Re: [RFC net-next 01/15] xdp: Size zero-copy skb heads by their contents

Maciej Fijalkowski [off-list ref] writes:

On Fri, Oct 02, 2026 at 09:00:02PM +0200, Björn Töpel wrote:

quoted

xdp_build_skb_from_zc() sizes the skb head by the XSK frame size,
which leaves no room for skb_shared_info. With 2 KiB chunks, a
1514 byte frame overwrites 48 bytes of it. Both copies also round
the length up to LARGEST_ALIGN, past the end of the new buffers.

Size the head from headroom plus data, copy exactly the data, and
drop frames whose head does not fit in a page.

Discovered by an AI code review agent. Reproduced on fbnic in QEMU
with AF_XDP zero-copy from the page-pool series: an XDP program that
adds metadata, grows the frame to its end and passes it gets UMEM
bytes in the skb's shared info. A new xskxceiver test,
XDP_PASS_FULL_FRAME, checks this and passes with the fix. The test
will be posted separately.

Fixes: 560d958c6c68 ("xsk: add generic XSk &xdp_buff -> skb conversion")
Signed-off-by: Björn Töpel <bjorn@kernel.org>

Late on the ball here, but I believe this is the case Clement reported and
we rejected it as the reproducer was OOT module.

https://lore.kernel.org/bpf/20260629072300.1664622-1-clecigne@google.com/ (local)

Should we proceed with Clement's fix then?

I'll wake that thread up!

Björn