Re: [PATCH bpf-next 3/9] bpf: Add log support for iter link_create

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [Low] bpf: misattributed iter_info error log messages in
  bpf_iter_link_attach()
--

commit d8f64c129a2738b81f1bf280ca7bbad040d70081
Author: Leon Hwang <leon.hwang@linux.dev>

bpf: Add log support for iter link_create

This commit passes the verifier log to bpf_iter_link_attach() and logs
diagnostic messages when BPF_LINK_CREATE fails for iterator programs.

> diff --git a/kernel/bpf/bpf_iter.c b/kernel/bpf/bpf_iter.c
> index f0b29a1709357..dfefa5579e033 100644
> --- a/kernel/bpf/bpf_iter.c
> +++ b/kernel/bpf/bpf_iter.c
[ ... ]
> @@ -538,24 +539,36 @@ int bpf_iter_link_attach(const union bpf_attr *attr, bpfptr_t uattr,
[ ... ]
>  	if (!bpfptr_is_null(ulinfo)) {
>  		err = bpf_check_uarg_tail_zero(ulinfo, sizeof(linfo),
>  					       linfo_len);
> -		if (err)
> +		if (err) {
> +			bpf_log(log, "Invalid iter_info.\n");
>  			return err;
> +		}
>  		linfo_len = min_t(u32, linfo_len, sizeof(linfo));
> -		if (copy_from_bpfptr(&linfo, ulinfo, linfo_len))
> +		if (copy_from_bpfptr(&linfo, ulinfo, linfo_len)) {
> +			bpf_log(log, "Invalid iter_info_len.\n");
>  			return -EFAULT;
> +		}
>  	}

[Severity: Low]
Are the log messages for iter_info and iter_info_len swapped or
misattributed here?

By the time copy_from_bpfptr() runs, linfo_len has already been clamped to
sizeof(linfo), so copy_from_bpfptr() only fails when reading from the
ulinfo pointer (attr->link_create.iter_info) faults, yet it logs "Invalid
iter_info_len.".  Conversely, bpf_check_uarg_tail_zero() rejects linfo_len
values larger than PAGE_SIZE with -E2BIG without touching ulinfo, which
logs "Invalid iter_info.".

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261109140816.5196-1-leon.hwang@linux.dev?part=3