diff options
| author | Ilya Maximets <i.maximets@samsung.com> | 2019-07-04 17:25:03 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2020-01-27 14:51:01 +0100 |
| commit | fca3e8283f359a8835dd3b981a993f41dad9ed35 (patch) | |
| tree | 62c98c11f98642c85c427680172318d2fa3d12e6 /net/xdp | |
| parent | d5fe594a48b7530f79fae9c7e2b2ff4786c2a46c (diff) | |
| download | linux-stable-fca3e8283f359a8835dd3b981a993f41dad9ed35.tar.gz linux-stable-fca3e8283f359a8835dd3b981a993f41dad9ed35.tar.bz2 linux-stable-fca3e8283f359a8835dd3b981a993f41dad9ed35.zip | |
xdp: fix possible cq entry leak
[ Upstream commit 675716400da6f15b9d3db04ef74ee74ca9a00af3 ]
Completion queue address reservation could not be undone.
In case of bad 'queue_id' or skb allocation failure, reserved entry
will be leaked reducing the total capacity of completion queue.
Fix that by moving reservation to the point where failure is not
possible. Additionally, 'queue_id' checking moved out from the loop
since there is no point to check it there.
Fixes: 35fcde7f8deb ("xsk: support for Tx")
Signed-off-by: Ilya Maximets <i.maximets@samsung.com>
Acked-by: Björn Töpel <bjorn.topel@intel.com>
Tested-by: William Tu <u9012063@gmail.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'net/xdp')
| -rw-r--r-- | net/xdp/xsk.c | 11 |
1 files changed, 4 insertions, 7 deletions
diff --git a/net/xdp/xsk.c b/net/xdp/xsk.c index 547fc4554b22..c90854bc3048 100644 --- a/net/xdp/xsk.c +++ b/net/xdp/xsk.c @@ -218,6 +218,9 @@ static int xsk_generic_xmit(struct sock *sk, struct msghdr *m, mutex_lock(&xs->mutex); + if (xs->queue_id >= xs->dev->real_num_tx_queues) + goto out; + while (xskq_peek_desc(xs->tx, &desc)) { char *buffer; u64 addr; @@ -228,12 +231,6 @@ static int xsk_generic_xmit(struct sock *sk, struct msghdr *m, goto out; } - if (xskq_reserve_addr(xs->umem->cq)) - goto out; - - if (xs->queue_id >= xs->dev->real_num_tx_queues) - goto out; - len = desc.len; skb = sock_alloc_send_skb(sk, len, 1, &err); if (unlikely(!skb)) { @@ -245,7 +242,7 @@ static int xsk_generic_xmit(struct sock *sk, struct msghdr *m, addr = desc.addr; buffer = xdp_umem_get_data(xs->umem, addr); err = skb_store_bits(skb, 0, buffer, len); - if (unlikely(err)) { + if (unlikely(err) || xskq_reserve_addr(xs->umem->cq)) { kfree_skb(skb); goto out; } |