Re: [PATCH 1/1] xskmap: reject TX-only AF_XDP sockets

[Jason Xing]

On Mon, Mar 30, 2026 at 3:33 AM Linpu Yu <linpu5433@xxxxxxxxx> wrote:
>
> Reject TX-only AF_XDP sockets from XSKMAP updates. Redirected
> packets always enter the Rx path, where the kernel expects the
> selected socket to have an Rx ring. A TX-only socket can
> currently be inserted into an XSKMAP, and redirecting a packet
> to it crashes the kernel in xsk_generic_rcv().
>
> Keep TX-only AF_XDP sockets valid for pure Tx use, but prevent
> them from being published through XSKMAP.
>
> Fixes: fbfc504a24f5 ("bpf: introduce new bpf AF_XDP map type BPF_MAP_TYPE_XSKMAP")
> Reported-by: Juefei Pu <tomapufckgml@xxxxxxxxx>
> Reported-by: Yuan Tan <yuantan098@xxxxxxxxx>
> Signed-off-by: Xin Liu <bird@xxxxxxxxxx>
> Signed-off-by: Yifan Wu <yifanwucs@xxxxxxxxx>
> Signed-off-by: Linpu Yu <linpu5433@xxxxxxxxx>

Thanks for the exhaustive report and fix!

Please use [patch net-next] or [patch bpf-next] as the targeted tree
for maintainers to easily understand which tree to apply.

> ---
>  net/xdp/xskmap.c | 4 ++++
>  1 file changed, 4 insertions(+)
>
> diff --git a/net/xdp/xskmap.c b/net/xdp/xskmap.c
> index afa457506274c..6dac59ebb5cf0 100644
> --- a/net/xdp/xskmap.c
> +++ b/net/xdp/xskmap.c
> @@ -184,6 +184,10 @@ static long xsk_map_update_elem(struct bpf_map *map, void *key, void *value,
>         }
>
>         xs = (struct xdp_sock *)sock->sk;
> +       if (!READ_ONCE(xs->rx)) {
> +               sockfd_put(sock);
> +               return -EINVAL;

Can we use -ENOBUFS as well, like how xsk_recvmsg checks the rx ring?

Otherwise, it looks good to me.

Thanks,
Jason