netdev - Re: bpf: xdp: unhandled error in xdp_test_run_init

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <d0a58c79-eb85-41d2-bc17-7b507f57155a@linux.dev>
Date: Thu, 18 Dec 2025 10:26:14 -0800
From: Martin KaFai Lau <martin.lau@...ux.dev>
To: Toke Høiland-Jørgensen <toke@...hat.com>
Cc: "dzm91@...t.edu.cn" <dzm91@...t.edu.cn>, M202472210@...t.edu.cn,
 ast@...nel.org, daniel@...earbox.net, andrii@...nel.org, eddyz87@...il.com,
 song@...nel.org, yonghong.song@...ux.dev, john.fastabend@...il.com,
 kpsingh@...nel.org, sdf@...ichev.me, haoluo@...gle.com, jolsa@...nel.org,
 davem@...emloft.net, edumazet@...gle.com, kuba@...nel.org,
 pabeni@...hat.com, horms@...nel.org,
 hust-os-kernel-patches@...glegroups.com, netdev@...r.kernel.org,
 bpf@...r.kernel.org, Alexander Lobakin <aleksander.lobakin@...el.com>,
 Yinhao Hu <dddddd@...t.edu.cn>
Subject: Re: bpf: xdp: unhandled error in xdp_test_run_init_page() leads to
 crash


On 12/18/25 2:43 AM, Yinhao Hu wrote:
> Our fuzzer tool discovered a user-memory-access vulnerability in the BPF
> subsystem. The vulnerability is triggered when building an `sk_buff`
> from an XDP frame that has not been properly initialized due to an
> unhandled initialization failure, causing the kernel to access an
> invalid memory address.
> 
> Reported-by: Yinhao Hu <dddddd@...t.edu.cn>
> Reported-by: Kaiyan Mei <M202472210@...t.edu.cn>
> Reviewed-by: Dongliang Mu <dzm91@...t.edu.cn>
> 
> ## Root Cause
> 
> `xdp_test_run_setup()` attempts to create a `page_pool` with the page
> initialization callback `xdp_test_run_init_page()`.
> 
> During page initialization, `xdp_test_run_init_page()` calls
> `xdp_update_frame_from_buff()` to initialize an `xdp_frame`. However, if
> the available headroom in the associated `xdp_buff` is insufficient,
> `xdp_update_frame_from_buff()` returns an error. This error is not
> handled by `xdp_test_run_init_page()`, leaving the `xdp_frame`
> uninitialized.
> 
> Later, `xdp_test_run_batch()` retrieves this `xdp_frame` from the
> `page_pool`. Although it may attempt to partially reinitialize the frame
> via `reset_ctx()`, the failure from `xdp_update_frame_from_buff()` is
> still ignored.
> 
> Finally, `__xdp_build_skb_from_frame()` attempts to construct an
> `sk_buff` from the uninitialized `xdp_frame`. It reads uninitialized
> members (e.g., `data`, `headroom`, `frame_sz`) to compute a `hard_start`
> address, which is then passed to `build_skb_around()`. The underlying
> `__build_skb_around()` attempts to write to this invalid address,
> resulting in a kernel crash.
> 
> ## Execution Flow Visualization
> 
> ```
> Vulnerability Execution Flow
> |
> |--- 1. An XDP program is loaded with act XDP_PASS
> |
> |--- 2. `bpf(BPF_PROG_TEST_RUN, ...)` Syscall Execution
> |    |
> |    `-- bpf_test_run_xdp_live
> |        |
> |        `-- xdp_test_run_setup
> |        |   |
> |        |   `--> page_pool_create() with init callback
> xdp_test_run_init_page()
> |        |         |
> |        |         `--> xdp_update_frame_from_buff() may fail, but error
> is ignored, leaving xdp_frame uninitialized
> |        |
> |        `-- xdp_test_run_batch
> |             |
> |             |--> page_pool_dev_alloc_pages() returns page with
> uninitialized xdp_frame
> |             |
> |             `--> xdp_recv_frames
> |                   |
> |                   |--> __xdp_build_skb_from_frame() reads
> uninitialized xdpf members, computes invalid hard_start address, passes
> it to build_skb_around()
> |                   |
> |                   `--> __build_skb_around() writes to invalid address
> -> CRASH
> ```
> 

This looks a legit issue. Toke, please help to take a look.