From: Björn Töpel <bjorn.topel@intel.com>
Date: Mon, 7 Dec 2020 08:20:08 +0000 (+0100)
Subject: xsk: Validate socket state in xsk_recvmsg, prior touching socket members
X-Git-Tag: v5.11-rc1~169^2~26^2~15
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=3546b9b8eced9799b35ef953f766a0973b17fda2;p=thirdparty%2Fkernel%2Flinux.git

xsk: Validate socket state in xsk_recvmsg, prior touching socket members

In AF_XDP the socket state needs to be checked, prior touching the
members of the socket. This was not the case for the recvmsg
implementation. Fix that by moving the xsk_is_bound() call.

Fixes: 45a86681844e ("xsk: Add support for recvmsg()")
Reported-by: kernel test robot <oliver.sang@intel.com>
Signed-off-by: Björn Töpel <bjorn.topel@intel.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Magnus Karlsson <magnus.karlsson@intel.com>
Link: https://lore.kernel.org/bpf/20201207082008.132263-1-bjorn.topel@gmail.com
---

diff --git a/net/xdp/xsk.c b/net/xdp/xsk.c
index 56c46e5f57bcf..e28c6825e0897 100644
--- a/net/xdp/xsk.c
+++ b/net/xdp/xsk.c
@@ -554,12 +554,12 @@ static int xsk_recvmsg(struct socket *sock, struct msghdr *m, size_t len, int fl
 	struct sock *sk = sock->sk;
 	struct xdp_sock *xs = xdp_sk(sk);
 
+	if (unlikely(!xsk_is_bound(xs)))
+		return -ENXIO;
 	if (unlikely(!(xs->dev->flags & IFF_UP)))
 		return -ENETDOWN;
 	if (unlikely(!xs->rx))
 		return -ENOBUFS;
-	if (unlikely(!xsk_is_bound(xs)))
-		return -ENXIO;
 	if (unlikely(need_wait))
 		return -EOPNOTSUPP;