Hello:
This series was applied to netdev/net.git (main)
by Jakub Kicinski [off-list ref]:
On Mon, 27 Jul 2026 09:19:53 -0700 you wrote:
Cen Zhang reported a KASAN out-of-bounds read when AF_XDP is configured
with a TX metadata area smaller than struct xsk_tx_metadata. The metadata
is also shared with user space, so reading its flags more than once can
produce inconsistent validation and processing decisions.
Require enough space for the flags and one request field, validate the
launch-time field against the configured metadata length, and use one
snapshot of the flags while processing each request. Carry the validated
decision through completion handling so later user-space changes cannot
enable an unrequested completion timestamp.
[...]
Here is the summary with links:
- [net,1/6] xsk: require at least 16 bytes of TX metadata
https://git.kernel.org/netdev/net/c/1bb30b181d9f
- [net,2/6] xsk: pass TX metadata pointer by reference
https://git.kernel.org/netdev/net/c/19366db6dfcc
- [net,3/6] xsk: clear metadata pointer when no timestamp is requested
https://git.kernel.org/netdev/net/c/9f60a67df8d3
- [net,4/6] xsk: validate launch-time metadata size
https://git.kernel.org/netdev/net/c/439ce2dddf3d
- [net,5/6] xsk: move xsk_tx_metadata_request() to xdp_sock_drv.h
https://git.kernel.org/netdev/net/c/ddd0d6c5bfe2
- [net,6/6] xsk: validate metadata when processing requests
https://git.kernel.org/netdev/net/c/849b1664dbda
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html