Re: [PATCH bpf-next v1 07/10] selftests/bpf: Test arena binding by libbpf

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Low] selftests/bpf: uninitialized stack memory read in assert_prog_map() on test failure
--

commit 2eeeb2c231d34a25c0bfb615692f8a717edbdc53
Author: Kumar Kartikeya Dwivedi <memxor@gmail.com>

selftests/bpf: Test arena binding by libbpf

This commit introduces a test to ensure libbpf correctly binds an arena
to all programs in an object, even if they don't explicitly refer to it.
It also relocates programs that were previously expected to fail without
an arena to a new object without an arena map to preserve their negative
tests.

> diff --git a/tools/testing/selftests/bpf/prog_tests/test_struct_ops_arena.c b/tools/testing/selftests/bpf/prog_tests/test_struct_ops_arena.c
> index 1a7fe0d6c5a4c..a45b360b4c65d 100644
> --- a/tools/testing/selftests/bpf/prog_tests/test_struct_ops_arena.c
> +++ b/tools/testing/selftests/bpf/prog_tests/test_struct_ops_arena.c
[ ... ]
> @@ -144,6 +145,50 @@ static void arena_member(void)
>  	struct_ops_arena_member__destroy(skel);
>  }
>  
> +/* @prog_fd lists exactly one map, the one with @map_id. */
> +static void assert_prog_map(int prog_fd, __u32 map_id, const char *name)
> +{
> +	__u32 map_ids[2], len = sizeof(struct bpf_prog_info);
> +	struct bpf_prog_info info = {
> +		.nr_map_ids = ARRAY_SIZE(map_ids),
> +		.map_ids = ptr_to_u64(map_ids),
> +	};
> +	int err;
> +
> +	err = bpf_prog_get_info_by_fd(prog_fd, &info, &len);
> +	if (!ASSERT_OK(err, name))
> +		return;
> +	ASSERT_EQ(info.nr_map_ids, 1, name);
> +	ASSERT_EQ(map_ids[0], map_id, name);

[Severity: Low]
Does this read uninitialized stack memory on test failure?

If bpf_prog_get_info_by_fd() successfully returns but the program has 0 maps,
it will set info.nr_map_ids = 0 and leave the map_ids array unwritten.
Since ASSERT_EQ() does not abort the test on failure, execution will continue
to the next assertion, which evaluates map_ids[0].

Could we return early if info.nr_map_ids != 1, or initialize the map_ids
array to zero?

> +}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261012133711.4030594-1-memxor@gmail.com?part=7