Commit bf6d507f7e3c for kernel

commit bf6d507f7e3c65751d52fd8caf1ea4e003922624
Author: Linpu Yu <linpu5433@gmail.com>
Date:   Fri May 8 22:43:43 2026 +0800

    xskmap: reject TX-only AF_XDP sockets

    XSKMAP entries are used as redirect targets for incoming XDP frames.
    A TX-only AF_XDP socket lacks an Rx ring and cannot handle redirected
    traffic, but xsk_map_update_elem() currently allows such sockets to
    be inserted into the map.

    Redirecting packets to such a socket on the veth generic-XDP path
    causes a kernel crash in xsk_generic_rcv().

    This became possible after xsk_is_setup_for_bpf_map() was removed from
    the XSKMAP update path, which allowed bound TX-only sockets to be
    inserted into the map.

    Reject TX-only sockets during XSKMAP updates to avoid the crash.
    They remain fully operational for pure Tx purposes outside XSKMAP.

    Fixes: 968be23ceaca ("xsk: Fix possible segfault at xskmap entry insertion")
    Reported-by: Juefei Pu <tomapufckgml@gmail.com>
    Reported-by: Yuan Tan <yuantan098@gmail.com>
    Reported-by: Xin Liu <bird@lzu.edu.cn>
    Signed-off-by: Yifan Wu <yifanwucs@gmail.com>
    Signed-off-by: Linpu Yu <linpu5433@gmail.com>
    Reviewed-by: Jason Xing <kerneljasonxing@gmail.com>
    Link: https://lore.kernel.org/r/20260508144344.694-1-linpu5433@gmail.com
    Signed-off-by: Alexei Starovoitov <ast@kernel.org>

diff --git a/net/xdp/xskmap.c b/net/xdp/xskmap.c
index afa457506274..3bff346308d0 100644
--- a/net/xdp/xskmap.c
+++ b/net/xdp/xskmap.c
@@ -184,6 +184,10 @@ static long xsk_map_update_elem(struct bpf_map *map, void *key, void *value,
 	}

 	xs = (struct xdp_sock *)sock->sk;
+	if (!READ_ONCE(xs->rx)) {
+		sockfd_put(sock);
+		return -ENOBUFS;
+	}

 	map_entry = &m->xsk_map[i];
 	node = xsk_map_node_alloc(m, map_entry);