From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-ed1-f73.google.com (mail-ed1-f73.google.com [209.85.208.73]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C7C3C3CF1E1 for ; Mon, 29 Jun 2026 07:23:22 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.208.73 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782717807; cv=none; b=nsc52ukxHvRzTBb4/3+byK+n0YYGgMgQoJKdeM7cuWk4UGA9P8Kd49HkSo4yvkEExf5qrFA2zPS4oykywoUNxbbIZ/LlY88Ef1kQt/UdScOJnqkQEroR1DuPg479T7t3Ik9d8qPS8/duuVBT5d8E8pBcIxIvbEdHs2U93n4ayJA= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782717807; c=relaxed/simple; bh=F4mUr5fBW1c1Axigt0EZGxBodn37EyWGG5Bvapzj6BA=; h=Date:Mime-Version:Message-ID:Subject:From:To:Cc:Content-Type; b=ClN6pAfLQ7YIfLbKW6+2OoBw54A/Vzjd3MR6Wp8vhkztgauRK8N78sT4CP0Lu054GPjC7d2pwh3vniA77+uEQaWeIng6lrsBcrOh9SutF1cVSBo2tBVc6vNAJWDL0zLRj0+erEb2/ejVB6i7r0DWqEbS5D8qrU+uegoYPFGug9s= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--clecigne.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=KFoMNT+Z; arc=none smtp.client-ip=209.85.208.73 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--clecigne.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="KFoMNT+Z" Received: by mail-ed1-f73.google.com with SMTP id 4fb4d7f45d1cf-6982fdf5801so2470336a12.0 for ; Mon, 29 Jun 2026 00:23:22 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1782717801; x=1783322601; darn=vger.kernel.org; h=content-transfer-encoding:cc:to:from:subject:message-id :mime-version:date:from:to:cc:subject:date:message-id:reply-to; bh=esIyG5vSRRrObBzd9FBYvLdlPmWTHEKEhlqipjb5aLM=; b=KFoMNT+Z3IUv44V2WDO4nmwk0jVWhc2avf3twLkEiT0zC+bo+OV5BorxbIRkAtr4Se wJMhGJM4b7eDiIvkabthe7LoUzlt/UuiFddM+e0tI5O5eKxMffGjqxQ4Ukf4lVaXIWzQ myNLd55O2h5efC5BE4jh4pp06AtSTl0+4oiemVCIgEi9E1+UzitUohSj1QqWWLLqS8vV QCk1DLwtaDzCB15iIn4PEUgtKinmBz1/03vLlQ1ahFukJYepsjfuja2q1r7grmCfmh6T VnXNiH5qYiUg2ibLbFEUKX6ruy9Dv3vGTU99cavVObLewmbm0fzStxbY93vHFc7kzHoF Y4WA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1782717801; x=1783322601; h=content-transfer-encoding:cc:to:from:subject:message-id :mime-version:date:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=esIyG5vSRRrObBzd9FBYvLdlPmWTHEKEhlqipjb5aLM=; b=mqxnQJUOotRSLryXBz/g2C0h7ku3fWRFG3t3Zlwzxmc7fppDOKiuJkXasXRlb1iAVV VqP1ztYZURVVtKKfKMMCD1K5CTcTZ+/uCsZUDF92OTiV4i7B6y4ppy5xWHCOhQXeUusq N3N5yDx3wrERBfoZqvr11oOPuL9oF/jUqniLRED9Y98HFwEPswz1xJ2qAOc+pgF8kvh8 vWjIBhTLpV/ZuXmvxUYOYDKf6Om81VRcf/V2iItpJPdlBiVcmFFjZtq6E28EIrmmdvG6 t8jdXFQYEBo0mAKkyNvPMwtdRZkxpirpulE0DOspIZ7+ZKlVIuBkr3Ih2gfP0jkAHcmz gXVA== X-Forwarded-Encrypted: i=1; AHgh+Rrt4lxRhFu2j2Tj+lfxmInNKtldTra83tKpMvR8DCbv10NYTZ3TfsO6YWYw0nsnWGrNIjO7RqclRC4taCs=@vger.kernel.org X-Gm-Message-State: AOJu0YwHppY2R52w4YIzR6/LTVurbXLu/ikDP7qvQ8tYq3jaKq/jrZwY A0X2bkm9nnRAIdJdyaqxnWsWlUvOYCM5U6/V7V0Tlcf16B/G+2k4gglOgr8dRhYO9Qlh9/CP8nL evnpgMk2LlQ+fRQ== X-Received: from edyd4.prod.google.com ([2002:a05:6402:784:b0:698:3f24:d08a]) (user=clecigne job=prod-delivery.src-stubby-dispatcher) by 2002:a05:6402:190b:b0:697:c0f6:394c with SMTP id 4fb4d7f45d1cf-69810a44a6dmr5463438a12.9.1782717800656; Mon, 29 Jun 2026 00:23:20 -0700 (PDT) Date: Mon, 29 Jun 2026 07:22:58 +0000 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 X-Mailer: git-send-email 2.55.0.rc0.799.gd6f94ed593-goog Message-ID: <20260629072300.1664622-1-clecigne@google.com> Subject: [PATCH v3] xsk: fix memory corruptions in net/core/xdp.c From: Clement Lecigne To: aleksander.lobakin@intel.com, edumazet@google.com, netdev@vger.kernel.org Cc: clecigne@google.com, bpf@vger.kernel.org, linux-kernel@vger.kernel.org, kuba@kernel.org, sdf@fomichev.me, horms@kernel.org, john.fastabend@gmail.com, ast@kernel.org, daniel@iogearbox.net Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable