kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-24 19:10:26 +00:00
Code Issues Releases Packages Activity
linux/net/xdp
History
Alexander Lobakin 1463cd066f xsk: Harden userspace-supplied xdp_desc validation 
commit 07ca98f906 upstream.

Turned out certain clearly invalid values passed in xdp_desc from
userspace can pass xp_{,un}aligned_validate_desc() and then lead
to UBs or just invalid frames to be queued for xmit.

desc->len close to ``U32_MAX`` with a non-zero pool->tx_metadata_len
can cause positive integer overflow and wraparound, the same way low
enough desc->addr with a non-zero pool->tx_metadata_len can cause
negative integer overflow. Both scenarios can then pass the
validation successfully.
This doesn't happen with valid XSk applications, but can be used
to perform attacks.

Always promote desc->len to ``u64`` first to exclude positive
overflows of it. Use explicit check_{add,sub}_overflow() when
validating desc->addr (which is ``u64`` already).

bloat-o-meter reports a little growth of the code size:

add/remove: 0/0 grow/shrink: 2/1 up/down: 60/-16 (44)
Function                                     old     new   delta
xskq_cons_peek_desc                          299     330     +31
xsk_tx_peek_release_desc_batch               973    1002     +29
xsk_generic_xmit                            3148    3132     -16

but hopefully this doesn't hurt the performance much.

Fixes: 341ac980ea ("xsk: Support tx_metadata_len")
Cc: stable@vger.kernel.org # 6.8+
Signed-off-by: Alexander Lobakin <aleksander.lobakin@intel.com>
Reviewed-by: Jason Xing <kerneljasonxing@gmail.com>
Reviewed-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com>
Link: https://lore.kernel.org/r/20251008165659.4141318-1-aleksander.lobakin@intel.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2025-10-19 16:33:53 +02:00
..
Kconfig treewide: Add SPDX license identifier - Makefile/Kconfig 2019-05-21 10:50:46 +02:00
Makefile xsk: Introduce AF_XDP buffer allocation API 2020-05-21 17:31:26 -07:00
xdp_umem.c xsk: Require XDP_UMEM_TX_METADATA_LEN to actuate tx_metadata_len 2024-07-25 11:57:27 +02:00
xdp_umem.h xsk: Fix umem cleanup bug at socket destruct 2020-11-20 15:52:39 +01:00
xsk.c xsk: Fix race condition in AF_XDP generic RX path 2025-05-09 09:50:38 +02:00
xsk.h xdp: Add proper __rcu annotations to redirect map entries 2021-06-24 19:41:15 +02:00
xsk_buff_pool.c xsk: Fix race condition in AF_XDP generic RX path 2025-05-09 09:50:38 +02:00
xsk_diag.c sock_diag: add module pointer to "struct sock_diag_handler" 2024-01-23 15:13:54 +01:00
xsk_queue.c xdp: Fix zero-size allocation warning in xskq_create() 2023-10-09 16:13:29 +02:00
xsk_queue.h xsk: Harden userspace-supplied xdp_desc validation 2025-10-19 16:33:53 +02:00
xskmap.c xsk: fix OOB map writes when deleting elements 2024-12-14 20:03:31 +01:00