[PATCH bpf v4] selftests/bpf: Cover partial copy of non-linear test_run output

[PATCH bpf v4] selftests/bpf: Cover partial copy of non-linear test_run output

[Sun Jian]

prog_run_opts already verifies that BPF_PROG_TEST_RUN returns -ENOSPC
for a short data_out buffer while still reporting the full output size
through data_size_out.

Add the same coverage for non-linear test_run output. Use pass-through
TC and XDP programs with a 9000-byte packet, a 64-byte linear data area,
and a 100-byte data_out buffer. The expected output spans both the linear
data and the first fragment.

Verify that test_run returns -ENOSPC, reports the full packet length
through data_size_out, and copies the packet prefix into data_out for
both non-linear skb and XDP frags paths.

Signed-off-by: Sun Jian <sun.jian.kdev@gmail.com>
---

v4:
- Send only the selftest patch; the fix patch has been applied to bpf/master.
- Initialize data_out buffers to avoid reading uninitialized stack memory if
  bpf_prog_test_run_opts() fails unexpectedly.

 .../selftests/bpf/prog_tests/prog_run_opts.c  | 70 +++++++++++++++++++
 .../selftests/bpf/progs/test_pkt_access.c     | 12 ++++
 2 files changed, 82 insertions(+)

diff --git a/tools/testing/selftests/bpf/prog_tests/prog_run_opts.c b/tools/testing/selftests/bpf/prog_tests/prog_run_opts.c
index 01f1d1b6715a..beb6fa78fd94 100644
--- a/tools/testing/selftests/bpf/prog_tests/prog_run_opts.c
+++ b/tools/testing/selftests/bpf/prog_tests/prog_run_opts.c
@@ -4,6 +4,10 @@
 
 #include "test_pkt_access.skel.h"
 
+#define NONLINEAR_PKT_LEN 9000
+#define NONLINEAR_LINEAR_DATA_LEN 64
+#define SHORT_OUT_LEN 100
+
 static const __u32 duration;
 
 static void check_run_cnt(int prog_fd, __u64 run_cnt)
@@ -20,6 +24,69 @@ static void check_run_cnt(int prog_fd, __u64 run_cnt)
 	      "incorrect number of repetitions, want %llu have %llu\n", run_cnt, info.run_cnt);
 }
 
+static void init_pkt(__u8 *pkt, size_t len)
+{
+	size_t i;
+
+	for (i = 0; i < len; i++)
+		pkt[i] = i & 0xff;
+}
+
+static void test_skb_nonlinear_data_out_partial(struct test_pkt_access *skel)
+{
+	LIBBPF_OPTS(bpf_test_run_opts, topts);
+	__u8 pkt[NONLINEAR_PKT_LEN];
+	__u8 out[SHORT_OUT_LEN] = {};
+	struct __sk_buff skb = {};
+	int prog_fd, err;
+
+	init_pkt(pkt, sizeof(pkt));
+
+	skb.data_end = NONLINEAR_LINEAR_DATA_LEN;
+
+	topts.data_in = pkt;
+	topts.data_size_in = sizeof(pkt);
+	topts.data_out = out;
+	topts.data_size_out = sizeof(out);
+	topts.ctx_in = &skb;
+	topts.ctx_size_in = sizeof(skb);
+
+	prog_fd = bpf_program__fd(skel->progs.tc_pass_prog);
+	err = bpf_prog_test_run_opts(prog_fd, &topts);
+
+	ASSERT_EQ(err, -ENOSPC, "skb_partial_err");
+	ASSERT_EQ(topts.data_size_out, sizeof(pkt), "skb_partial_size");
+	ASSERT_OK(memcmp(out, pkt, sizeof(out)), "skb_partial_data");
+}
+
+static void test_xdp_nonlinear_data_out_partial(struct test_pkt_access *skel)
+{
+	LIBBPF_OPTS(bpf_test_run_opts, topts);
+	__u8 pkt[NONLINEAR_PKT_LEN];
+	__u8 out[SHORT_OUT_LEN] = {};
+	struct xdp_md ctx = {};
+	int prog_fd, err;
+
+	init_pkt(pkt, sizeof(pkt));
+
+	ctx.data = 0;
+	ctx.data_end = NONLINEAR_LINEAR_DATA_LEN;
+
+	topts.data_in = pkt;
+	topts.data_size_in = sizeof(pkt);
+	topts.data_out = out;
+	topts.data_size_out = sizeof(out);
+	topts.ctx_in = &ctx;
+	topts.ctx_size_in = sizeof(ctx);
+
+	prog_fd = bpf_program__fd(skel->progs.xdp_frags_pass_prog);
+	err = bpf_prog_test_run_opts(prog_fd, &topts);
+
+	ASSERT_EQ(err, -ENOSPC, "xdp_partial_err");
+	ASSERT_EQ(topts.data_size_out, sizeof(pkt), "xdp_partial_size");
+	ASSERT_OK(memcmp(out, pkt, sizeof(out)), "xdp_partial_data");
+}
+
 void test_prog_run_opts(void)
 {
 	struct test_pkt_access *skel;
@@ -69,6 +136,9 @@ void test_prog_run_opts(void)
 	run_cnt += topts.repeat;
 	check_run_cnt(prog_fd, run_cnt);
 
