Re: [PATCH bpf-next v4 10/13] selftests/bpf: Add struct_ops __arena and __arena__nullable argument tests

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] Missing NULL check for the global pointer `st_ops3` and its function pointers in `bpf_testmod_ops3_call_test_arena` and `bpf_testmod_ops3_call_test_arena_nullable` kfuncs.
--

--- Patch [10]: [PATCH bpf-next v4 10/13] selftests/bpf: Add struct_ops __arena and __arena__nullable argument tests ---
commit c92a05fea3ca93b4550591e23b6734b40facb5bc
Author: Tejun Heo <tj@kernel.org>

selftests/bpf: Add struct_ops __arena and __arena__nullable argument tests

Add test_arena and test_arena_nullable members to bpf_testmod_ops3 with
arena-tagged stub arguments and kfuncs that forward a caller-provided
pointer to them.

> diff --git a/tools/testing/selftests/bpf/test_kmods/bpf_testmod.c b/tools/testing/selftests/bpf/test_kmods/bpf_testmod.c
> index b92ac1e5df1d2..64ca43744c593 100644
> --- a/tools/testing/selftests/bpf/test_kmods/bpf_testmod.c
> +++ b/tools/testing/selftests/bpf/test_kmods/bpf_testmod.c

[ ... ]

> @@ -418,6 +430,16 @@ __bpf_kfunc void bpf_testmod_ops3_call_test_2(void)
>  	st_ops3->test_2();
>  }
>  
> +__bpf_kfunc int bpf_testmod_ops3_call_test_arena(u64 *ptr__arena)
> +{
> +	return st_ops3->test_arena(ptr__arena);

[Severity: Medium]
Will this cause a kernel panic if a BPF program calls this kfunc before
the struct_ops is attached, leaving st_ops3 as NULL? 

Additionally, if a user provides a struct_ops map that omits the test_arena
callback, could st_ops3->test_arena be NULL, leading to a NULL function
pointer dereference?

> +}
> +
> +__bpf_kfunc int bpf_testmod_ops3_call_test_arena_nullable(u64 *ptr__arena__nullable)
> +{
> +	return st_ops3->test_arena_nullable(ptr__arena__nullable);

[Severity: Medium]
Similarly, can st_ops3 or st_ops3->test_arena_nullable be NULL here under the
same conditions, causing a panic?

> +}
> +
>  struct bpf_testmod_btf_type_tag_1 {
>  	int a;
>  };

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260805210427.3218326-1-memxor@gmail.com?part=10