From: Jason Xing <kerneljasonxing@gmail•com>
To: davem@davemloft•net, edumazet@google•com, kuba@kernel•org,
pabeni@redhat•com, bjorn@kernel•org, magnus.karlsson@intel•com,
maciej.fijalkowski@intel•com, jonathan.lemon@gmail•com,
sdf@fomichev•me, ast@kernel•org, daniel@iogearbox•net,
hawk@kernel•org, john.fastabend@gmail•com
Cc: bpf@vger•kernel.org, netdev@vger•kernel.org,
Jason Xing <kernelxing@tencent•com>
Subject: [PATCH net v3 0/8] xsk: fix bugs around xsk skb allocation
Date: Wed, 22 Apr 2026 11:36:42 +0800 [thread overview]
Message-ID: <20260422033650.68457-1-kerneljasonxing@gmail.com> (raw)
From: Jason Xing <kernelxing@tencent•com>
There are rare issues around xsk_build_skb(). Some of them
were founded by Sashiko[1][2].
[1]: https://lore.kernel.org/all/20260415082654.21026-1-kerneljasonxing@gmail.com/
[2]: https://lore.kernel.org/all/20260418045644.28612-1-kerneljasonxing@gmail.com/
---
v3
Link: https://lore.kernel.org/all/20260420082805.14844-1-kerneljasonxing@gmail.com/
1. use !xs->skb as the indicator of first frag in patch 3 (Stan)
2. move init skb after it's allocated successfully, so patch 4,5,6 have
been adjusted accordingly (Stan)
3. do not support 32-bit arch (Stan)
4. add acked-by tags (Stan)
v2
Link: https://lore.kernel.org/all/20260418045644.28612-1-kerneljasonxing@gmail.com/#t
1. add four patches spotted by sashiko to fix buggy pre-existing
behavior
2. adjust the order of 8 patches.
Jason Xing (8):
xsk: reject sw-csum UMEM binding to IFF_TX_SKB_NO_LINEAR devices
xsk: handle NULL dereference of the skb without frags issue
xsk: fix use-after-free of xs->skb in xsk_build_skb() free_err path
xsk: prevent CQ desync when freeing half-built skbs in xsk_build_skb()
xsk: avoid skb leak in XDP_TX_METADATA case
xsk: free the skb when hitting the upper bound MAX_SKB_FRAGS
xsk: fix xsk_addrs slab leak on multi-buffer error path
xsk: don't support AF_XDP on 32-bit architectures
net/xdp/Kconfig | 2 +-
net/xdp/xsk.c | 31 ++++++++++++++++++++-----------
net/xdp/xsk_buff_pool.c | 3 +++
3 files changed, 24 insertions(+), 12 deletions(-)
--
2.41.3
next reply other threads:[~2026-04-22 3:36 UTC|newest]
Thread overview: 23+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-04-22 3:36 Jason Xing [this message]
2026-04-22 3:36 ` [PATCH net v3 1/8] xsk: reject sw-csum UMEM binding to IFF_TX_SKB_NO_LINEAR devices Jason Xing
2026-04-22 3:36 ` [PATCH net v3 2/8] xsk: handle NULL dereference of the skb without frags issue Jason Xing
2026-04-22 3:36 ` [PATCH net v3 3/8] xsk: fix use-after-free of xs->skb in xsk_build_skb() free_err path Jason Xing
2026-04-22 16:31 ` Stanislav Fomichev
2026-04-22 3:36 ` [PATCH net v3 4/8] xsk: prevent CQ desync when freeing half-built skbs in xsk_build_skb() Jason Xing
2026-04-22 16:31 ` Stanislav Fomichev
2026-04-22 3:36 ` [PATCH net v3 5/8] xsk: avoid skb leak in XDP_TX_METADATA case Jason Xing
2026-04-22 16:31 ` Stanislav Fomichev
2026-04-22 3:36 ` [PATCH net v3 6/8] xsk: free the skb when hitting the upper bound MAX_SKB_FRAGS Jason Xing
2026-04-22 16:31 ` Stanislav Fomichev
2026-04-22 3:36 ` [PATCH net v3 7/8] xsk: fix xsk_addrs slab leak on multi-buffer error path Jason Xing
2026-04-22 3:36 ` [PATCH net v3 8/8] xsk: don't support AF_XDP on 32-bit architectures Jason Xing
2026-04-22 16:09 ` Alexander Lobakin
2026-04-22 16:37 ` Jason Xing
2026-04-22 16:58 ` Maciej Fijalkowski
2026-04-22 23:49 ` Jason Xing
2026-04-23 12:14 ` Alexander Lobakin
2026-04-23 13:03 ` Jason Xing
2026-04-22 17:00 ` Alexander Lobakin
2026-04-22 16:31 ` Stanislav Fomichev
2026-04-22 20:27 ` David Laight
2026-04-22 23:45 ` Jason Xing
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260422033650.68457-1-kerneljasonxing@gmail.com \
--to=kerneljasonxing@gmail$(echo .)com \
--cc=ast@kernel$(echo .)org \
--cc=bjorn@kernel$(echo .)org \
--cc=bpf@vger$(echo .)kernel.org \
--cc=daniel@iogearbox$(echo .)net \
--cc=davem@davemloft$(echo .)net \
--cc=edumazet@google$(echo .)com \
--cc=hawk@kernel$(echo .)org \
--cc=john.fastabend@gmail$(echo .)com \
--cc=jonathan.lemon@gmail$(echo .)com \
--cc=kernelxing@tencent$(echo .)com \
--cc=kuba@kernel$(echo .)org \
--cc=maciej.fijalkowski@intel$(echo .)com \
--cc=magnus.karlsson@intel$(echo .)com \
--cc=netdev@vger$(echo .)kernel.org \
--cc=pabeni@redhat$(echo .)com \
--cc=sdf@fomichev$(echo .)me \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox