Re: [RFC net-next 01/15] xdp: Size zero-copy skb heads by their contents

[Björn Töpel]

Maciej Fijalkowski <maciej.fijalkowski@xxxxxxxxx> writes:

> On Fri, Oct 02, 2026 at 09:00:02PM +0200, Björn Töpel wrote:
>> xdp_build_skb_from_zc() sizes the skb head by the XSK frame size,
>> which leaves no room for skb_shared_info. With 2 KiB chunks, a
>> 1514 byte frame overwrites 48 bytes of it. Both copies also round
>> the length up to LARGEST_ALIGN, past the end of the new buffers.
>> 
>> Size the head from headroom plus data, copy exactly the data, and
>> drop frames whose head does not fit in a page.
>> 
>> Discovered by an AI code review agent. Reproduced on fbnic in QEMU
>> with AF_XDP zero-copy from the page-pool series: an XDP program that
>> adds metadata, grows the frame to its end and passes it gets UMEM
>> bytes in the skb's shared info. A new xskxceiver test,
>> XDP_PASS_FULL_FRAME, checks this and passes with the fix. The test
>> will be posted separately.
>> 
>> Fixes: 560d958c6c68 ("xsk: add generic XSk &xdp_buff -> skb conversion")
>> Signed-off-by: Björn Töpel <bjorn@xxxxxxxxxx>
>
> Late on the ball here, but I believe this is the case Clement reported and
> we rejected it as the reproducer was OOT module.
>
> https://lore.kernel.org/bpf/20260629072300.1664622-1-clecigne@xxxxxxxxxx/
>
> Should we proceed with Clement's fix then?

I'll wake that thread up!

Björn