]> git.ipfire.org Git - thirdparty/kernel/linux.git/commitdiff
Merge branch 'xsk-harden-tx-metadata-validation-against-races'
authorJakub Kicinski <kuba@kernel.org>
Mon, 3 Aug 2026 23:43:56 +0000 (16:43 -0700)
committerJakub Kicinski <kuba@kernel.org>
Mon, 3 Aug 2026 23:43:56 +0000 (16:43 -0700)
Stanislav Fomichev says:

====================
xsk: harden TX metadata validation against races

Cen Zhang reported a KASAN out-of-bounds read when AF_XDP is configured
with a TX metadata area smaller than struct xsk_tx_metadata. The metadata
is also shared with user space, so reading its flags more than once can
produce inconsistent validation and processing decisions.

Require enough space for the flags and one request field, validate the
launch-time field against the configured metadata length, and use one
snapshot of the flags while processing each request. Carry the validated
decision through completion handling so later user-space changes cannot
enable an unrequested completion timestamp.

Reported-by: AutonomousCodeSecurity@microsoft.com
Reported-by: Cen Zhang (Microsoft) <blbllhy@gmail.com>
Link: https://lore.kernel.org/netdev/20260720155210.34229-1-blbllhy@gmail.com/
====================

Link: https://patch.msgid.link/20260727161959.885642-1-sdf@fomichev.me
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

Trivial merge