+	test_skb_nonlinear_data_out_partial(skel);
+	test_xdp_nonlinear_data_out_partial(skel);
+
 cleanup:
 	if (skel)
 		test_pkt_access__destroy(skel);
diff --git a/tools/testing/selftests/bpf/progs/test_pkt_access.c b/tools/testing/selftests/bpf/progs/test_pkt_access.c
index bce7173152c6..cd284401eebd 100644
--- a/tools/testing/selftests/bpf/progs/test_pkt_access.c
+++ b/tools/testing/selftests/bpf/progs/test_pkt_access.c
@@ -150,3 +150,15 @@ int test_pkt_access(struct __sk_buff *skb)
 
 	return TC_ACT_UNSPEC;
 }
+
+SEC("tc")
+int tc_pass_prog(struct __sk_buff *skb)
+{
+	return TC_ACT_OK;
+}
+
+SEC("xdp.frags")
+int xdp_frags_pass_prog(struct xdp_md *ctx)
+{
+	return XDP_PASS;
+}
-- 
2.43.0

Re: [PATCH bpf v4] selftests/bpf: Cover partial copy of non-linear test_run output

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] The newly added selftests `test_skb_nonlinear_data_out_partial` and `test_xdp_nonlinear_data_out_partial` will unconditionally fail due to an unaddressed arithmetic bug in the kernel's `bpf_test_finish` function, breaking the selftest suite.
--

commit 99284be8e441ba5ead251137597e96ebcee998f4
Author: Sun Jian <sun.jian.kdev@gmail.com>

selftests/bpf: Cover partial copy of non-linear test_run output

This commit adds selftests to cover the partial copy of non-linear test_run
output for both TC and XDP programs. It uses a 9000-byte packet with a 64-byte
linear data area and a 100-byte output buffer.

> diff --git a/tools/testing/selftests/bpf/prog_tests/prog_run_opts.c b/tools/testing/selftests/bpf/prog_tests/prog_run_opts.c
> index 01f1d1b6715a6..beb6fa78fd949 100644
> --- a/tools/testing/selftests/bpf/prog_tests/prog_run_opts.c
> +++ b/tools/testing/selftests/bpf/prog_tests/prog_run_opts.c

[ ... ]

> @@ -20,6 +24,69 @@ static void check_run_cnt(int prog_fd, __u64 run_cnt)
>  	      "incorrect number of repetitions, want %llu have %llu\n", run_cnt, info.run_cnt);
>  }
>  
> +static void init_pkt(__u8 *pkt, size_t len)
> +{
> +	size_t i;
> +
> +	for (i = 0; i < len; i++)
> +		pkt[i] = i & 0xff;
> +}
> +
> +static void test_skb_nonlinear_data_out_partial(struct test_pkt_access *skel)
> +{
> +	LIBBPF_OPTS(bpf_test_run_opts, topts);
> +	__u8 pkt[NONLINEAR_PKT_LEN];
> +	__u8 out[SHORT_OUT_LEN] = {};
> +	struct __sk_buff skb = {};
> +	int prog_fd, err;
> +
> +	init_pkt(pkt, sizeof(pkt));
> +
> +	skb.data_end = NONLINEAR_LINEAR_DATA_LEN;
> +
> +	topts.data_in = pkt;
> +	topts.data_size_in = sizeof(pkt);
> +	topts.data_out = out;
> +	topts.data_size_out = sizeof(out);
> +	topts.ctx_in = &skb;
> +	topts.ctx_size_in = sizeof(skb);
> +
> +	prog_fd = bpf_program__fd(skel->progs.tc_pass_prog);
> +	err = bpf_prog_test_run_opts(prog_fd, &topts);
> +
> +	ASSERT_EQ(err, -ENOSPC, "skb_partial_err");
> +	ASSERT_EQ(topts.data_size_out, sizeof(pkt), "skb_partial_size");
> +	ASSERT_OK(memcmp(out, pkt, sizeof(out)), "skb_partial_data");

[Severity: High]
Will these assertions fail unconditionally due to an existing arithmetic
bug in the kernel?

