Re: [PATCH net v5 2/2] selftests/bpf: add regression test for ktls+sockmap verdict UAF

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Low] Usage of ASSERT_TRUE for skeleton pointer checks instead of ASSERT_OK_PTR.
--

commit 2da876f992ba88c42d69b2910d90f780e2c1b89f
Author: Xingwang Xiang <v3rdant.xiang@gmail.com>
selftests/bpf: add regression test for ktls+sockmap verdict UAF

This commit adds a regression test for a use-after-free vulnerability
involving KTLS and sockmap verdict programs. The test creates a scenario
where TLS RX is configured after inserting the receiver socket into a
sockmap.

> diff --git a/tools/testing/selftests/bpf/prog_tests/sockmap_ktls.c b/tools/testing/selftests/bpf/prog_tests/sockmap_ktls.c
> index b87e7f39e15a8..6ed8e149e3d58 100644
> --- a/tools/testing/selftests/bpf/prog_tests/sockmap_ktls.c
> +++ b/tools/testing/selftests/bpf/prog_tests/sockmap_ktls.c

[ ... ]

> @@ -417,6 +417,107 @@ static void run_tests(int family, enum bpf_map_type map_type)
>  	close(map);
>  }
>  
> +/*
> + * Regression test for the KTLS + sockmap (verdict) reverse-order UAF.
> + *
> + * Vulnerable sequence:

[ ... ]

> +static void test_sockmap_ktls_verdict_with_tls_rx(int family, int sotype)
> +{
> +	struct tls12_crypto_info_aes_gcm_128 crypto_info = {};
> +	char send_buf[] = "hello ktls sockmap reverse order";
> +	char recv_buf[sizeof(send_buf)] = {};
> +	struct test_sockmap_ktls *skel;
> +	int c = -1, p = -1, zero = 0;
> +	int prog_fd, map_fd;
> +	ssize_t n;
> +	int err;
> +
> +	skel = test_sockmap_ktls__open_and_load();
> +	if (!ASSERT_TRUE(skel, "open_and_load"))

This isn't a bug, but should this use ASSERT_OK_PTR() instead?

ASSERT_OK_PTR() handles IS_ERR_OR_NULL checks and provides better
debugging output for pointers on failure.

> +		return;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260517145630.20521-1-v3rdant.xiang@gmail.com?part=2