From: Bui Quang Minh <minhquangbui99@xxxxxxxxx>
Date: Wed, 23 Apr 2025 17:10:47 +0700
> Add the missing offsets when copying frags in xdp_copy_frags_from_zc().
>
> Fixes: 560d958c6c68 ("xsk: add generic XSk &xdp_buff -> skb conversion")
> Signed-off-by: Bui Quang Minh <minhquangbui99@xxxxxxxxx>
> ---
> net/core/xdp.c | 7 ++++---
> 1 file changed, 4 insertions(+), 3 deletions(-)
>
> diff --git a/net/core/xdp.c b/net/core/xdp.c
> index f86eedad586a..a723dc301f94 100644
> --- a/net/core/xdp.c
> +++ b/net/core/xdp.c
> @@ -697,7 +697,8 @@ static noinline bool xdp_copy_frags_from_zc(struct sk_buff *skb,
> nr_frags = xinfo->nr_frags;
>
> for (u32 i = 0; i < nr_frags; i++) {
> - u32 len = skb_frag_size(&xinfo->frags[i]);
> + const skb_frag_t *frag = &xinfo->frags[i];
> + u32 len = skb_frag_size(frag);
> u32 offset, truesize = len;
> netmem_ref netmem;
>
> @@ -707,8 +708,8 @@ static noinline bool xdp_copy_frags_from_zc(struct sk_buff *skb,
> return false;
> }
>
> - memcpy(__netmem_address(netmem),
> - __netmem_address(xinfo->frags[i].netmem),
> + memcpy(__netmem_address(netmem) + offset,
> + __netmem_address(frag->netmem) + skb_frag_off(frag),
> LARGEST_ALIGN(len));
> __skb_fill_netmem_desc_noacc(sinfo, i, netmem, offset, len);
Incorrect fix.
page_pool_dev_alloc_netmem() allocates a buffer of skb_frag_size() len,
but then you pass offset when copying, which may lead to access beyond
the end of the buffer.
I know that my code here is incorrect as well, but the idea was to
allocate only skb_frag_size() and copy the actual payload without any
offset to the new buffer. So, you need to pass the offset only to the
second argument of memcpy() and then pass 0 as @offset to
__skb_fill_netmem_desc_noacc().
Thanks,
Olek