In net/bpf/test_run.c:bpf_test_finish(), the length is calculated as:

    int len = sinfo ? copy_size - frag_size : copy_size;

    if (len < 0) {
        err = -ENOSPC;
        goto out;
    }

Since the packet length is 9000 bytes with a 64 byte linear area, frag_size
is 8936. When copy_size is 100, this yields a negative length of -8836.

This triggers an early error exit, completely bypassing both the partial
data copy to the userspace out buffer and the update of data_size_out.

> +}

[ ... ]

> +static void test_xdp_nonlinear_data_out_partial(struct test_pkt_access *skel)
> +{
> +	LIBBPF_OPTS(bpf_test_run_opts, topts);
> +	__u8 pkt[NONLINEAR_PKT_LEN];
> +	__u8 out[SHORT_OUT_LEN] = {};
> +	struct xdp_md ctx = {};
> +	int prog_fd, err;
> +
> +	init_pkt(pkt, sizeof(pkt));
> +
> +	ctx.data = 0;
> +	ctx.data_end = NONLINEAR_LINEAR_DATA_LEN;
> +
> +	topts.data_in = pkt;
> +	topts.data_size_in = sizeof(pkt);
> +	topts.data_out = out;
> +	topts.data_size_out = sizeof(out);
> +	topts.ctx_in = &ctx;
> +	topts.ctx_size_in = sizeof(ctx);
> +
> +	prog_fd = bpf_program__fd(skel->progs.xdp_frags_pass_prog);
> +	err = bpf_prog_test_run_opts(prog_fd, &topts);
> +
> +	ASSERT_EQ(err, -ENOSPC, "xdp_partial_err");
> +	ASSERT_EQ(topts.data_size_out, sizeof(pkt), "xdp_partial_size");
> +	ASSERT_OK(memcmp(out, pkt, sizeof(out)), "xdp_partial_data");

[Severity: High]
Will this XDP test also unconditionally fail for the same reason?

> +}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260623014027.402820-1-sun.jian.kdev@gmail.com?part=1

Re: [PATCH bpf v4] selftests/bpf: Cover partial copy of non-linear test_run output

[sun jian]