From: Cl=C3=A9ment Lecigne Commit 560d958c6c68 ("xsk: add generic XSk &xdp_buff -> skb conversion") introduced a vulnerability in the handling of XDP_PASS for AF_XDP zero-copy frames. Note: Currently, this specific AF_XDP zero-copy conversion path is only reachable from the drivers/net/ethernet/intel/ice and drivers/net/ethernet/intel/idpf drivers. When building an skb, xdp_build_skb_from_zc() uses the chunk size (xdp->frame_sz) for the allocation. However, napi_build_skb() automatically reserves space at the end of the allocation for the skb_shared_info structure.=20 Most high performance UMEM applications use 4K chunks, where the corruption cannot happen. However, if the UMEM is configured with 2KB chunks (a very common configuration to maximize packet density in memory), a standard 1500 MTU packet will trigger the corruption because the required space exceeds the 2048 byte chunk size: Headroom (256) + Packet (1514) + skb_shared_info (320) =3D 2090 bytes Because 2090 bytes > 2048 bytes and __skb_put() does not perform bounds checking, the memcpy() writes past the available linear data area and corrupts the skb_shared_info structure. This can lead to arbitrary code execution if pointers like destructor_arg are overwritten. Additionally, in xdp_copy_frags_from_zc(), the allocation size is set strictly to the fragment size (len), but the subsequent memcpy() uses LARGEST_ALIGN(len). This mismatch results in an out-of-bounds write of up to 7 bytes, which triggers KASAN warnings and is unsafe despite typical page pool allocator padding. Fix the skb allocation in xdp_build_skb_from_zc() by dynamically calculating the exact truesize required using SKB_HEAD_ALIGN() to properly account for the headroom, the LARGEST_ALIGN(len), and the skb_shared_info overhead. Fix the out-of-bounds write in xdp_copy_frags_from_zc() by rounding up the allocation request using LARGEST_ALIGN(len) to match the copy operation. Fixes: 560d958c6c68 ("xsk: add generic XSk &xdp_buff -> skb conversion") CC: Alexander Lobakin CC: Eric Dumazet Signed-off-by: Cl=C3=A9ment Lecigne --- Changes since v2: - Used LARGEST_ALIGN to calculate the len to account for the aligned memcp= y. - Fixed the commit message to include the idpf driver. Changes since v1: - Used SKB_HEAD_ALIGN to properly calculate the required allocation size including the skb_shared_info overhead. - Re-ordered variable declarations. --- diff --git a/net/core/xdp.c b/net/core/xdp.c index 9890a30584ba..7e39f17ad407 100644 --- a/net/core/xdp.c +++ b/net/core/xdp.c @@ -698,8 +698,8 @@ static noinline bool xdp_copy_frags_from_zc(struct sk_b= uff *skb, =20 for (u32 i =3D 0; i < nr_frags; i++) { const skb_frag_t *frag =3D &xinfo->frags[i]; - u32 len =3D skb_frag_size(frag); - u32 offset, truesize =3D len; + u32 offset, len =3D skb_frag_size(frag); + u32 truesize =3D LARGEST_ALIGN(len); struct page *page; =20 page =3D page_pool_dev_alloc(pp, &offset, &truesize); @@ -738,9 +738,10 @@ static noinline bool xdp_copy_frags_from_zc(struct sk_= buff *skb, */ struct sk_buff *xdp_build_skb_from_zc(struct xdp_buff *xdp) { + u32 headroom =3D xdp->data_meta - xdp->data_hard_start; const struct xdp_rxq_info *rxq =3D xdp->rxq; - u32 len =3D xdp->data_end - xdp->data_meta; - u32 truesize =3D xdp->frame_sz; + u32 len =3D LARGEST_ALIGN(xdp->data_end - xdp->data_meta); + u32 truesize =3D SKB_HEAD_ALIGN(headroom + len); struct sk_buff *skb =3D NULL; struct page_pool *pp; int metalen; @@ -762,7 +763,7 @@ struct sk_buff *xdp_build_skb_from_zc(struct xdp_buff *= xdp) } =20 skb_mark_for_recycle(skb); - skb_reserve(skb, xdp->data_meta - xdp->data_hard_start); + skb_reserve(skb, headroom); =20 memcpy(__skb_put(skb, len), xdp->data_meta, LARGEST_ALIGN(len)); =20