veth: convert frag_list skbs before running XDP

Overview

In the Linux kernel, the following vulnerability has been resolved:

veth: convert frag_list skbs before running XDP

A frag_list skb can reach veth with data_len set but nr_frags zero. veth_convert_skb_to_xdp_buff() only converts skbs that are shared, locked, have frags[], or do not have enough headroom. It later uses skb_is_nonlinear() to decide whether to set XDP_FLAGS_HAS_FRAGS and xdp_frags_size.

That exposes frag_list data to XDP as if it were stored in frags[], but frags[] is empty. AF_XDP copy mode can then trust the bogus XDP fragment metadata, walk an empty fragment entry, and crash in memcpy() from __xsk_rcv().

Route non-linear skbs through skb_pp_cow_data() before exposing them to XDP, and only advertise XDP frags when the resulting skb has frags[]. skb_copy_bits() already handles frag_list input, and skb_pp_cow_data() builds frags[] output with skb_add_rx_frag(), which is the representation XDP multi-buffer expects.

Affected

• Linux >= 718a18a0c8a67f97781e40bdef7cdd055c430996 < 0be3632597b8349d43a7dc4244b492dc62a05998
• Linux >= 718a18a0c8a67f97781e40bdef7cdd055c430996 < 04958dba44dc795dc79ce2fcbc117821bbbd6542
• Linux >= 718a18a0c8a67f97781e40bdef7cdd055c430996 < 5c1c15c540fc45820ce3033c319151ec891bc10a
• Linux >= 718a18a0c8a67f97781e40bdef7cdd055c430996 < b24ba0bbffe3e23eb2f6838881c1fabcb29fb9fb
• Linux >= 718a18a0c8a67f97781e40bdef7cdd055c430996 < f9c1fff857e93be709c8b52ed1a643f37bd82c66
• Linux >= 718a18a0c8a67f97781e40bdef7cdd055c430996 < d0d6415963040c401e7a7e4e482a698ba52448cb
• Linux 5.18

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.