[PATCH bpf v2] veth: convert frag_list skbs before running XDP

[PATCH bpf v2] veth: convert frag_list skbs before running XDP

[Matt Fleming]

From: Matt Fleming <mfleming@cloudflare.com>

A frag_list skb can reach veth with data_len set but nr_frags zero.
veth_convert_skb_to_xdp_buff() only converts skbs that are shared,
locked, have frags[], or do not have enough headroom. It later uses
skb_is_nonlinear() to decide whether to set XDP_FLAGS_HAS_FRAGS and
xdp_frags_size.

That exposes frag_list data to XDP as if it were stored in frags[], but
frags[] is empty. AF_XDP copy mode can then trust the bogus XDP fragment
metadata, walk an empty fragment entry, and crash in memcpy() from
__xsk_rcv().

Route non-linear skbs through skb_pp_cow_data() before exposing them to
XDP, and only advertise XDP frags when the resulting skb has frags[].
skb_copy_bits() already handles frag_list input, and skb_pp_cow_data()
builds frags[] output with skb_add_rx_frag(), which is the
representation XDP multi-buffer expects.

Fixes: 718a18a0c8a6 ("veth: Rework veth_xdp_rcv_skb in order to accept non-linear skb")
Cc: stable@vger.kernel.org
Signed-off-by: Matt Fleming <mfleming@cloudflare.com>
---
Changes in v2:
- Use skb_is_nonlinear() in veth_convert_skb_to_xdp_buff().
- Move the skb_pp_cow_data() comment into kerneldoc.

 drivers/net/veth.c |  4 ++--
 net/core/skbuff.c  | 16 ++++++++++------
 2 files changed, 12 insertions(+), 8 deletions(-)

diff --git a/drivers/net/veth.c b/drivers/net/veth.c
index 1c5142149175..00e34afd858e 100644
--- a/drivers/net/veth.c
+++ b/drivers/net/veth.c
@@ -756,7 +756,7 @@ static int veth_convert_skb_to_xdp_buff(struct veth_rq *rq,
 	u32 frame_sz;
 
 	if (skb_shared(skb) || skb_head_is_locked(skb) ||
-	    skb_shinfo(skb)->nr_frags ||
+	    skb_is_nonlinear(skb) ||
 	    skb_headroom(skb) < XDP_PACKET_HEADROOM) {
 		if (skb_pp_cow_data(rq->page_pool, pskb, XDP_PACKET_HEADROOM))
 			goto drop;
@@ -771,7 +771,7 @@ static int veth_convert_skb_to_xdp_buff(struct veth_rq *rq,
 	xdp_prepare_buff(xdp, skb->head, skb_headroom(skb),
 			 skb_headlen(skb), true);
 
-	if (skb_is_nonlinear(skb)) {
+	if (skb_shinfo(skb)->nr_frags) {
 		skb_shinfo(skb)->xdp_frags_size = skb->data_len;
 		xdp_buff_set_frags_flag(xdp);
 	} else {
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 18dabb4e9cfa..66f57131633a 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -927,6 +927,16 @@ static void skb_clone_fraglist(struct sk_buff *skb)
 		skb_get(list);
 }
 
+/**
+ * skb_pp_cow_data() - copy skb data into page-pool backed storage
+ * @pool: page pool to allocate from
+ * @pskb: pointer to skb pointer, replaced with the copied skb on success
+ * @headroom: headroom to reserve in the copied skb
+ *
+ * skb_copy_bits() handles both frags[] and frag_list input. If the copied
+ * skb remains non-linear, it uses frags[], which is the representation used
+ * by XDP multi-buffer.
+ */
 int skb_pp_cow_data(struct page_pool *pool, struct sk_buff **pskb,
 		    unsigned int headroom)
 {
@@ -936,12 +946,6 @@ int skb_pp_cow_data(struct page_pool *pool, struct sk_buff **pskb,
 	int err, i, head_off;
 	void *data;
 
-	/* XDP does not support fraglist so we need to linearize
-	 * the skb.
-	 */
-	if (skb_has_frag_list(skb))
-		return -EOPNOTSUPP;
-
 	max_head_size = SKB_WITH_OVERHEAD(PAGE_SIZE - headroom);
 	if (skb->len > max_head_size + MAX_SKB_FRAGS * PAGE_SIZE)
 		return -ENOMEM;
-- 
2.43.0

Re: [PATCH bpf v2] veth: convert frag_list skbs before running XDP

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [Critical] veth_xdp_rcv_skb() fails to adjust skb->len when an XDP program modifies fragment lengths, causing state desynchronization.
--

--- Patch [1]: [PATCH bpf v2] veth: convert frag_list skbs before running XDP ---
commit c3ece024a1663f1b10d53a17f59581af7993ec1f
Author: Matt Fleming <mfleming@cloudflare.com>

veth: convert frag_list skbs before running XDP
    
A frag_list skb can reach veth with data_len set but nr_frags zero.
This patch routes non-linear skbs through skb_pp_cow_data() before exposing
them to XDP, preventing a crash in AF_XDP copy mode.

