Re: [PATCH bpf-next v2 2/2] selftests/bpf: Add testcase for callback with tailcall

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Low] Out-of-bounds map index used in bpf_tail_call_static in the test program.
--

--- Patch [2]: [PATCH bpf-next v2 2/2] selftests/bpf: Add testcase for callback with tailcall ---
commit 6b7ff517c87bc3ed869da7118100965c0668a781
Author: Pu Lehui <pulehui@huawei.com>

selftests/bpf: Add testcase for callback with tailcall

This commit adds a new BPF selftest to verify that a callback involving a
subprogram with a tail call is properly rejected by the verifier.

> diff --git a/tools/testing/selftests/bpf/progs/tailcall_bpf2bpf_callback.c b/tools/testing/selftests/bpf/progs/tailcall_bpf2bpf_callback.c
> new file mode 100644
> index 0000000000000..dfe9c49cfeb1d
> --- /dev/null
> +++ b/tools/testing/selftests/bpf/progs/tailcall_bpf2bpf_callback.c
> @@ -0,0 +1,62 @@
> +// SPDX-License-Identifier: GPL-2.0
> +#include <linux/bpf.h>
> +#include <bpf/bpf_helpers.h>
> +#include "bpf_misc.h"
> +#include "bpf_test_utils.h"
> +
> +int classifier_0(struct __sk_buff *skb);
> +
> +struct {
> +	__uint(type, BPF_MAP_TYPE_PROG_ARRAY);
> +	__uint(max_entries, 1);
> +	__uint(key_size, sizeof(__u32));
> +	__array(values, void (void));
> +} jmp_table SEC(".maps") = {
> +	.values = {
> +		[0] = (void *) &classifier_0,
> +	},
> +};
> +
> +static __noinline
> +int subprog_tail0(struct __sk_buff *skb)
> +{
> +	int ret = 0;
> +
> +	bpf_tail_call_static(skb, &jmp_table, 1);

[Severity: Low]
Does this code use an out-of-bounds index for the tail call? The jmp_table
map has max_entries set to 1 and populates index 0 with classifier_0, but
this bpf_tail_call_static() invocation uses index 1.

Even though this test is designed to be rejected by the verifier, should
this pass index 0 to correctly match the intended tail call target?

> +	barrier_var(ret);
> +	return ret;
> +}

[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260714024459.420075-1-pulehui@huaweicloud.com?part=2