Re: [PATCH 2/2] selftests/bpf: validate rx_queue_index in xdp_metadata

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
- [High] ABI / Struct Layout Mismatch on 32-bit platforms
- [Medium] Uninitialized Memory Leak in `xdp_hw_metadata` BPF Program
--

commit 601fd9ffcc49bcd779869ed0a9069b48be1a4a14
Author: Siddharth_Cibi <siddharthcibi@icloud.com>

selftests/bpf: validate rx_queue_index in xdp_metadata

This commit extends the xdp_metadata selftest to validate that
rx_queue_index is preserved after an XDP redirect. It captures the
queue index in the metadata and asserts it matches the expected queue ID.

> diff --git a/tools/testing/selftests/bpf/xdp_metadata.h b/tools/testing/selftests/bpf/xdp_metadata.h
> index 87318ad1117a1..1f0ae4c00091b 100644
> --- a/tools/testing/selftests/bpf/xdp_metadata.h
> +++ b/tools/testing/selftests/bpf/xdp_metadata.h
> @@ -49,4 +49,5 @@ struct xdp_meta {
>  		__s32 rx_vlan_tag_err;
>  	};
>  	enum xdp_meta_field hint_valid;
> +	__u32 rx_queue_index;
>  };

[Severity: High]
Will adding this 4-byte field without explicit padding cause an ABI layout
mismatch between 64-bit BPF programs and 32-bit user-space test environments?

On 64-bit architectures, the __u64 members force the struct alignment to
8 bytes, causing the compiler to implicitly pad the struct size to 40 bytes.
However, on 32-bit architectures like i386, __u64 only requires 4-byte
alignment, meaning the struct size remains exactly 36 bytes.

When verify_xsk_metadata() calculates the user-space pointer:

    meta = data - sizeof(struct xdp_meta);

Could this subtract 36 bytes instead of the 40 bytes reserved by the BPF
program on 32-bit platforms, shifting all metadata fields and causing the
user-space program to read corrupted values?

[Severity: Medium]
Does increasing the size of this struct expose uninitialized memory in
the xdp_hw_metadata BPF program?

Because struct xdp_meta is shared, xdp_hw_metadata.c now allocates more
headroom via bpf_xdp_adjust_meta().

Since xdp_hw_metadata.c wasn't updated to initialize rx_queue_index or
the new implicit padding, does this leave uninitialized packet headroom
memory exposed to user space via the AF_XDP socket?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260619195759.41254-1-siddharthcibi@icloud.com?part=2