> diff --git a/drivers/net/veth.c b/drivers/net/veth.c
> index 1c51421491753..00e34afd858e7 100644
> --- a/drivers/net/veth.c
> +++ b/drivers/net/veth.c

[ ... ]

> @@ -771,7 +771,7 @@ static int veth_convert_skb_to_xdp_buff(struct veth_rq *rq,
>  	xdp_prepare_buff(xdp, skb->head, skb_headroom(skb),
>  			 skb_headlen(skb), true);
>  
> -	if (skb_is_nonlinear(skb)) {
> +	if (skb_shinfo(skb)->nr_frags) {
>  		skb_shinfo(skb)->xdp_frags_size = skb->data_len;
>  		xdp_buff_set_frags_flag(xdp);
>  	} else {

[Severity: Critical]
This is a pre-existing issue, but while reviewing the XDP fragment changes, I
noticed a potential state desynchronization in veth_xdp_rcv_skb() when handling
XDP tail adjustments.

When a fragmented packet is received and an attached XDP program calls
bpf_xdp_adjust_tail() to shrink or grow the packet, veth_xdp_rcv_skb() updates
skb->data_len:

drivers/net/veth.c:veth_xdp_rcv_skb() {
    ...
	/* XDP frag metadata (e.g. nr_frags) are updated in eBPF helpers
	 * (e.g. bpf_xdp_adjust_tail), we need to update data_len here.
	 */
	if (xdp_buff_has_frags(xdp))
		skb->data_len = skb_shinfo(skb)->xdp_frags_size;
	else
		skb->data_len = 0;
    ...
}

Does skb->len also need to be updated with the corresponding delta when
skb->data_len is modified?

If skb->len isn't updated alongside skb->data_len, could skb_headlen()
evaluate to a size larger than the actual linear buffer? If the tail is
shrunk, this desynchronization might lead to out-of-bounds reads or writes
past the allocated linear memory during subsequent network stack processing.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260720140545.461747-1-matt@readmodwrite.com?part=1

Re: [PATCH bpf v2] veth: convert frag_list skbs before running XDP

[Toke Høiland-Jørgensen]

On 20 July 2026 16.05.45 CEST, Matt Fleming <matt@readmodwrite.com> wrote:
>From: Matt Fleming <mfleming@cloudflare.com>
>
>A frag_list skb can reach veth with data_len set but nr_frags zero.
>veth_convert_skb_to_xdp_buff() only converts skbs that are shared,
>locked, have frags[], or do not have enough headroom. It later uses
>skb_is_nonlinear() to decide whether to set XDP_FLAGS_HAS_FRAGS and
>xdp_frags_size.
>
>That exposes frag_list data to XDP as if it were stored in frags[], but
>frags[] is empty. AF_XDP copy mode can then trust the bogus XDP fragment
>metadata, walk an empty fragment entry, and crash in memcpy() from
>__xsk_rcv().
>
>Route non-linear skbs through skb_pp_cow_data() before exposing them to
>XDP, and only advertise XDP frags when the resulting skb has frags[].
>skb_copy_bits() already handles frag_list input, and skb_pp_cow_data()
>builds frags[] output with skb_add_rx_frag(), which is the
>representation XDP multi-buffer expects.
>
>Fixes: 718a18a0c8a6 ("veth: Rework veth_xdp_rcv_skb in order to accept non-linear skb")
>Cc: stable@vger.kernel.org
>Signed-off-by: Matt Fleming <mfleming@cloudflare.com>

Reviewed-by: Toke Høiland-Jørgensen <toke@toke.dk>

Re: [PATCH bpf v2] veth: convert frag_list skbs before running XDP

[Lorenzo Bianconi]

[-- Attachment #1: Type: text/plain, Size: 3615 bytes --]

> From: Matt Fleming <mfleming@cloudflare.com>
> 
> A frag_list skb can reach veth with data_len set but nr_frags zero.
> veth_convert_skb_to_xdp_buff() only converts skbs that are shared,
> locked, have frags[], or do not have enough headroom. It later uses
> skb_is_nonlinear() to decide whether to set XDP_FLAGS_HAS_FRAGS and
> xdp_frags_size.
> 
> That exposes frag_list data to XDP as if it were stored in frags[], but
> frags[] is empty. AF_XDP copy mode can then trust the bogus XDP fragment
> metadata, walk an empty fragment entry, and crash in memcpy() from
> __xsk_rcv().
> 
> Route non-linear skbs through skb_pp_cow_data() before exposing them to
> XDP, and only advertise XDP frags when the resulting skb has frags[].
> skb_copy_bits() already handles frag_list input, and skb_pp_cow_data()
> builds frags[] output with skb_add_rx_frag(), which is the
> representation XDP multi-buffer expects.
> 
> Fixes: 718a18a0c8a6 ("veth: Rework veth_xdp_rcv_skb in order to accept non-linear skb")
> Cc: stable@vger.kernel.org
> Signed-off-by: Matt Fleming <mfleming@cloudflare.com>

