linux-kernel - Re: [lvc-project] [PATCH net v2] xsk: Fix overflow in descriptor validation

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <2a261520-1d86-43d6-af56-7c5f9366c76b@intel.com>
Date: Wed, 15 Oct 2025 12:25:42 +0200
From: Alexander Lobakin <aleksander.lobakin@...el.com>
To: Ilia Gavrilov <Ilia.Gavrilov@...otecs.ru>
CC: Magnus Karlsson <magnus.karlsson@...el.com>, Song Yoong Siang
	<yoong.siang.song@...el.com>, Maciej Fijalkowski
	<maciej.fijalkowski@...el.com>, Jesper Dangaard Brouer <hawk@...nel.org>,
	Daniel Borkmann <daniel@...earbox.net>, "netdev@...r.kernel.org"
	<netdev@...r.kernel.org>, John Fastabend <john.fastabend@...il.com>, "Alexei
 Starovoitov" <ast@...nel.org>, "stable@...r.kernel.org"
	<stable@...r.kernel.org>, "linux-kernel@...r.kernel.org"
	<linux-kernel@...r.kernel.org>, Eric Dumazet <edumazet@...gle.com>,
	"Stanislav Fomichev" <sdf@...ichev.me>, Simon Horman <horms@...nel.org>,
	Jakub Kicinski <kuba@...nel.org>, "bpf@...r.kernel.org"
	<bpf@...r.kernel.org>, Paolo Abeni <pabeni@...hat.com>, "David S. Miller"
	<davem@...emloft.net>, "lvc-project@...uxtesting.org"
	<lvc-project@...uxtesting.org>
Subject: Re: [lvc-project] [PATCH net v2] xsk: Fix overflow in descriptor
 validation

From: Ilia Gavrilov <Ilia.Gavrilov@...otecs.ru>
Date: Wed, 15 Oct 2025 08:12:20 +0000

> On 10/7/25 17:06, Ilia Gavrilov wrote:
>> The desc->len value can be set up to U32_MAX. If umem tx_metadata_len
>> option is also set, the value of the expression
>> 'desc->len + pool->tx_metadata_len' can overflow and validation
>> of the incorrect descriptor will be successfully passed.
>> This can lead to a subsequent chain of arithmetic overflows
>> in the xsk_build_skb() function and incorrect sk_buff allocation.
>>
>> To reproduce the overflow, this piece of userspace code can be used:
>>        struct xdp_umem_reg umem_reg;
>>        umem_reg.addr = (__u64)(void *)umem;
>>        ...
>>        umem_reg.chunk_size = 4096;
>>        umem_reg.tx_metadata_len = 16;
>>        umem_reg.flags = XDP_UMEM_TX_METADATA_LEN;
>>        setsockopt(sfd, SOL_XDP, XDP_UMEM_REG, &umem_reg, sizeof(umem_reg));
>>        ...
>>
>>        xsk_ring_prod__reserve(tq, batch_size, &idx);
>>
>>        for (i = 0; i < nr_packets; ++i) {
>>                struct xdp_desc *tx_desc = xsk_ring_prod__tx_desc(tq, idx + i);
>>                tx_desc->addr = packets[i].addr;
>>                tx_desc->addr += umem->tx_metadata_len;
>>                tx_desc->options = XDP_TX_METADATA;
>>                tx_desc->len = UINT32_MAX;
>>        }
>>
>>        xsk_ring_prod__submit(tq, nr_packets);
>>        ...
>>        sendto(sfd, NULL, 0, MSG_DONTWAIT, NULL, 0);
>>
>> Found by InfoTeCS on behalf of Linux Verification Center
>> (linuxtesting.org) with SVACE.
>>
>> Fixes: 341ac980eab9 ("xsk: Support tx_metadata_len")
>> Cc: stable@...r.kernel.org
>> Signed-off-by: Ilia Gavrilov <Ilia.Gavrilov@...otecs.ru>
>> ---
>> v2: Add a repro
>>  net/xdp/xsk_queue.h | 4 ++--
>>  1 file changed, 2 insertions(+), 2 deletions(-)
>>
>> diff --git a/net/xdp/xsk_queue.h b/net/xdp/xsk_queue.h
>> index f16f390370dc..b206a8839b39 100644
>> --- a/net/xdp/xsk_queue.h
>> +++ b/net/xdp/xsk_queue.h
>> @@ -144,7 +144,7 @@ static inline bool xp_aligned_validate_desc(struct xsk_buff_pool *pool,
>>  					    struct xdp_desc *desc)
>>  {
>>  	u64 addr = desc->addr - pool->tx_metadata_len;
>> -	u64 len = desc->len + pool->tx_metadata_len;
>> +	u64 len = (u64)desc->len + pool->tx_metadata_len;
>>  	u64 offset = addr & (pool->chunk_size - 1);
>>  
>>  	if (!desc->len)
>> @@ -165,7 +165,7 @@ static inline bool xp_unaligned_validate_desc(struct xsk_buff_pool *pool,
>>  					      struct xdp_desc *desc)
>>  {
>>  	u64 addr = xp_unaligned_add_offset_to_addr(desc->addr) - pool->tx_metadata_len;
>> -	u64 len = desc->len + pool->tx_metadata_len;
>> +	u64 len = (u64)desc->len + pool->tx_metadata_len;
>>  
>>  	if (!desc->len)
>>  		return false;
> 
> Hi, Alexander, Magnus!
> 
> I'm sorry to bother you.
> Will this patch be applied or rejected?

Hey,

We took a different solution: [0]

[0]
https://web.git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=07ca98f906a403637fc5e513a872a50ef1247f3b

Thanks,
Olek