Re: [PATCH bpf-next v2 2/2] selftests/bpf: add verification for BPF_PROG_QUERY attr size boundaries

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Critical] The selftest validates and enshrines an ABI-breaking kernel behavior where BPF_PROG_QUERY rejects valid queries from older user-space binaries with -EFAULT.
--

commit a51bd156081fb623564c01426a789df272b5e924
Author: Yuyang Huang <yuyanghuang@google.com>

selftests/bpf: add verification for BPF_PROG_QUERY attr size boundaries

This commit adds a selftest to verify that BPF_PROG_QUERY rejects queries
with a user-declared size below the size covering query.revision with
-EFAULT. It also ensures the query succeeds when given the full size.

> diff --git a/tools/testing/selftests/bpf/prog_tests/bpf_attr_size.c b/tools/testing/selftests/bpf/prog_tests/bpf_attr_size.c
> new file mode 100644
> index 0000000000000..4fbe56cb29d4a
> --- /dev/null
> +++ b/tools/testing/selftests/bpf/prog_tests/bpf_attr_size.c
> @@ -0,0 +1,65 @@
> +// SPDX-License-Identifier: GPL-2.0
> +/* Copyright (c) 2026 Google LLC */
> +#include <linux/bpf.h>

[ ... ]

> +#define OLD_QUERY_SIZE		offsetofend(union bpf_attr, query.prog_cnt)
> +#define FULL_QUERY_SIZE		offsetofend(union bpf_attr, query.revision)
> +
> +static void test_query_size_boundaries(void)
> +{

[ ... ]

> +	memset(&attr, 0, sizeof(attr));
> +	attr.query.target_fd = cg_fd;
> +	attr.query.attach_type = BPF_CGROUP_INET_INGRESS;
> +
> +	err = syscall(__NR_bpf, BPF_PROG_QUERY, &attr, OLD_QUERY_SIZE);
> +	ASSERT_EQ(err, -1, "query_old_size_fails");
> +	ASSERT_EQ(errno, EFAULT, "query_old_size_efault");

[Severity: Critical]
Does this selftest validate an ABI-breaking kernel behavior where
BPF_PROG_QUERY rejects valid queries from older user-space binaries with
-EFAULT?

Older user-space applications (like an older bpftool) compiled with older
headers will supply a smaller bpf_attr size up to query.prog_cnt.
Previously, the kernel would accept this size, but this test now enforces
that the kernel rejects these historically valid queries unconditionally.

Should the kernel conditionally copy to query.revision only if the
user-provided size is large enough, rather than breaking backwards
compatibility for existing binaries?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260531004748.3567875-1-yuyanghuang@google.com?part=2