netdev - Re: [PATCH] bpf: cpumap: report queue_index to xdp_rxq

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <718d0ad2565e1df204d3d73cc8130f7a37527e056affe7f3637f2898fb886c8f@mail.kernel.org>
Date: Wed, 14 Jan 2026 02:44:20 +0000 (UTC)
From: bot+bpf-ci@...nel.org
To: saiaunghlyanhtet2003@...il.com,bpf@...r.kernel.org
Cc: ast@...nel.org,daniel@...earbox.net,john.fastabend@...il.com,netdev@...r.kernel.org,saiaunghlyanhtet2003@...il.com,ast@...nel.org,andrii@...nel.org,daniel@...earbox.net,martin.lau@...nel.org,eddyz87@...il.com,yonghong.song@...ux.dev,clm@...a.com,ihor.solodrai@...ux.dev
Subject: Re: [PATCH] bpf: cpumap: report queue_index to xdp_rxq_info

> diff --git a/include/net/xdp.h b/include/net/xdp.h
> index aa742f413c35..feafeed327a2 100644
> --- a/include/net/xdp.h
> +++ b/include/net/xdp.h

[ ... ]

> @@ -421,6 +422,7 @@ int xdp_update_frame_from_buff(const struct xdp_buff *xdp,
>  	xdp_frame->metasize = metasize;
>  	xdp_frame->frame_sz = xdp->frame_sz;
>  	xdp_frame->flags = xdp->flags;
> +	xdp_frame->queue_index = xdp->rxq->queue_index;
>
>  	return 0;
>  }

The new assignment unconditionally writes queue_index from xdp->rxq to the
frame. Several callers of xdp_update_frame_from_buff() do not set up
rxq.queue_index, which means they will write incorrect values.

In dev_map_bpf_prog_run() (kernel/bpf/devmap.c):

    struct xdp_rxq_info rxq = { .dev = rx_dev };
    ...
    xdp.rxq = &rxq;
    ...
    err = xdp_update_frame_from_buff(&xdp, xdpf);

The local rxq has queue_index implicitly set to 0, so any frame passing
through devmap with XDP_PASS will have its queue_index overwritten to 0.
Should devmap also preserve queue_index similar to cpumap, perhaps like:

    rxq.queue_index = xdpf->queue_index;

In veth_xdp_rcv_one() (drivers/net/veth.c):

    xdp_convert_frame_to_buff(frame, xdp);
    xdp->rxq = &rq->xdp_rxq;
    ...
    if (xdp_update_frame_from_buff(xdp, frame))

Here the frame's queue_index will be overwritten with veth's own queue
index, not the original source queue. Is this intended behavior?

Additionally, xdp_convert_zc_to_xdp_frame() in net/core/xdp.c creates
frames for XSK buff pool memory but does not set queue_index:

    xdpf = addr;
    memset(xdpf, 0, sizeof(*xdpf));
    ...
    xdpf->frame_sz = PAGE_SIZE;
    xdpf->mem_type = MEM_TYPE_PAGE_ORDER0;
    /* queue_index not set, remains 0 from memset */

Should this also copy xdp->rxq->queue_index to maintain consistency with
the regular conversion path?

---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md

CI run summary: https://github.com/kernel-patches/bpf/actions/runs/20980088225