Re: [PATCH net v2] xsk: reject undersized tx_metadata at runtime validation
From: Alexander Lobakin <aleksander.lobakin@intel.com>
Date: 2026-07-23 15:17:53
Also in:
bpf, lkml
From: Stanislav Fomichev <redacted> Date: Wed, 22 Jul 2026 10:55:17 -0700
On 07/22, Cen Zhang (Microsoft) wrote:quoted
There is no metadata length check before accessing struct xsk_tx_metadata fields in both xdp_umem_reg() (registration) and xsk_buff_valid_tx_metadata() (runtime). Thus, an invalid small tx_metadata_len (e.g. 8 bytes) passes registration and later causes an out-of-bounds read when xsk_skb_metadata() accesses fields beyond the declared metadata region.
[...]
quoted hunk ↗ jump to hunk
@@ -773,7 +773,7 @@ struct xdp_desc_ctx xp_raw_get_ctx(const struct xsk_buff_pool *pool, u64 addr) addr = __xp_raw_get_addr(pool, addr); ret.dma = __xp_raw_get_dma(pool, addr); - ret.meta = __xsk_buff_get_metadata(pool, __xp_raw_get_data(pool, addr)); + xsk_buff_read_metadata(pool, addr, &ret.meta);
That effectively disables some micro-optimizations that were the reason I created this helper -- __xp_raw_get_data() is inline, while xsk_buff_read_metadata() uses the external version, probably some other stuff (note the underscored __xsk_buff_get_metadata()) =\ This function expanded to have no external calls on clang -O2, with this patch I'm not sure it would.
return ret; }
Thanks, Olek