Re: [PATCH bpf-next v5 08/10] selftests/bpf: add helpers for KASAN in JIT testing

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] The newly added get_kasan_multi_shot_enabled() helper is highly unreliable due to its reliance on the broken cmdline_contains() helper, which reads uninitialized stack memory and performs incorrect prefix matching.
--

--- Patch [8]: [PATCH bpf-next v5 08/10] selftests/bpf: add helpers for KASAN in JIT testing ---
commit 89c5dbabce02201a3bf78105cd83cff83602d41f
Author: Alexis Lothoré (eBPF Foundation) <alexis.lothore@bootlin.com>

selftests/bpf: add helpers for KASAN in JIT testing

Add two simple helpers to allow checking whether KASAN for eBPF tests
should be executed.

> diff --git a/tools/testing/selftests/bpf/unpriv_helpers.c b/tools/testing/selftests/bpf/unpriv_helpers.c
> index f997d7ec8fd08..95be839378837 100644
> --- a/tools/testing/selftests/bpf/unpriv_helpers.c
> +++ b/tools/testing/selftests/bpf/unpriv_helpers.c

[ ... ]

> @@ -142,3 +142,13 @@ bool get_unpriv_disabled(void)
>  	}
>  	return mitigations_off;
>  }
> +
> +bool get_kasan_jit_enabled(void)
> +{
> +	return config_contains("CONFIG_BPF_JIT_KASAN=y") == 1;
> +}
> +
> +bool get_kasan_multi_shot_enabled(void)
> +{
> +	return cmdline_contains("kasan_multi_shot");
> +}

[Severity: Medium]
Can this return false positives due to the parsing logic in
cmdline_contains()?

Looking at cmdline_contains(), the buffer isn't correctly null-terminated
after reading:

    if (read(fd, cmdline, sizeof(cmdline) - 1) < 0) {
        perror("read /proc/cmdline");
        goto out;
    }

    cmdline[sizeof(cmdline) - 1] = '\0';

This leaves uninitialized stack memory between the read bytes and the end of
the array, which gets tokenized by strtok().

Additionally, the token matching logic uses strlen(c) instead of the pattern
length:

    for (c = strtok(cmdline, " \n"); c; c = strtok(NULL, " \n")) {
        if (strncmp(c, pat, strlen(c)))
            continue;

Because strncmp() checks only the length of the token, any kernel parameter
that happens to be a prefix of "kasan_multi_shot" (such as "k" or "kasan")
would incorrectly return true.

Could cmdline_contains() be updated to null-terminate at the read length and
use strcmp() for exact matching to avoid non-deterministic test behavior?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260709-kasan-v5-0-1c64af8e4e1e@bootlin.com?part=8