Subject: Re: net/xdp: Potential issue with xp_aligned_validate_desc() in multi-buffer packets

From: Stanislav Fomichev <[email-masked]>
Date: Tue, 3 Feb 2026 18:03:37 -0800

On 02/03, Rao, Nikhil wrote:
> Hi XDP maintainers,
> 
> I have noticed a potential issue with multi-buffer packet support in the
> xp_aligned_validate_desc() function in net/xdp/xsk_queue.h.
> 
> In xp_aligned_validate_desc(), the validation always adjusts the address
> and length by pool->tx_metadata_len:
> 
>   u64 addr = desc->addr - pool->tx_metadata_len;
>   u64 len = desc->len + pool->tx_metadata_len;
> 
> However, in multi-buffer XDP packets, only the first descriptor contains
> TX metadata. Subsequent descriptors do not have
> metadata and should not be validated with this adjustment.
> 
> This causes validation failures for the 2nd buffer onward in
> multi-buffer packets when TX metadata is enabled.
> 
> The same issue exists in xp_unaligned_validate_desc() as well.
> 
> I'm happy to submit a patch if this is indeed a bug. Please let me know
> your thoughts.

I think your assessment is correct. Can you try to extend
prog_tests/xdp_metadata.c to send a mbuf packet? I don't think we have
any real test coverage for the metadata+mbuf..