netdev - Re: net/xdp: Potential issue with xp_aligned_validate

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <aYKo-YeGpsl8ngeK@mini-arch>
Date: Tue, 3 Feb 2026 18:03:37 -0800
From: Stanislav Fomichev <stfomichev@...il.com>
To: "Rao, Nikhil" <nikhirao@....com>
Cc: magnus.karlsson@...el.com, maciej.fijalkowski@...el.com,
	sdf@...ichev.me, netdev@...r.kernel.org
Subject: Re: net/xdp: Potential issue with xp_aligned_validate_desc() in
 multi-buffer packets

On 02/03, Rao, Nikhil wrote:
> Hi XDP maintainers,
> 
> I have noticed a potential issue with multi-buffer packet support in the
> xp_aligned_validate_desc() function in net/xdp/xsk_queue.h.
> 
> In xp_aligned_validate_desc(), the validation always adjusts the address
> and length by pool->tx_metadata_len:
> 
>   u64 addr = desc->addr - pool->tx_metadata_len;
>   u64 len = desc->len + pool->tx_metadata_len;
> 
> However, in multi-buffer XDP packets, only the first descriptor contains
> TX metadata. Subsequent descriptors do not have
> metadata and should not be validated with this adjustment.
> 
> This causes validation failures for the 2nd buffer onward in
> multi-buffer packets when TX metadata is enabled.
> 
> The same issue exists in xp_unaligned_validate_desc() as well.
> 
> I'm happy to submit a patch if this is indeed a bug. Please let me know
> your thoughts.

I think your assessment is correct. Can you try to extend
prog_tests/xdp_metadata.c to send a mbuf packet? I don't think we have
any real test coverage for the metadata+mbuf..