static int xsk_diag_fill(struct sock *sk, struct sk_buff *nlskb,
|
|
struct xdp_diag_req *req,
|
|
struct user_namespace *user_ns,
|
|
u32 portid, u32 seq, u32 flags, int sk_ino)
|
|
{
|
|
struct xdp_sock *xs = xdp_sk(sk);
|
|
struct xdp_diag_msg *msg;
|
|
struct nlmsghdr *nlh;
|
|
|
|
nlh = nlmsg_put(nlskb, portid, seq, SOCK_DIAG_BY_FAMILY, sizeof(*msg),
|
|
flags);
|
|
if (!nlh)
|
|
return -EMSGSIZE;
|
|
|
|
msg = nlmsg_data(nlh);
|
|
memset(msg, 0, sizeof(*msg));
|
|
msg->xdiag_family = AF_XDP;
|
|
msg->xdiag_type = sk->sk_type;
|
|
msg->xdiag_ino = sk_ino;
|
|
sock_diag_save_cookie(sk, msg->xdiag_cookie);
|
|
|
|
if ((req->xdiag_show & XDP_SHOW_INFO) && xsk_diag_put_info(xs, nlskb))
|
|
goto out_nlmsg_trim;
|
|
|
|
if ((req->xdiag_show & XDP_SHOW_INFO) &&
|
|
nla_put_u32(nlskb, XDP_DIAG_UID,
|
|
from_kuid_munged(user_ns, sock_i_uid(sk))))
|
|
goto out_nlmsg_trim;
|
|
|
|
if ((req->xdiag_show & XDP_SHOW_RING_CFG) &&
|
|
xsk_diag_put_rings_cfg(xs, nlskb))
|
|
goto out_nlmsg_trim;
|
|
|
|
if ((req->xdiag_show & XDP_SHOW_UMEM) &&
|
|
xsk_diag_put_umem(xs, nlskb))
|
|
goto out_nlmsg_trim;
|
|
|
|
if ((req->xdiag_show & XDP_SHOW_MEMINFO) &&
|
|
sock_diag_put_meminfo(sk, nlskb, XDP_DIAG_MEMINFO))
|
|
goto out_nlmsg_trim;
|
|
|
|
nlmsg_end(nlskb, nlh);
|
|
return 0;
|
|
|
|
out_nlmsg_trim:
|
|
nlmsg_cancel(nlskb, nlh);
|
|
return -EMSGSIZE;
|
|
}
|
|
|
|
static int xsk_diag_dump(struct sk_buff *nlskb, struct netlink_callback *cb)
|
|
{
|
|
struct xdp_diag_req *req = nlmsg_data(cb->nlh);
|
|
struct net *net = sock_net(nlskb->sk);
|
|
int num = 0, s_num = cb->args[0];
|
|
struct sock *sk;
|
|
|
|
mutex_lock(&net->xdp.lock);
|
|
|
|
sk_for_each(sk, &net->xdp.list) {
|
|
if (!net_eq(sock_net(sk), net))
|
|
continue;
|
|
if (num++ < s_num)
|
|
continue;
|
|
|
|
if (xsk_diag_fill(sk, nlskb, req,
|
|
sk_user_ns(NETLINK_CB(cb->skb).sk),
|
|
NETLINK_CB(cb->skb).portid,
|
|
cb->nlh->nlmsg_seq, NLM_F_MULTI,
|
|
sock_i_ino(sk)) < 0) {
|
|
num--;
|
|
break;
|
|
}
|
|
}
|
|
|
|
mutex_unlock(&net->xdp.lock);
|
|
cb->args[0] = num;
|
|
return nlskb->len;
|
|
}
|
|
|
|
static int xsk_diag_handler_dump(struct sk_buff *nlskb, struct nlmsghdr *hdr)
|
|
{
|
|
struct netlink_dump_control c = { .dump = xsk_diag_dump };
|
|
int hdrlen = sizeof(struct xdp_diag_req);
|
|
struct net *net = sock_net(nlskb->sk);
|
|
|
|
if (nlmsg_len(hdr) < hdrlen)
|
|
return -EINVAL;
|
|
|
|
if (!(hdr->nlmsg_flags & NLM_F_DUMP))
|
|
return -EOPNOTSUPP;
|
|
|
|
return netlink_dump_start(net->diag_nlsk, nlskb, hdr, &c);
|
|
}
|
|
|
|
static const struct sock_diag_handler xsk_diag_handler = {
|
|
.family = AF_XDP,
|
|
.dump = xsk_diag_handler_dump,
|
|
};
|
|
|
|
static int __init xsk_diag_init(void)
|
|
{
|
|
return sock_diag_register(&xsk_diag_handler);
|
|
}
|
|
|
|
static void __exit xsk_diag_exit(void)
|
|
{
|
|
sock_diag_unregister(&xsk_diag_handler);
|
|
}
|
|
|
|
module_init(xsk_diag_init);
|
|
module_exit(xsk_diag_exit);
|
|
MODULE_LICENSE("GPL");
|
|
MODULE_ALIAS_NET_PF_PROTO_TYPE(PF_NETLINK, NETLINK_SOCK_DIAG, AF_XDP);
|