* [PATCH net v2] xsk: Fix overflow in descriptor validation
@ 2025-10-07 14:06 Ilia Gavrilov
2025-10-15 8:12 ` [lvc-project] " Ilia Gavrilov
0 siblings, 1 reply; 3+ messages in thread
From: Ilia Gavrilov @ 2025-10-07 14:06 UTC (permalink / raw)
To: Magnus Karlsson
Cc: Maciej Fijalkowski, Stanislav Fomichev, David S. Miller,
Eric Dumazet, Jakub Kicinski, Paolo Abeni, Simon Horman,
Alexei Starovoitov, Daniel Borkmann, Jesper Dangaard Brouer,
John Fastabend, Song Yoong Siang, netdev, bpf, linux-kernel,
lvc-project, stable
The desc->len value can be set up to U32_MAX. If umem tx_metadata_len
option is also set, the value of the expression
'desc->len + pool->tx_metadata_len' can overflow and validation
of the incorrect descriptor will be successfully passed.
This can lead to a subsequent chain of arithmetic overflows
in the xsk_build_skb() function and incorrect sk_buff allocation.
To reproduce the overflow, this piece of userspace code can be used:
struct xdp_umem_reg umem_reg;
umem_reg.addr = (__u64)(void *)umem;
...
umem_reg.chunk_size = 4096;
umem_reg.tx_metadata_len = 16;
umem_reg.flags = XDP_UMEM_TX_METADATA_LEN;
setsockopt(sfd, SOL_XDP, XDP_UMEM_REG, &umem_reg, sizeof(umem_reg));
...
xsk_ring_prod__reserve(tq, batch_size, &idx);
for (i = 0; i < nr_packets; ++i) {
struct xdp_desc *tx_desc = xsk_ring_prod__tx_desc(tq, idx + i);
tx_desc->addr = packets[i].addr;
tx_desc->addr += umem->tx_metadata_len;
tx_desc->options = XDP_TX_METADATA;
tx_desc->len = UINT32_MAX;
}
xsk_ring_prod__submit(tq, nr_packets);
...
sendto(sfd, NULL, 0, MSG_DONTWAIT, NULL, 0);
Found by InfoTeCS on behalf of Linux Verification Center
(linuxtesting.org) with SVACE.
Fixes: 341ac980eab9 ("xsk: Support tx_metadata_len")
Cc: stable@vger.kernel.org
Signed-off-by: Ilia Gavrilov <Ilia.Gavrilov@infotecs.ru>
---
v2: Add a repro
net/xdp/xsk_queue.h | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/net/xdp/xsk_queue.h b/net/xdp/xsk_queue.h
index f16f390370dc..b206a8839b39 100644
--- a/net/xdp/xsk_queue.h
+++ b/net/xdp/xsk_queue.h
@@ -144,7 +144,7 @@ static inline bool xp_aligned_validate_desc(struct xsk_buff_pool *pool,
struct xdp_desc *desc)
{
u64 addr = desc->addr - pool->tx_metadata_len;
- u64 len = desc->len + pool->tx_metadata_len;
+ u64 len = (u64)desc->len + pool->tx_metadata_len;
u64 offset = addr & (pool->chunk_size - 1);
if (!desc->len)
@@ -165,7 +165,7 @@ static inline bool xp_unaligned_validate_desc(struct xsk_buff_pool *pool,
struct xdp_desc *desc)
{
u64 addr = xp_unaligned_add_offset_to_addr(desc->addr) - pool->tx_metadata_len;
- u64 len = desc->len + pool->tx_metadata_len;
+ u64 len = (u64)desc->len + pool->tx_metadata_len;
if (!desc->len)
return false;
--
2.39.5
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [lvc-project] [PATCH net v2] xsk: Fix overflow in descriptor validation
2025-10-07 14:06 [PATCH net v2] xsk: Fix overflow in descriptor validation Ilia Gavrilov
@ 2025-10-15 8:12 ` Ilia Gavrilov
2025-10-15 10:25 ` Alexander Lobakin
0 siblings, 1 reply; 3+ messages in thread
From: Ilia Gavrilov @ 2025-10-15 8:12 UTC (permalink / raw)
To: Alexander Lobakin, Magnus Karlsson
Cc: Song Yoong Siang, Maciej Fijalkowski, Jesper Dangaard Brouer,
Daniel Borkmann, netdev, John Fastabend, Alexei Starovoitov,
stable, linux-kernel, Eric Dumazet, Stanislav Fomichev,
Simon Horman, Jakub Kicinski, bpf, Paolo Abeni, David S. Miller,
lvc-project
On 10/7/25 17:06, Ilia Gavrilov wrote:
> The desc->len value can be set up to U32_MAX. If umem tx_metadata_len
> option is also set, the value of the expression
> 'desc->len + pool->tx_metadata_len' can overflow and validation
> of the incorrect descriptor will be successfully passed.
