Re: [PATCH net-next v5 2/3] net: stmmac: rework stmmac_rx to support XDP rx multi-buff

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] net: stmmac: OOB read in stmmac_rx_zc() for multi-buffer frames
--

commit b6459feb6b07a40586d4710878eea688f9a8b50c
Author: Lorenzo Bianconi <lorenzo.bianconi@oss.qualcomm.com>

net: stmmac: rework stmmac_rx to support XDP rx multi-buff

This commit reworks stmmac_rx to build the xdp_buff by accumulating all
descriptors that make up a frame. This allows the XDP program to run on
the full, possibly fragmented packet instead of just the first buffer. It
lays the groundwork for extending XDP to jumbo frames and SPH.

> diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
> index 6128e6d9504c8..be2cba8fcbc6d 100644
> --- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
> +++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
[ ... ]
> @@ -5798,6 +5804,118 @@ static int stmmac_rx_zc(struct stmmac_priv *priv, int limit, u32 queue)
>  	return failure ? limit : (int)count;
>  }

[Severity: High]
Since this patch series removes the MTU check and enables jumbo frame
support, does it expose an out-of-bounds read in stmmac_rx_zc for
multi-buffer frames?

Looking at stmmac_rx_zc, when AF_XDP Zero-Copy is active and intermediate
fragments are dropped, the len accumulator is not updated:

drivers/net/ethernet/stmicro/stmmac/stmmac_main.c:stmmac_rx_zc() {
	...
	/* XSK pool expects RX frame 1:1 mapped to XSK buffer */
	if (likely(status & rx_not_ls)) {
		xsk_buff_free(buf->xdp);
		buf->xdp = NULL;
		dirty++;
		count++;
		goto read_again;
	}

	ctx = xsk_buff_to_stmmac_ctx(buf->xdp);
	...
	buf1_len = stmmac_rx_buf1_len(priv, p, status, len);
	len += buf1_len;
	...
	buf->xdp->data_end = buf->xdp->data + buf1_len;
}

When the final descriptor arrives (status without rx_not_ls), len is
still 0. The stmmac_rx_buf1_len function then calculates
buf1_len = min(dma_buf_sz, plen - 0).

If plen is greater than dma_buf_sz, buf1_len is set to dma_buf_sz, but the
final descriptor only contains the tail bytes of the frame. This gives the
XDP program a buffer length that exceeds the actual data written by DMA,
potentially exposing up to dma_buf_sz of uninitialized XSK UMEM memory.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261009-stmmac-rx-mb-v5-0-c38fa4eaa138@oss.qualcomm.com?part=2