PR feedback

microsoft · Dec 17, 2024 · 78e7865 · 78e7865
1 parent f85a4c9
commit 78e7865
Show file tree

Hide file tree

Showing 2 changed files with 9 additions and 2 deletions.
diff --git a/src/xdp/xsk.c b/src/xdp/xsk.c
@@ -756,7 +756,6 @@ XskFillTx(
             continue;
         }
 
-
         if (Buffer->DataLength > min(Xsk->Tx.Xdp.MaxBufferLength, Xsk->Tx.Xdp.MaxFrameLength)) {
             Xsk->Statistics.TxInvalidDescriptors++;
             STAT_INC(XdpTxQueueGetStats(Xsk->Tx.Xdp.Queue), XskInvalidDescriptors);

diff --git a/src/xdplwf/send.c b/src/xdplwf/send.c
@@ -268,6 +268,10 @@ XdpGenericBuildTxNbl(
                 if (*NextHeader != IPPROTO_TCP ||
                     Buffer->DataLength < Layer4HeaderOffset + sizeof(*Tcp) ||
                     Tcp->th_len < (sizeof(*Tcp) >> 2) ||
+                    /* N.B. The TCP header length is only validated to fit within the frame's
+                            buffer, in order to prevent memory access violations by NDIS drivers
+                            further in the send path. It is not compared to the IP packet's length,
+                            which may result in the frame eventually being dropped by a receiver. */
                     Buffer->DataLength < Layer4HeaderOffset + (Tcp->th_len << 2)) {
                     goto InvalidOffload;
                 }
@@ -281,7 +285,11 @@ XdpGenericBuildTxNbl(
                 if (*NextHeader != IPPROTO_UDP ||
                     Buffer->DataLength < Layer4HeaderOffset + sizeof(*Udp) ||
                     Udp->uh_ulen < sizeof(*Udp) ||
-                    Buffer->DataLength < ntohs(Udp->uh_ulen) /* Allow UDP length to exceed IP length */) {
+                    /* N.B. The UDP datagram length is only validated to fit within the frame's
+                            buffer, in order to prevent memory access violations by NDIS drivers
+                            further in the send path. It is not compared to the IP packet's length,
+                            which may result in the frame eventually being dropped by a receiver. */
+                    Buffer->DataLength < ntohs(Udp->uh_ulen)) {
                     goto InvalidOffload;
                 }
                 ChecksumInfo->Transmit.UdpChecksum = TRUE;