> This can lead to a subsequent chain of arithmetic overflows
> in the xsk_build_skb() function and incorrect sk_buff allocation.
>
> To reproduce the overflow, this piece of userspace code can be used:
> struct xdp_umem_reg umem_reg;
> umem_reg.addr = (__u64)(void *)umem;
> ...
> umem_reg.chunk_size = 4096;
> umem_reg.tx_metadata_len = 16;
> umem_reg.flags = XDP_UMEM_TX_METADATA_LEN;
> setsockopt(sfd, SOL_XDP, XDP_UMEM_REG, &umem_reg, sizeof(umem_reg));
> ...
>
> xsk_ring_prod__reserve(tq, batch_size, &idx);
>
> for (i = 0; i < nr_packets; ++i) {
> struct xdp_desc *tx_desc = xsk_ring_prod__tx_desc(tq, idx + i);
> tx_desc->addr = packets[i].addr;
> tx_desc->addr += umem->tx_metadata_len;
> tx_desc->options = XDP_TX_METADATA;
> tx_desc->len = UINT32_MAX;
> }
>
> xsk_ring_prod__submit(tq, nr_packets);
> ...
> sendto(sfd, NULL, 0, MSG_DONTWAIT, NULL, 0);
>
> Found by InfoTeCS on behalf of Linux Verification Center
> (linuxtesting.org) with SVACE.
>
> Fixes: 341ac980eab9 ("xsk: Support tx_metadata_len")
> Cc: stable@vger.kernel.org
> Signed-off-by: Ilia Gavrilov <Ilia.Gavrilov@infotecs.ru>
> ---
> v2: Add a repro
> net/xdp/xsk_queue.h | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/net/xdp/xsk_queue.h b/net/xdp/xsk_queue.h
> index f16f390370dc..b206a8839b39 100644
> --- a/net/xdp/xsk_queue.h
> +++ b/net/xdp/xsk_queue.h
> @@ -144,7 +144,7 @@ static inline bool xp_aligned_validate_desc(struct xsk_buff_pool *pool,
> struct xdp_desc *desc)
> {
> u64 addr = desc->addr - pool->tx_metadata_len;
> - u64 len = desc->len + pool->tx_metadata_len;
> + u64 len = (u64)desc->len + pool->tx_metadata_len;
> u64 offset = addr & (pool->chunk_size - 1);
>
> if (!desc->len)
> @@ -165,7 +165,7 @@ static inline bool xp_unaligned_validate_desc(struct xsk_buff_pool *pool,
> struct xdp_desc *desc)
> {
> u64 addr = xp_unaligned_add_offset_to_addr(desc->addr) - pool->tx_metadata_len;
> - u64 len = desc->len + pool->tx_metadata_len;
> + u64 len = (u64)desc->len + pool->tx_metadata_len;
>
> if (!desc->len)
> return false;
Hi, Alexander, Magnus!
I'm sorry to bother you.
Will this patch be applied or rejected?
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [lvc-project] [PATCH net v2] xsk: Fix overflow in descriptor validation
2025-10-15 8:12 ` [lvc-project] " Ilia Gavrilov
@ 2025-10-15 10:25 ` Alexander Lobakin
0 siblings, 0 replies; 3+ messages in thread
From: Alexander Lobakin @ 2025-10-15 10:25 UTC (permalink / raw)
To: Ilia Gavrilov
Cc: Magnus Karlsson, Song Yoong Siang, Maciej Fijalkowski,
Jesper Dangaard Brouer, Daniel Borkmann, netdev, John Fastabend,
Alexei Starovoitov, stable, linux-kernel, Eric Dumazet,
Stanislav Fomichev, Simon Horman, Jakub Kicinski, bpf,
Paolo Abeni, David S. Miller, lvc-project
From: Ilia Gavrilov <Ilia.Gavrilov@infotecs.ru>
Date: Wed, 15 Oct 2025 08:12:20 +0000
> On 10/7/25 17:06, Ilia Gavrilov wrote:
>> The desc->len value can be set up to U32_MAX. If umem tx_metadata_len
>> option is also set, the value of the expression
>> 'desc->len + pool->tx_metadata_len' can overflow and validation
>> of the incorrect descriptor will be successfully passed.
