xdp_umem_reg() validates tx_metadata_len for upper bound (<256) and alignment (%8) but not a lower bound. xsk_skb_metadata() computes meta = buffer - pool->tx_metadata_len then unconditionally accesses the full 24-byte struct xsk_tx_metadata, so any value less than sizeof(struct xsk_tx_metadata) allows an out-of-bounds read. KASAN reports this as: BUG: KASAN: vmalloc-out-of-bounds in xsk_skb_metadata+0x4b2/0x500 Read of size 8 at addr ffffc90000f11000 by task exploit/148 xsk_skb_metadata (net/xdp/xsk.c:837) xsk_build_skb (net/xdp/xsk.c) __xsk_generic_xmit (net/xdp/xsk.c) xsk_sendmsg (net/xdp/xsk.c) Add a lower-bound check in xdp_umem_reg() to reject tx_metadata_len values that cannot cover the full metadata struct. Fixes: 341ac980eab9 ("xsk: Support tx_metadata_len") Reported-by: AutonomousCodeSecurity@microsoft.com Signed-off-by: Cen Zhang (Microsoft) --- net/xdp/xdp_umem.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/xdp/xdp_umem.c b/net/xdp/xdp_umem.c index 58da2f4f4397..d16ad9d8f919 100644 --- a/net/xdp/xdp_umem.c +++ b/net/xdp/xdp_umem.c @@ -208,7 +208,8 @@ static int xdp_umem_reg(struct xdp_umem *umem, struct xdp_umem_reg *mr) return -EINVAL; if (mr->flags & XDP_UMEM_TX_METADATA_LEN) { - if (mr->tx_metadata_len >= 256 || mr->tx_metadata_len % 8) + if (mr->tx_metadata_len < sizeof(struct xsk_tx_metadata) || + mr->tx_metadata_len >= 256 || mr->tx_metadata_len % 8) return -EINVAL; umem->tx_metadata_len = mr->tx_metadata_len; } -- 2.53.0