Skip to content

xskmap: reject TX-only AF_XDP sockets#12035

Closed
kernel-patches-daemon-bpf[bot] wants to merge 2 commits intobpf_basefrom
series/1091677=>bpf
Closed

xskmap: reject TX-only AF_XDP sockets#12035
kernel-patches-daemon-bpf[bot] wants to merge 2 commits intobpf_basefrom
series/1091677=>bpf

Conversation

@kernel-patches-daemon-bpf
Copy link
Copy Markdown

Pull request for series with
subject: xskmap: reject TX-only AF_XDP sockets
version: 4
url: https://patchwork.kernel.org/project/netdevbpf/list/?series=1091677

@kernel-patches-daemon-bpf
Copy link
Copy Markdown
Author

Upstream branch: 0c7ae13
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=1091677
version: 4

@kernel-patches-daemon-bpf
Copy link
Copy Markdown
Author

Upstream branch: f3b8c28
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=1091677
version: 4

@kernel-patches-daemon-bpf
Copy link
Copy Markdown
Author

Upstream branch: 18fc650
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=1091677
version: 4

@kernel-patches-daemon-bpf
Copy link
Copy Markdown
Author

Upstream branch: 18fc650
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=1091677
version: 4

XSKMAP entries are used as redirect targets for incoming XDP frames.
A TX-only AF_XDP socket lacks an Rx ring and cannot handle redirected
traffic, but xsk_map_update_elem() currently allows such sockets to
be inserted into the map.

Redirecting packets to such a socket on the veth generic-XDP path
causes a kernel crash in xsk_generic_rcv().

This became possible after xsk_is_setup_for_bpf_map() was removed from
the XSKMAP update path, which allowed bound TX-only sockets to be
inserted into the map.

Reject TX-only sockets during XSKMAP updates to avoid the crash.
They remain fully operational for pure Tx purposes outside XSKMAP.

Fixes: 968be23 ("xsk: Fix possible segfault at xskmap entry insertion")
Reported-by: Juefei Pu <tomapufckgml@gmail.com>
Reported-by: Yuan Tan <yuantan098@gmail.com>
Reported-by: Xin Liu <bird@lzu.edu.cn>
Signed-off-by: Yifan Wu <yifanwucs@gmail.com>
Signed-off-by: Linpu Yu <linpu5433@gmail.com>
Reviewed-by: Jason Xing <kerneljasonxing@gmail.com>
@kernel-patches-daemon-bpf
Copy link
Copy Markdown
Author

At least one diff in series https://patchwork.kernel.org/project/netdevbpf/list/?series=1091677 irrelevant now. Closing PR.

@kernel-patches-daemon-bpf kernel-patches-daemon-bpf Bot deleted the series/1091677=>bpf branch May 9, 2026 23:34
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant