xsk: Fix for xp_aligned_validate_desc() when len == chunk_size

When desc->len is equal to chunk_size, it is legal. But when the
xp_aligned_validate_desc() got chunk_end from desc->addr + desc->len
pointing to the next chunk during the check, it caused the check to
fail.

This problem was first introduced in 5c50728312d3 ("xsk: new descriptor
addressing scheme"). Later in d9ed155ea143 ("xsk: Introduce AF_XDP buffer
allocation API") this piece of code was moved into the new function called
xp_aligned_validate_desc(). This function was then moved into xsk_queue.h
via 71a80efd1167 ("xsk: Explicitly inline functions and move definitions").

Fixes: 5c50728312d3 ("xsk: new descriptor addressing scheme")
Signed-off-by: Xuan Zhuo <xuanzhuo@linux.alibaba.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Magnus Karlsson <magnus.karlsson@intel.com>
Link: https://lore.kernel.org/bpf/20210428094424.54435-1-xuanzhuo@linux.alibaba.com

diff --git a/net/xdp/xsk_queue.h b/net/xdp/xsk_queue.h
index 2ac3802c2cd7fc96ac6a7be851a5457cc34d9863..9d2a89d793c010e46541bda80d6134dd606fedfa 100644 (file)
--- a/net/xdp/xsk_queue.h
+++ b/net/xdp/xsk_queue.h
@@ -128,13 +128,12 @@ static inline bool xskq_cons_read_addr_unchecked(struct xsk_queue *q, u64 *addr)
 static inline bool xp_aligned_validate_desc(struct xsk_buff_pool *pool,
                                            struct xdp_desc *desc)
 {
-       u64 chunk, chunk_end;
+       u64 chunk;
 
-       chunk = xp_aligned_extract_addr(pool, desc->addr);
-       chunk_end = xp_aligned_extract_addr(pool, desc->addr + desc->len);
-       if (chunk != chunk_end)
+       if (desc->len > pool->chunk_size)
                return false;
 
+       chunk = xp_aligned_extract_addr(pool, desc->addr);
        if (chunk >= pool->addrs_cnt)
                return false;