On Tue, Jun 23, 2026 at 9:53 AM <sashiko-bot@kernel.org> wrote:
>
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> - [High] The newly added selftests `test_skb_nonlinear_data_out_partial` and `test_xdp_nonlinear_data_out_partial` will unconditionally fail due to an unaddressed arithmetic bug in the kernel's `bpf_test_finish` function, breaking the selftest suite.
> --
>
> commit 99284be8e441ba5ead251137597e96ebcee998f4
> Author: Sun Jian <sun.jian.kdev@gmail.com>
>
> selftests/bpf: Cover partial copy of non-linear test_run output
>
> This commit adds selftests to cover the partial copy of non-linear test_run
> output for both TC and XDP programs. It uses a 9000-byte packet with a 64-byte
> linear data area and a 100-byte output buffer.
>
> > diff --git a/tools/testing/selftests/bpf/prog_tests/prog_run_opts.c b/tools/testing/selftests/bpf/prog_tests/prog_run_opts.c
> > index 01f1d1b6715a6..beb6fa78fd949 100644
> > --- a/tools/testing/selftests/bpf/prog_tests/prog_run_opts.c
> > +++ b/tools/testing/selftests/bpf/prog_tests/prog_run_opts.c
>
> [ ... ]
>
> > @@ -20,6 +24,69 @@ static void check_run_cnt(int prog_fd, __u64 run_cnt)
> >             "incorrect number of repetitions, want %llu have %llu\n", run_cnt, info.run_cnt);
> >  }
> >
> > +static void init_pkt(__u8 *pkt, size_t len)
> > +{
> > +     size_t i;
> > +
> > +     for (i = 0; i < len; i++)
> > +             pkt[i] = i & 0xff;
> > +}
> > +
> > +static void test_skb_nonlinear_data_out_partial(struct test_pkt_access *skel)
> > +{
> > +     LIBBPF_OPTS(bpf_test_run_opts, topts);
> > +     __u8 pkt[NONLINEAR_PKT_LEN];
> > +     __u8 out[SHORT_OUT_LEN] = {};
> > +     struct __sk_buff skb = {};
> > +     int prog_fd, err;
> > +
> > +     init_pkt(pkt, sizeof(pkt));
> > +
> > +     skb.data_end = NONLINEAR_LINEAR_DATA_LEN;
> > +
> > +     topts.data_in = pkt;
> > +     topts.data_size_in = sizeof(pkt);
> > +     topts.data_out = out;
> > +     topts.data_size_out = sizeof(out);
> > +     topts.ctx_in = &skb;
> > +     topts.ctx_size_in = sizeof(skb);
> > +
> > +     prog_fd = bpf_program__fd(skel->progs.tc_pass_prog);
> > +     err = bpf_prog_test_run_opts(prog_fd, &topts);
> > +
> > +     ASSERT_EQ(err, -ENOSPC, "skb_partial_err");
> > +     ASSERT_EQ(topts.data_size_out, sizeof(pkt), "skb_partial_size");
> > +     ASSERT_OK(memcmp(out, pkt, sizeof(out)), "skb_partial_data");
>
> [Severity: High]
> Will these assertions fail unconditionally due to an existing arithmetic
> bug in the kernel?
>
> In net/bpf/test_run.c:bpf_test_finish(), the length is calculated as:
>
>     int len = sinfo ? copy_size - frag_size : copy_size;
>
>     if (len < 0) {
>         err = -ENOSPC;
>         goto out;
>     }
>

This looks like a false positive based on the old bpf_test_finish()
implementation.

The fix patch has already been applied to bpf/master as:

b5f3534268e3 ("bpf: Fix partial copy of non-linear test_run output")

That commit removes the old copy_size - frag_size calculation and computes
the linear copy length from the packet layout instead:

head_len = size - frag_size
len = min(copy_size, head_len)

This v4 only resends the remaining selftest patch on top of current
bpf/master, where the fix is already present.

I also verified the tests on current bpf/master:

./test_progs -t prog_run_opts -v
./test_progs -t skb_load_bytes -v
./test_progs -t xdp_pull_data -v

All passed.

Thanks,
Sun Jian

> Since the packet length is 9000 bytes with a 64 byte linear area, frag_size
> is 8936. When copy_size is 100, this yields a negative length of -8836.
>
> This triggers an early error exit, completely bypassing both the partial
> data copy to the userspace out buffer and the update of data_size_out.
>
> > +}
>
> [ ... ]
>
> > +static void test_xdp_nonlinear_data_out_partial(struct test_pkt_access *skel)
> > +{
> > +     LIBBPF_OPTS(bpf_test_run_opts, topts);
> > +     __u8 pkt[NONLINEAR_PKT_LEN];
> > +     __u8 out[SHORT_OUT_LEN] = {};
> > +     struct xdp_md ctx = {};
> > +     int prog_fd, err;
> > +
> > +     init_pkt(pkt, sizeof(pkt));
> > +
> > +     ctx.data = 0;
> > +     ctx.data_end = NONLINEAR_LINEAR_DATA_LEN;
> > +
> > +     topts.data_in = pkt;
> > +     topts.data_size_in = sizeof(pkt);
> > +     topts.data_out = out;
> > +     topts.data_size_out = sizeof(out);
> > +     topts.ctx_in = &ctx;
> > +     topts.ctx_size_in = sizeof(ctx);
> > +
> > +     prog_fd = bpf_program__fd(skel->progs.xdp_frags_pass_prog);
> > +     err = bpf_prog_test_run_opts(prog_fd, &topts);
> > +
> > +     ASSERT_EQ(err, -ENOSPC, "xdp_partial_err");
> > +     ASSERT_EQ(topts.data_size_out, sizeof(pkt), "xdp_partial_size");
> > +     ASSERT_OK(memcmp(out, pkt, sizeof(out)), "xdp_partial_data");
>
> [Severity: High]
> Will this XDP test also unconditionally fail for the same reason?
>
> > +}
>
> --
> Sashiko AI review · https://sashiko.dev/#/patchset/20260623014027.402820-1-sun.jian.kdev@gmail.com?part=1