Re: [PATCH bpf-next v4 5/6] selftests/bpf: Add bpf_xdp_metadata_rx_checksum support to xdp_hw_metadat prog

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] Addition of fields to `struct xdp_meta` changes its size from 32 bytes to 44 bytes, causing an alignment-induced offset mismatch between 64-bit BPF programs and 32-bit userspace architectures.
--

--- Patch [5]: [PATCH bpf-next v4 5/6] selftests/bpf: Add bpf_xdp_metadata_rx_checksum support to xdp_hw_metadat prog ---
commit 1839c76747e10e7e5dc96d9eb03c1675cdf0e646
Author: Lorenzo Bianconi <lorenzo@kernel.org>

selftests/bpf: Add bpf_xdp_metadata_rx_checksum support to xdp_hw_metadat prog

This patch introduces the capability to dump the HW rx checksum in the
xdp_hw_metadata program. It achieves this by using the new
bpf_xdp_metadata_rx_checksum() kfunc.

> diff --git a/tools/testing/selftests/bpf/xdp_metadata.h b/tools/testing/selftests/bpf/xdp_metadata.h
> index bca09b94af261..f864d4a8bd8c6 100644
> --- a/tools/testing/selftests/bpf/xdp_metadata.h
> +++ b/tools/testing/selftests/bpf/xdp_metadata.h
[ ... ]
> @@ -52,10 +53,13 @@ struct xdp_meta {
>  		};
>  		__s32 rx_vlan_tag_err;
>  	};
> -	struct {
> -		__u32 ip_summed;
> -		__u32 cksum;
> -		__u8 cksum_level;
> +	union {
> +		struct {
> +			__u32 ip_summed;
> +			__u32 cksum;
> +			__u8 cksum_level;
> +		};
> +		__s32 rx_cksum_err;
>  	};
>  	enum xdp_meta_field hint_valid;
>  };

[Severity: Medium]
Does this change create an alignment mismatch between the 64-bit BPF program
and 32-bit userspace architectures?

The addition of these fields changes the size of struct xdp_meta to 44 bytes.
On a 32-bit x86 system, the __u64 fields earlier in the struct require only
4-byte alignment, keeping the userspace struct size at exactly 44 bytes.
However, the BPF program runs in a 64-bit context where __u64 requires 8-byte
alignment, causing the compiler to pad the struct to 48 bytes.

When verify_xdp_metadata() is called in userspace:

    meta = data - sizeof(*meta);

Userspace will subtract 44 bytes from the packet data pointer, while the
BPF program actually placed it at data - 48. Could this shift all metadata
reads by 4 bytes on 32-bit platforms, leading to incorrect results and
metadata corruption?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260708203410.45121-1-deliran@verdict.gg?part=5