[PATCH 1/1] xskmap: reject TX-only AF_XDP sockets

[Linpu Yu]

Reject TX-only AF_XDP sockets from XSKMAP updates. Redirected
packets always enter the Rx path, where the kernel expects the
selected socket to have an Rx ring. A TX-only socket can
currently be inserted into an XSKMAP, and redirecting a packet
to it crashes the kernel in xsk_generic_rcv().

Keep TX-only AF_XDP sockets valid for pure Tx use, but prevent
them from being published through XSKMAP.

Fixes: fbfc504a24f5 ("bpf: introduce new bpf AF_XDP map type BPF_MAP_TYPE_XSKMAP")
Reported-by: Juefei Pu <tomapufckgml@xxxxxxxxx>
Reported-by: Yuan Tan <yuantan098@xxxxxxxxx>
Signed-off-by: Xin Liu <bird@xxxxxxxxxx>
Signed-off-by: Yifan Wu <yifanwucs@xxxxxxxxx>
Signed-off-by: Linpu Yu <linpu5433@xxxxxxxxx>
---
 net/xdp/xskmap.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/net/xdp/xskmap.c b/net/xdp/xskmap.c
index afa457506274c..6dac59ebb5cf0 100644
--- a/net/xdp/xskmap.c
+++ b/net/xdp/xskmap.c
@@ -184,6 +184,10 @@ static long xsk_map_update_elem(struct bpf_map *map, void *key, void *value,
 	}
 
 	xs = (struct xdp_sock *)sock->sk;
+	if (!READ_ONCE(xs->rx)) {
+		sockfd_put(sock);
+		return -EINVAL;
+	}
 
 	map_entry = &m->xsk_map[i];
 	node = xsk_map_node_alloc(m, map_entry);
-- 
2.53.0