From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pl1-f169.google.com (mail-pl1-f169.google.com [209.85.214.169]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A8E55377AAC for ; Tue, 18 Aug 2026 15:49:22 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.169 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787068164; cv=none; b=EgXufs0m/lTlMnj5K0fdOvLGMTJ1vlPEnxHfXWaEg3cJDplLdOvCKOQ05Rn++jViu2yPqvTH/5eqNddGt0ogFOdxtoeFs3Z4ZVVzDdQTAihNF8RHqt47BcCFDzdlJUoBVMll3BkF+je203IX2/5sse1FxIUAIyzvOGGf1O2ivE4= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787068164; c=relaxed/simple; bh=fo5PoXZ5ZKT8MDrEaZn6E4TyN2oZ8TJ4XeZLBR3XSA8=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=uaNEjxo/jpD9E6iVGaSwm5RBEgRJ2bmg1BMrzCGYgpoEK84j+U0m8nS5W5CqWX+qs/w1DoLBjPRBhSR6vpXk9Obm0LmSo+s3Q557/ql4QhjibR28I6IWy1PV+nuwYpkekVuKhjV2oMPRdKMMMPWh0c8tWCTUNoI7uH7MjGv3sYg= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=PylBpURd; arc=none smtp.client-ip=209.85.214.169 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="PylBpURd" Received: by mail-pl1-f169.google.com with SMTP id d9443c01a7336-2cf52d15d88so44818055ad.2 for ; Tue, 18 Aug 2026 08:49:22 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1787068162; x=1787672962; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:sender:from:to:cc:subject:date:message-id:reply-to :content-type; bh=kSuvpzf7rU+xT5RM3KODXO3i5VoabBrqOkefcg/k454=; b=PylBpURd1jLiVAm8Cs7dCBobDJvvZy9TGx7l+ZjllMkDrnAoBsWnRm0LEitGLy5ior fRO+97ovEeHD7R0dkpTMuFZ+EvC90M6hly50UyUQh6uH9UTDJaxcM8TFuXxWlz47vI/R SU34n+TfVbXF7KAJpg8htzK4FqwDbv4ZY4JKsS82IADbPqjayswGuWbids6QN4Mbnnwu +2LK1O3IAtFa0o1igXqZm9XvG8epRDhBzHB05xh3qZILigP6rp3YgrPmZFFXipCCnaST TfLBjY+y6FCj6TXYhyh7fyoOYd+PNDIbd10JnhzysNf8PL1uKAqZoCfdsdFMHTetOXI9 r4gQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787068162; x=1787672962; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:sender:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=kSuvpzf7rU+xT5RM3KODXO3i5VoabBrqOkefcg/k454=; b=YzyrSOHBF2OzKAf3eMHRWX8ULfR4BKrOWpsiIAuweKGAHz/sDUv4ilcCThIIUzi73n yA3cauCPp4k8CqypsrfBE+oZmTsREpZer3skAtPtheRshCKDgsO7E9zH0wfK4Gt8kr/f XQCb0MnYyGlociuITx9a1EImRhfN8+R7tj6bG3K+GvF5kIVuRzmQIu+E4tAVzX/rPcEM H3H64+bra6IvttT9cVxYGmUQced2Fu5rHi3yc1haxozwsxrKe88Ib2Nm/UZF3q0vtn/H bEQpVn1NiCLXCE+yMlAIzyhdIcRrcxV6Vien4L4gUc9U5Q+iC2nMLfc1ypgxC71CBWps fUyQ== X-Forwarded-Encrypted: i=1; AHgh+RqQ9m06vsbGHEW8Mkub1l38PbjjeY5xLlESt9ADE6OKwj9QRASfzMUiAZW9cGqZOT9hP13WjhFn7pXmqAo=@vger.kernel.org X-Gm-Message-State: AOJu0Yx+OBWb47gjI2bZRs1nNlZB9kERnQ19jfz+vTKytp/Nr15TeG57 o3kQXeP7/NMMiz2pqpJBjKYkrgO9WaoCAJn4VT8rYzwqJ8Mq4PgF9FnT X-Gm-Gg: AR+sD11Ue4NNSb/cySVLBvTfp+geGhhE8GTPro5H0Vb7wnL4nQVsYOas5kZTXOGqDZf S4HOh7tbKbx+83xBlqc6YxlfwAUTVfyGRXZVsdQ4NA+R2GrpUB8dWY1xGTK+aKH8oR8NooxNdov wf0duLnn+SdKthE1GrI5A8B/qjeL+JuXcwLPAtOgb0aVP6gKBmhOGCy242i3J97ZJewgHlJ9XOQ UbnmKzzKCLX+5QJRyN5knm5EvuDVslVe7jD67iL3emEvK7QOvDr+F6US2OC3i3rLxutqN3x1B8D Wt3BLlPn+dkC0TGEl52QjHwVtXNFCpDCSsknAikcq/Qw2cQPpjVgfkZciNyCRT0fTDQD65xHkPh PvOGZvVZVXmGWH+ezkRdFSgWTeg9nlwMIv+DSFp5qEdkTNYlRDq18Sh1RyDGA1Jb4NSs/QgEsfb Bs3eZBhSnPYvdRvNxSe7Gc0silyMrRoC50kUHDTMp9VPOBPoX8femjk2Bsh793xA/QX3zv6Bx8H