AF_XDP TX metadata hardened against OOB reads and races

AF_XDP transmit metadata handling is being tightened after Cen Zhang of Microsoft reported a KASAN out-of-bounds read when the configured TX metadata area is smaller than the kernel expects, plus time-of-check/time-of-use races on flags shared with userspace.

Stanislav Fomichev has posted a six-part series on the BPF list that raises the minimum TX metadata length, checks that launch-time fields fit in the registered area, and takes a single snapshot of the flags for request and completion processing. The goal is to stop the kernel from reading past the end of an undersized metadata region and to keep userspace from flipping flags between validation and use so that an unrequested completion timestamp cannot be enabled after the fact.

The flaws sit in the path that drives hardware offloads such as launch-time scheduling and TX timestamps on zero-copy AF_XDP sockets. Inconsistent flag reads could produce mismatched offload decisions; an undersized metadata area could let the kernel touch memory outside the umem mapping. Drivers that already consume the metadata (Intel igc, Mellanox mlx5, stmmac, and the generic path) are updated to pass the pool and the snapshotted decision through rather than re-reading userspace memory.

Maciej Fijalkowski flagged a residual concern that an early validation path still returns a live userspace pointer whose flags can change before the later request helper runs; Fomichev’s later patches move full validation into that helper and carry the snapshot forward. Automated review also noted pre-existing layout and completion-path issues outside this series. The work targets the net tree as fixes for the launch-time metadata support added earlier.