Re: [PATCH net-next v3 11/13] net: lan966x: add PCIe FDMA XDP support

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Critical] Out-of-bounds memory access due to incorrect XDP `data_hard_start` calculation.
--

commit a924fb52292b32258a27064e54f04210cd1ffa58
Author: Daniel Machon <daniel.machon@microchip.com>

net: lan966x: add PCIe FDMA XDP support

This commit adds XDP support for the PCIe FDMA path. The implementation
operates on contiguous ATU-mapped buffers with memcpy-based XDP_TX, unlike
the platform path which uses page_pool.

> diff --git a/drivers/net/ethernet/microchip/lan966x/lan966x_fdma_pci.c b/drivers/net/ethernet/microchip/lan966x/lan966x_fdma_pci.c
> index 491ddc337760..48ed5aeb1aff 100644
> --- a/drivers/net/ethernet/microchip/lan966x/lan966x_fdma_pci.c
> +++ b/drivers/net/ethernet/microchip/lan966x/lan966x_fdma_pci.c
[ ... ]
> @@ -107,7 +109,118 @@ static bool lan966x_fdma_pci_tx_size_fits(struct fdma *fdma, u32 len)
[ ... ]
> +static int lan966x_xdp_pci_run(struct lan966x_port *port, void *data,
> +			       u32 data_len, void **xdp_data, u32 *xdp_len)
> +{
[ ... ]
> +	xdp_init_buff(&xdp, fdma->db_size, &port->xdp_rxq);
> +
> +	/* Headroom includes the IFH; BPF may grow into it via adjust_head.
> +	 * The IFH is rebuilt on XDP_TX and unread on XDP_PASS.
> +	 */
> +	xdp_prepare_buff(&xdp,
> +			 data - XDP_PACKET_HEADROOM,
> +			 XDP_PACKET_HEADROOM + IFH_LEN_BYTES,
> +			 data_len,
> +			 false);

Does this calculate an out-of-bounds pointer for the hard_start?

Looking at lan966x_fdma_pci_rx_check_frame(), the data parameter passed here
is virt_addr, which is retrieved via fdma_dataptr_virt_addr_contiguous().
This pointer represents the start of the DMA-mapped database block.

If data is the start of the allocated buffer, subtracting XDP_PACKET_HEADROOM
would set xdp->data_hard_start to point 256 bytes before the allocated memory.

If an XDP program calls bpf_xdp_adjust_head() to prepend headers, could this
allow it to overwrite adjacent memory, such as the preceding DMA database
block or hardware DCB descriptors?

> +
> +	act = bpf_prog_run_xdp(xdp_prog, &xdp);

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260504-lan966x-pci-fdma-v3-0-a56f5740d870@microchip.com?part=11