Re: [PATCH net v2] xsk: reject undersized tx_metadata at runtime validation

[Stanislav Fomichev]

On 07/24, Alexander Lobakin wrote:
> From: Stanislav Fomichev <sdf.kernel@xxxxxxxxx>
> Date: Thu, 23 Jul 2026 10:15:15 -0700
> 
> > On 07/23, Alexander Lobakin wrote:
> >> From: Stanislav Fomichev <sdf.kernel@xxxxxxxxx>
> >> Date: Wed, 22 Jul 2026 10:55:17 -0700
> >>
> >>> On 07/22, Cen Zhang (Microsoft) wrote:
> >>>> There is no metadata length check before accessing struct xsk_tx_metadata
> >>>> fields in both xdp_umem_reg() (registration) and
> >>>> xsk_buff_valid_tx_metadata() (runtime).  Thus, an invalid small
> >>>> tx_metadata_len (e.g. 8 bytes) passes registration and later causes an
> >>>> out-of-bounds read when xsk_skb_metadata() accesses fields beyond the
> >>>> declared metadata region.
> >>
> >> [...]
> >>
> >>> @@ -773,7 +773,7 @@ struct xdp_desc_ctx xp_raw_get_ctx(const struct xsk_buff_pool *pool, u64 addr)
> >>>  	addr = __xp_raw_get_addr(pool, addr);
> >>>  
> >>>  	ret.dma = __xp_raw_get_dma(pool, addr);
> >>> -	ret.meta = __xsk_buff_get_metadata(pool, __xp_raw_get_data(pool, addr));
> >>> +	xsk_buff_read_metadata(pool, addr, &ret.meta);
> >>
> >> That effectively disables some micro-optimizations that were the reason
> >> I created this helper -- __xp_raw_get_data() is inline, while
> >> xsk_buff_read_metadata() uses the external version, probably some other
> >> stuff (note the underscored __xsk_buff_get_metadata()) =\ This function
> >> expanded to have no external calls on clang -O2, with this patch I'm not
> >> sure it would.
> > 
> > Any better ideas on how to solve it? I can convert all non libeth stuff
> > to these new xsk_buff_read_metadata helpers and keep xp_raw_get_ctx
> > to you? Will that work?
> 
> Sure, I can take a look.
> 
> Do you want me to pick this patch as a base or you'd like to send a new rev?

I have an idea on how to keep the existing pointer (instead of introducing a
copy). Let me play with it today, will send something hopefully Monday..