Re: [PATCH 6.12.y] xsk: cache csum_start/csum_offset to fix TOCTOU in xsk_skb_metadata()
From: Sasha Levin <sashal@kernel.org>
Date: 2026-09-06 13:33:49
Also in:
bpf, stable
The TX metadata area resides in the UMEM buffer which is memory-mapped and concurrently writable by userspace. In xsk_skb_metadata(), csum_start and csum_offset are read from shared memory for bounds validation, then read again for skb assignment. A malicious userspace application can race to overwrite these values between the two reads,
Queued for 6.12, thanks. -- Thanks, Sasha