]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
Merge branch 'xsk-harden-tx-metadata-validation-against-races'
authorJakub Kicinski <kuba@kernel.org>
Mon, 3 Aug 2026 23:43:56 +0000 (16:43 -0700)
committerJakub Kicinski <kuba@kernel.org>
Mon, 3 Aug 2026 23:43:56 +0000 (16:43 -0700)
commit5243c3e3ad20d879d89f533198ee1c50506182ff
tree570c3ba37fe1fe96599ad74875129479dfb741e6
parentd5c5ecea1fb4ed0c32d639c023a64e906e038bc3
parent849b1664dbda1cf6c63e0fd4f9dec23782b8c851
Merge branch 'xsk-harden-tx-metadata-validation-against-races'

Stanislav Fomichev says:

====================
xsk: harden TX metadata validation against races

Cen Zhang reported a KASAN out-of-bounds read when AF_XDP is configured
with a TX metadata area smaller than struct xsk_tx_metadata. The metadata
is also shared with user space, so reading its flags more than once can
produce inconsistent validation and processing decisions.

Require enough space for the flags and one request field, validate the
launch-time field against the configured metadata length, and use one
snapshot of the flags while processing each request. Carry the validated
decision through completion handling so later user-space changes cannot
enable an unrequested completion timestamp.

Reported-by: AutonomousCodeSecurity@microsoft.com
Reported-by: Cen Zhang (Microsoft) <blbllhy@gmail.com>
Link: https://lore.kernel.org/netdev/20260720155210.34229-1-blbllhy@gmail.com/
====================

Link: https://patch.msgid.link/20260727161959.885642-1-sdf@fomichev.me
Signed-off-by: Jakub Kicinski <kuba@kernel.org>