Re: [lvc-project] [PATCH net v2] xsk: Fix overflow in descriptor validation

On 10/7/25 17:06, Ilia Gavrilov wrote:

The desc->len value can be set up to U32_MAX. If umem tx_metadata_len option is also set, the value of the expression 'desc->len + pool->tx_metadata_len' can overflow and validation of the incorrect descriptor will be successfully passed. This can lead to a subsequent chain of arithmetic overflows in the xsk_build_skb() function and incorrect sk_buff allocation.

To reproduce the overflow, this piece of userspace code can be used: struct xdp_umem_reg umem_reg; umem_reg.addr = (__u64)(void *)umem; ... umem_reg.chunk_size = 4096; umem_reg.tx_metadata_len = 16; umem_reg.flags = XDP_UMEM_TX_METADATA_LEN; setsockopt(sfd, SOL_XDP, XDP_UMEM_REG, &umem_reg, sizeof(umem_reg)); ...

   xsk_ring_prod__reserve(tq, batch_size, &idx);

   for (i = 0; i < nr_packets; ++i) {
           struct xdp_desc *tx_desc = xsk_ring_prod__tx_desc(tq, idx + i);
           tx_desc->addr = packets[i].addr;
           tx_desc->addr += umem->tx_metadata_len;
           tx_desc->options = XDP_TX_METADATA;
           tx_desc->len = UINT32_MAX;
   }

   xsk_ring_prod__submit(tq, nr_packets);
   ...
   sendto(sfd, NULL, 0, MSG_DONTWAIT, NULL, 0);

Found by InfoTeCS on behalf of Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: 341ac980eab9 ("xsk: Support tx_metadata_len") Cc: stable@vger.kernel.org Signed-off-by: Ilia Gavrilov Ilia.Gavrilov@infotecs.ru

---

v2: Add a repro net/xdp/xsk_queue.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/xdp/xsk_queue.h b/net/xdp/xsk_queue.h index f16f390370dc..b206a8839b39 100644 --- a/net/xdp/xsk_queue.h +++ b/net/xdp/xsk_queue.h @@ -144,7 +144,7 @@ static inline bool xp_aligned_validate_desc(struct xsk_buff_pool *pool, struct xdp_desc *desc) { u64 addr = desc->addr - pool->tx_metadata_len;

• u64 len = desc->len + pool->tx_metadata_len;

• u64 len = (u64)desc->len + pool->tx_metadata_len; u64 offset = addr & (pool->chunk_size - 1);

if (!desc->len) @@ -165,7 +165,7 @@ static inline bool xp_unaligned_validate_desc(struct xsk_buff_pool *pool, struct xdp_desc *desc) { u64 addr = xp_unaligned_add_offset_to_addr(desc->addr) - pool->tx_metadata_len;

• u64 len = desc->len + pool->tx_metadata_len;

• u64 len = (u64)desc->len + pool->tx_metadata_len;

if (!desc->len) return false;

Hi, Alexander, Magnus!

I'm sorry to bother you. Will this patch be applied or rejected?