Acked-by: Lorenzo Bianconi <lorenzo@kernel.org>

> ---
> Changes in v2:
> - Use skb_is_nonlinear() in veth_convert_skb_to_xdp_buff().
> - Move the skb_pp_cow_data() comment into kerneldoc.
> 
>  drivers/net/veth.c |  4 ++--
>  net/core/skbuff.c  | 16 ++++++++++------
>  2 files changed, 12 insertions(+), 8 deletions(-)
> 
> diff --git a/drivers/net/veth.c b/drivers/net/veth.c
> index 1c5142149175..00e34afd858e 100644
> --- a/drivers/net/veth.c
> +++ b/drivers/net/veth.c
> @@ -756,7 +756,7 @@ static int veth_convert_skb_to_xdp_buff(struct veth_rq *rq,
>  	u32 frame_sz;
>  
>  	if (skb_shared(skb) || skb_head_is_locked(skb) ||
> -	    skb_shinfo(skb)->nr_frags ||
> +	    skb_is_nonlinear(skb) ||
>  	    skb_headroom(skb) < XDP_PACKET_HEADROOM) {
>  		if (skb_pp_cow_data(rq->page_pool, pskb, XDP_PACKET_HEADROOM))
>  			goto drop;
> @@ -771,7 +771,7 @@ static int veth_convert_skb_to_xdp_buff(struct veth_rq *rq,
>  	xdp_prepare_buff(xdp, skb->head, skb_headroom(skb),
>  			 skb_headlen(skb), true);
>  
> -	if (skb_is_nonlinear(skb)) {
> +	if (skb_shinfo(skb)->nr_frags) {
>  		skb_shinfo(skb)->xdp_frags_size = skb->data_len;
>  		xdp_buff_set_frags_flag(xdp);
>  	} else {
> diff --git a/net/core/skbuff.c b/net/core/skbuff.c
> index 18dabb4e9cfa..66f57131633a 100644
> --- a/net/core/skbuff.c
> +++ b/net/core/skbuff.c
> @@ -927,6 +927,16 @@ static void skb_clone_fraglist(struct sk_buff *skb)
>  		skb_get(list);
>  }
>  
> +/**
> + * skb_pp_cow_data() - copy skb data into page-pool backed storage
> + * @pool: page pool to allocate from
> + * @pskb: pointer to skb pointer, replaced with the copied skb on success
> + * @headroom: headroom to reserve in the copied skb
> + *
> + * skb_copy_bits() handles both frags[] and frag_list input. If the copied
> + * skb remains non-linear, it uses frags[], which is the representation used
> + * by XDP multi-buffer.
> + */
>  int skb_pp_cow_data(struct page_pool *pool, struct sk_buff **pskb,
>  		    unsigned int headroom)
>  {
> @@ -936,12 +946,6 @@ int skb_pp_cow_data(struct page_pool *pool, struct sk_buff **pskb,
>  	int err, i, head_off;
>  	void *data;
>  
> -	/* XDP does not support fraglist so we need to linearize
> -	 * the skb.
> -	 */
> -	if (skb_has_frag_list(skb))
> -		return -EOPNOTSUPP;
> -
>  	max_head_size = SKB_WITH_OVERHEAD(PAGE_SIZE - headroom);
>  	if (skb->len > max_head_size + MAX_SKB_FRAGS * PAGE_SIZE)
>  		return -ENOMEM;
> -- 
> 2.43.0
> 

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]

Re: [PATCH bpf v2] veth: convert frag_list skbs before running XDP

[Maciej Fijalkowski]

