[PATCH 6.12.y] xsk: cache csum_start/csum_offset to fix TOCTOU in xsk_skb_metadata()

[PATCH 6.12.y] xsk: cache csum_start/csum_offset to fix TOCTOU in xsk_skb_metadata()

[Suraj Jitindar Singh]

From: Jason Xing <kernelxing@tencent.com>

commit 22ba97ea9cc1f63a0d0244fae38057ed452b6ac7 upstream.

The TX metadata area resides in the UMEM buffer which is memory-mapped
and concurrently writable by userspace. In xsk_skb_metadata(),
csum_start and csum_offset are read from shared memory for bounds
validation, then read again for skb assignment. A malicious userspace
application can race to overwrite these values between the two reads,
bypassing the bounds check and causing out-of-bounds memory access
during checksum computation in the transmit path.

Fix this by reading csum_start and csum_offset into local variables
once, then using the local copies for both validation and assignment.

Note that other metadata fields (flags, launch_time) and the cached
csum fields may be mutually inconsistent due to concurrent userspace
writes, but this is benign: the only security-critical invariant is
that each field's validated value is the same one used, which local
caching guarantees.

Closes: https://lore.kernel.org/all/20260503200927.73EA1C2BCB4@smtp.kernel.org/
Reviewed-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com>
Signed-off-by: Jason Xing <kernelxing@tencent.com>
Acked-by: Stanislav Fomichev <sdf@fomichev.me>
Fixes: 48eb03dd2630 ("xsk: Add TX timestamp and TX checksum offload support")
Link: https://patch.msgid.link/20260530042630.80626-1-kerneljasonxing@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
[ 6.12: Apply fix in xsk_build_skb() since missing patch
	30c3055f9c0d ("xsk: wrap generic metadata handling onto separate
	function") added in v6.18 which moves handling to separate
	function xsk_skb_metadata(). ]
Signed-off-by: Suraj Jitindar Singh <surajjs@amazon.com>
---
 net/xdp/xsk.c | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/net/xdp/xsk.c b/net/xdp/xsk.c
index da7e11e3bfad..76675ce70f03 100644
--- a/net/xdp/xsk.c
+++ b/net/xdp/xsk.c
@@ -665,6 +665,7 @@ static struct sk_buff *xsk_build_skb(struct xdp_sock *xs,
 	struct xsk_tx_metadata *meta = NULL;
 	struct net_device *dev = xs->dev;
 	struct sk_buff *skb = xs->skb;
+	u16 csum_start, csum_offset;
 	bool first_frag = false;
 	int err;
 
@@ -733,15 +734,17 @@ static struct sk_buff *xsk_build_skb(struct xdp_sock *xs,
 			}
 
 			if (meta->flags & XDP_TXMD_FLAGS_CHECKSUM) {
-				if (unlikely(meta->request.csum_start +
-					     meta->request.csum_offset +
+				csum_start = READ_ONCE(meta->request.csum_start);
+				csum_offset = READ_ONCE(meta->request.csum_offset);
+
+				if (unlikely(csum_start + csum_offset +
 					     sizeof(__sum16) > len)) {
 					err = -EINVAL;
 					goto free_err;
 				}
 
-				skb->csum_start = hr + meta->request.csum_start;
-				skb->csum_offset = meta->request.csum_offset;
+				skb->csum_start = hr + csum_start;
+				skb->csum_offset = csum_offset;
 				skb->ip_summed = CHECKSUM_PARTIAL;
 
 				if (unlikely(xs->pool->tx_sw_csum)) {
-- 
2.47.3

Re: [PATCH 6.12.y] xsk: cache csum_start/csum_offset to fix TOCTOU in xsk_skb_metadata()

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 3 potential issue(s) to consider:

Pre-existing issues:
- [High] Premature checksum calculation for multi-buffer AF_XDP packets.
- [High] Incorrect error recovery on `-EOVERFLOW` leads to packet fragmentation and garbage transmission.
- [High] Integer overflow in `skb->csum_start` leads to negative checksum offset and memory corruption or IOMMU faults.
--

commit 82f4b9c7cad6fc646be8342f727421a308e35ec1
Author: Jason Xing <kernelxing@tencent.com>

xsk: cache csum_start/csum_offset to fix TOCTOU in xsk_skb_metadata()

This commit fixes a time-of-check to time-of-use vulnerability in the AF_XDP
transmit path by caching csum_start and csum_offset in local variables. This
ensures userspace cannot race to overwrite these values between bounds
validation and assignment, preventing potential memory corruption.

