]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
xskmap: reject TX-only AF_XDP sockets
authorLinpu Yu <linpu5433@gmail.com>
Fri, 8 May 2026 14:43:43 +0000 (22:43 +0800)
committerAlexei Starovoitov <ast@kernel.org>
Sat, 9 May 2026 23:17:01 +0000 (16:17 -0700)
commitbf6d507f7e3c65751d52fd8caf1ea4e003922624
treec2d08f534341e6b59afc2b7ed6955abe7f4cc1ca
parent512809bb8a370d071f66fc53abe67368e171dec5
xskmap: reject TX-only AF_XDP sockets

XSKMAP entries are used as redirect targets for incoming XDP frames.
A TX-only AF_XDP socket lacks an Rx ring and cannot handle redirected
traffic, but xsk_map_update_elem() currently allows such sockets to
be inserted into the map.

Redirecting packets to such a socket on the veth generic-XDP path
causes a kernel crash in xsk_generic_rcv().

This became possible after xsk_is_setup_for_bpf_map() was removed from
the XSKMAP update path, which allowed bound TX-only sockets to be
inserted into the map.

Reject TX-only sockets during XSKMAP updates to avoid the crash.
They remain fully operational for pure Tx purposes outside XSKMAP.

Fixes: 968be23ceaca ("xsk: Fix possible segfault at xskmap entry insertion")
Reported-by: Juefei Pu <tomapufckgml@gmail.com>
Reported-by: Yuan Tan <yuantan098@gmail.com>
Reported-by: Xin Liu <bird@lzu.edu.cn>
Signed-off-by: Yifan Wu <yifanwucs@gmail.com>
Signed-off-by: Linpu Yu <linpu5433@gmail.com>
Reviewed-by: Jason Xing <kerneljasonxing@gmail.com>
Link: https://lore.kernel.org/r/20260508144344.694-1-linpu5433@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
net/xdp/xskmap.c