HkXii5u8ib4f/pNz9Mys/U= X-Received: by 2002:a17:902:d4c1:b0:2c9:c517:d070 with SMTP id d9443c01a7336-2d3b0ad45d3mr352820585ad.3.1787068161635; Tue, 18 Aug 2026 08:49:21 -0700 (PDT) Received: from 192.168.50.3 ([183.193.113.149]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2d5c1e543besm16937955ad.41.2026.08.18.08.49.16 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 18 Aug 2026 08:49:21 -0700 (PDT) Sender: Weiming Shi From: Weiming Shi To: Alexei Starovoitov , Daniel Borkmann , "David S. Miller" , Jakub Kicinski , Jesper Dangaard Brouer , John Fastabend , Stanislav Fomichev , Eric Dumazet , Paolo Abeni , Simon Horman Cc: netdev@vger.kernel.org, bpf@vger.kernel.org, linux-kernel@vger.kernel.org, =?UTF-8?q?Bj=C3=B6rn=20T=C3=B6pel?= , Xiang Mei , stable@vger.kernel.org Subject: [PATCH net] xdp: fix zero-copy frame layout Date: Tue, 18 Aug 2026 23:45:15 +0800 Message-ID: <20260818154516.793517-1-bestswngs@gmail.com> X-Mailer: git-send-email 2.55.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit xdp_convert_zc_to_xdp_frame() clones an XSK packet into an order-0 page and advertises PAGE_SIZE as its frame size. It allows the copied frame to occupy the page tail needed by skb_shared_info and records zero headroom even when metadata separates the frame header from packet data. An AF_XDP zero-copy packet redirected through cpumap can therefore make the skb overlap skb_shared_info or place it beyond the allocated page. Limit the copied layout to SKB_WITH_OVERHEAD(PAGE_SIZE) and include the metadata length in frame headroom. Redirect callers already handle a NULL conversion result. BUG: KASAN: slab-out-of-bounds in skb_gro_receive Write of size 4 at addr ffff88800cf37004 by task cpumap/1/map:1/146 Call Trace: skb_gro_receive (net/core/gro.c:174) udp_gro_receive (net/ipv4/udp_offload.c:812) inet_gro_receive (net/ipv4/af_inet.c:1539) dev_gro_receive (net/core/gro.c:515) gro_receive_skb (net/core/gro.c:633) cpu_map_kthread_run (kernel/bpf/cpumap.c:395) kthread (kernel/kthread.c:436) ret_from_fork (arch/x86/kernel/process.c:164) ret_from_fork_asm (arch/x86/entry/entry_64.S:255) Kernel panic - not syncing: KASAN: panic_on_warn set ... Fixes: b0d1beeff2a9 ("xdp: implement convert_to_xdp_frame for MEM_TYPE_ZERO_COPY") Cc: stable@vger.kernel.org Reported-by: Xiang Mei Assisted-by: Codex:gpt-5.6 Signed-off-by: Weiming Shi --- net/core/xdp.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/net/core/xdp.c b/net/core/xdp.c index 9890a30584ba..4bb97790b189 100644 --- a/net/core/xdp.c +++ b/net/core/xdp.c @@ -585,7 +585,7 @@ struct xdp_frame *xdp_convert_zc_to_xdp_frame(struct xdp_buff *xdp) xdp->data - xdp->data_meta; totsize = xdp->data_end - xdp->data + metasize; - if (sizeof(*xdpf) + totsize > PAGE_SIZE) + if (sizeof(*xdpf) + totsize > SKB_WITH_OVERHEAD(PAGE_SIZE)) return NULL; page = dev_alloc_page(); @@ -602,7 +602,7 @@ struct xdp_frame *xdp_convert_zc_to_xdp_frame(struct xdp_buff *xdp) xdpf->data = addr + metasize; xdpf->len = totsize - metasize; - xdpf->headroom = 0; + xdpf->headroom = metasize; xdpf->metasize = metasize; xdpf->frame_sz = PAGE_SIZE; xdpf->mem_type = MEM_TYPE_PAGE_ORDER0; -- 2.55.0