Closes: https://lore.kernel.org/all/20260503200927.73EA1C2BCB4@smtp.kernel.org/
Link: https://patch.msgid.link/20260530042630.80626-1-kerneljasonxing@gmail.com

> diff --git a/net/xdp/xsk.c b/net/xdp/xsk.c
> index da7e11e3bfad2..76675ce70f03d 100644
> --- a/net/xdp/xsk.c
> +++ b/net/xdp/xsk.c
[ ... ]
> @@ -733,15 +734,17 @@ static struct sk_buff *xsk_build_skb(struct xdp_sock *xs,
>  			}
>  
>  			if (meta->flags & XDP_TXMD_FLAGS_CHECKSUM) {
> -				if (unlikely(meta->request.csum_start +
> -					     meta->request.csum_offset +
> +				csum_start = READ_ONCE(meta->request.csum_start);
> +				csum_offset = READ_ONCE(meta->request.csum_offset);
> +
> +				if (unlikely(csum_start + csum_offset +
>  					     sizeof(__sum16) > len)) {
>  					err = -EINVAL;
>  					goto free_err;
>  				}
>  
> -				skb->csum_start = hr + meta->request.csum_start;
> -				skb->csum_offset = meta->request.csum_offset;
> +				skb->csum_start = hr + csum_start;

[Severity: High]
This is a pre-existing issue, but does this calculation overflow the 16-bit
skb->csum_start field?

On architectures with a 64KB page size, if userspace provides a csum_start
value close to 65535, adding hr (headroom, e.g., 64 bytes) could exceed the
16-bit maximum and silently wrap. Later, when skb_checksum_start_offset(skb)
subtracts the headroom, this could result in a negative offset, causing
out-of-bounds memory accesses into the headroom or hardware DMA faults.

> +				skb->csum_offset = csum_offset;
>  				skb->ip_summed = CHECKSUM_PARTIAL;
>  
>  				if (unlikely(xs->pool->tx_sw_csum)) {
>  					err = skb_checksum_help(skb);
>  					if (err)
>  						goto free_err;
>  				}
>  			}

[Severity: High]
This isn't a bug introduced by this patch, but does this compute the
software checksum prematurely for multi-buffer packets?

When a userspace application requests XDP_TXMD_FLAGS_CHECKSUM along with
tx_sw_csum for a multi-buffer packet, xsk_build_skb() appears to compute
the checksum over only the first fragment by calling skb_checksum_help().

Since subsequent payload fragments are added later, the final packet would
be transmitted with an invalid checksum covering only the first fragment,
leading to silent packet drops at the destination.

[ ... ]
>  free_err:
>  	if (first_frag && skb)
>  		kfree_skb(skb);
>  
>  	if (err == -EOVERFLOW) {
>  		/* Drop the packet */
>  		xsk_set_destructor_arg(xs->skb);
>  		xsk_drop_skb(xs->skb);
>  		xskq_cons_release(xs->tx);
>  	} else {

[Severity: High]
This is a pre-existing issue, but does the error recovery path for an
oversized multi-buffer packet desynchronize the transmission state machine?

If userspace sends a multi-buffer packet exceeding MAX_SKB_FRAGS, this path
correctly clears and drops xs->skb. However, because it doesn't signal the
caller to skip the remaining descriptors of the dropped packet, the next
descriptor (a middle or tail fragment) is processed with a NULL xs->skb.

Will this cause the fragment to be incorrectly treated as a new packet,
leading to raw payload fragments being transmitted as garbage?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260903221130.27316-1-surajjs@amazon.com?part=1