>> This can lead to a subsequent chain of arithmetic overflows
>> in the xsk_build_skb() function and incorrect sk_buff allocation.
>>
>> To reproduce the overflow, this piece of userspace code can be used:
>> struct xdp_umem_reg umem_reg;
>> umem_reg.addr = (__u64)(void *)umem;
>> ...
>> umem_reg.chunk_size = 4096;
>> umem_reg.tx_metadata_len = 16;
>> umem_reg.flags = XDP_UMEM_TX_METADATA_LEN;
>> setsockopt(sfd, SOL_XDP, XDP_UMEM_REG, &umem_reg, sizeof(umem_reg));
>> ...
>>
>> xsk_ring_prod__reserve(tq, batch_size, &idx);
>>
>> for (i = 0; i < nr_packets; ++i) {
>> struct xdp_desc *tx_desc = xsk_ring_prod__tx_desc(tq, idx + i);
>> tx_desc->addr = packets[i].addr;
>> tx_desc->addr += umem->tx_metadata_len;
>> tx_desc->options = XDP_TX_METADATA;
>> tx_desc->len = UINT32_MAX;
>> }
>>
>> xsk_ring_prod__submit(tq, nr_packets);
>> ...
>> sendto(sfd, NULL, 0, MSG_DONTWAIT, NULL, 0);
>>
>> Found by InfoTeCS on behalf of Linux Verification Center
>> (linuxtesting.org) with SVACE.
>>
>> Fixes: 341ac980eab9 ("xsk: Support tx_metadata_len")
>> Cc: stable@vger.kernel.org
>> Signed-off-by: Ilia Gavrilov <Ilia.Gavrilov@infotecs.ru>
>> ---
>> v2: Add a repro
>> net/xdp/xsk_queue.h | 4 ++--
>> 1 file changed, 2 insertions(+), 2 deletions(-)
>>
>> diff --git a/net/xdp/xsk_queue.h b/net/xdp/xsk_queue.h
>> index f16f390370dc..b206a8839b39 100644
>> --- a/net/xdp/xsk_queue.h
>> +++ b/net/xdp/xsk_queue.h
>> @@ -144,7 +144,7 @@ static inline bool xp_aligned_validate_desc(struct xsk_buff_pool *pool,
>> struct xdp_desc *desc)
>> {
>> u64 addr = desc->addr - pool->tx_metadata_len;
>> - u64 len = desc->len + pool->tx_metadata_len;
>> + u64 len = (u64)desc->len + pool->tx_metadata_len;
>> u64 offset = addr & (pool->chunk_size - 1);
>>
>> if (!desc->len)
>> @@ -165,7 +165,7 @@ static inline bool xp_unaligned_validate_desc(struct xsk_buff_pool *pool,
>> struct xdp_desc *desc)
>> {
>> u64 addr = xp_unaligned_add_offset_to_addr(desc->addr) - pool->tx_metadata_len;
>> - u64 len = desc->len + pool->tx_metadata_len;
>> + u64 len = (u64)desc->len + pool->tx_metadata_len;
>>
>> if (!desc->len)
>> return false;
>
> Hi, Alexander, Magnus!
>
> I'm sorry to bother you.
> Will this patch be applied or rejected?
Hey,
We took a different solution: [0]
[0]
https://web.git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=07ca98f906a403637fc5e513a872a50ef1247f3b
Thanks,
Olek
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2025-10-15 10:25 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2025-10-07 14:06 [PATCH net v2] xsk: Fix overflow in descriptor validation Ilia Gavrilov
2025-10-15 8:12 ` [lvc-project] " Ilia Gavrilov
2025-10-15 10:25 ` Alexander Lobakin
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®