On Mon, Jul 20, 2026 at 02:18:58PM +0000, sashiko-bot@kernel.org wrote:
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> 
> Pre-existing issues:
> - [Critical] veth_xdp_rcv_skb() fails to adjust skb->len when an XDP program modifies fragment lengths, causing state desynchronization.
> --
> 
> --- Patch [1]: [PATCH bpf v2] veth: convert frag_list skbs before running XDP ---
> commit c3ece024a1663f1b10d53a17f59581af7993ec1f
> Author: Matt Fleming <mfleming@cloudflare.com>
> 
> veth: convert frag_list skbs before running XDP
>     
> A frag_list skb can reach veth with data_len set but nr_frags zero.
> This patch routes non-linear skbs through skb_pp_cow_data() before exposing
> them to XDP, preventing a crash in AF_XDP copy mode.
> 
> > diff --git a/drivers/net/veth.c b/drivers/net/veth.c
> > index 1c51421491753..00e34afd858e7 100644
> > --- a/drivers/net/veth.c
> > +++ b/drivers/net/veth.c
> 
> [ ... ]
> 
> > @@ -771,7 +771,7 @@ static int veth_convert_skb_to_xdp_buff(struct veth_rq *rq,
> >  	xdp_prepare_buff(xdp, skb->head, skb_headroom(skb),
> >  			 skb_headlen(skb), true);
> >  
> > -	if (skb_is_nonlinear(skb)) {
> > +	if (skb_shinfo(skb)->nr_frags) {
> >  		skb_shinfo(skb)->xdp_frags_size = skb->data_len;
> >  		xdp_buff_set_frags_flag(xdp);
> >  	} else {
> 
> [Severity: Critical]
> This is a pre-existing issue, but while reviewing the XDP fragment changes, I
> noticed a potential state desynchronization in veth_xdp_rcv_skb() when handling
> XDP tail adjustments.
> 
> When a fragmented packet is received and an attached XDP program calls
> bpf_xdp_adjust_tail() to shrink or grow the packet, veth_xdp_rcv_skb() updates
> skb->data_len:
> 
> drivers/net/veth.c:veth_xdp_rcv_skb() {
>     ...
> 	/* XDP frag metadata (e.g. nr_frags) are updated in eBPF helpers
> 	 * (e.g. bpf_xdp_adjust_tail), we need to update data_len here.
> 	 */
> 	if (xdp_buff_has_frags(xdp))
> 		skb->data_len = skb_shinfo(skb)->xdp_frags_size;
> 	else
> 		skb->data_len = 0;
>     ...
> }
> 
> Does skb->len also need to be updated with the corresponding delta when
> skb->data_len is modified?
> 
> If skb->len isn't updated alongside skb->data_len, could skb_headlen()
> evaluate to a size larger than the actual linear buffer? If the tail is
> shrunk, this desynchronization might lead to out-of-bounds reads or writes
> past the allocated linear memory during subsequent network stack processing.

I think this is a valid find which also affects generic XDP side. Probably
another reason to have generic XDP code being reused here so fix would
happen in a single spot.

We only handle the linear part via __skb_put() when we detect
bpf_xdp_adjust_tail() usage. I assume skb->len = xdp_get_buff_len(xdp); is
missing.

> 
> -- 
> Sashiko AI review · https://sashiko.dev/#/patchset/20260720140545.461747-1-matt@readmodwrite.com?part=1
> 

Re: [PATCH bpf v2] veth: convert frag_list skbs before running XDP

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to bpf/bpf.git (master)
by Kumar Kartikeya Dwivedi <memxor@gmail.com>:

On Mon, 20 Jul 2026 15:05:45 +0100 you wrote:
> From: Matt Fleming <mfleming@cloudflare.com>
> 
> A frag_list skb can reach veth with data_len set but nr_frags zero.
> veth_convert_skb_to_xdp_buff() only converts skbs that are shared,
> locked, have frags[], or do not have enough headroom. It later uses
> skb_is_nonlinear() to decide whether to set XDP_FLAGS_HAS_FRAGS and
> xdp_frags_size.
> 
> [...]

Here is the summary with links:
  - [bpf,v2] veth: convert frag_list skbs before running XDP
    https://git.kernel.org/bpf/bpf/c/c3e0e81eec96

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html

Re: [PATCH bpf v2] veth: convert frag_list skbs before running XDP

[Jakub Kicinski]

On Tue, 21 Jul 2026 16:50:05 +0000 patchwork-bot+netdevbpf@kernel.org
wrote:
> Hello:
> 
> This patch was applied to bpf/bpf.git (master)
> by Kumar Kartikeya Dwivedi <memxor@gmail.com>:

Kumar, this looks like a networking patch.
Also the kdoc is missing a returns statement.

Re: [PATCH bpf v2] veth: convert frag_list skbs before running XDP

[Kumar Kartikeya Dwivedi]

On Tue Jul 21, 2026 at 11:14 PM CEST, Jakub Kicinski wrote:
> On Tue, 21 Jul 2026 16:50:05 +0000 patchwork-bot+netdevbpf@kernel.org
> wrote:
>> Hello:
>>
>> This patch was applied to bpf/bpf.git (master)
>> by Kumar Kartikeya Dwivedi <memxor@gmail.com>:
>
> Kumar, this looks like a networking patch.
> Also the kdoc is missing a returns statement.

Sorry about that, I had the feeling it should be tagging net instead.
I tossed it from the bpf tree.