[PATCH bpf 1/1] bpf: devmap: reject cloning fragmented xdp frames

From: Zhao Zhang <redacted>

Devmap broadcast redirects clone xdp_frame instances for all but the
last destination. That clone path only copies the linear frame data,
while fragmented XDP frames store skb_shared_info in tailroom outside
the linear area.

As a result, broadcasting a fragmented xdp_frame leaves the clone with
XDP_FLAGS_HAS_FRAGS set but without valid frag metadata. The later free
path then treats uninitialized tail data as skb_shared_info, leading to
an out-of-bounds access during frame return.

Reject fragmented frames in dev_map_enqueue_clone(). Devmap already uses
-EOPNOTSUPP for unsupported XDP frag forwarding cases, and the current
xdp_frame clone model cannot safely represent a cloned fragmented
frame.

Fixes: e624d4ed4aa8 ("xdp: Extend xdp_redirect_map with broadcast support")
Cc: stable@kernel.org
Reported-by: Yuan Tan <redacted>
Reported-by: Zhengchuan Liang <redacted>
Reported-by: Xin Liu <redacted>
Assisted-by: Codex:GPT-5.4
Signed-off-by: Zhao Zhang <redacted>
Signed-off-by: Ren Wei <redacted>
---
 kernel/bpf/devmap.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/kernel/bpf/devmap.c b/kernel/bpf/devmap.c
index cc0a43ebab6b..2bfebded5329 100644
--- a/kernel/bpf/devmap.c
+++ b/kernel/bpf/devmap.c

@@ -581,6 +581,10 @@ static int dev_map_enqueue_clone(struct bpf_dtab_netdev *obj,
 {
 	struct xdp_frame *nxdpf;
 
+	/* Frags live outside the linear frame and cannot be cloned safely. */
+	if (unlikely(xdp_frame_has_frags(xdpf)))
+		return -EOPNOTSUPP;
+
 	nxdpf = xdpf_clone(xdpf);
 	if (!nxdpf)
 		return -ENOMEM;

-- 
2.47.3