Re: [PATCH bpf v3 2/2] selftests/bpf: add xdp_shrink_frags

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] Type punning a byte array into a struct pointer violates strict aliasing rules.
--

commit 7d6829eaaf619b188a1baf1e3f7bf91fc5a0a765
Author: Jiayuan Chen <jiayuan.chen@linux.dev>

selftests/bpf: add xdp_shrink_frags

This commit adds a BPF selftest for XDP that shrinks fragments and
triggers a page_pool leak on a generic XDP path. The test exercises
test_tun, test_veth, and test_veth_tx to cover different data path
behaviors on 4K pages.

> diff --git a/tools/testing/selftests/bpf/prog_tests/xdp_shrink_frags.c b/tools/testing/selftests/bpf/prog_tests/xdp_shrink_frags.c
> new file mode 100644
> index 0000000000000..ee8f9034a2684
> --- /dev/null
> +++ b/tools/testing/selftests/bpf/prog_tests/xdp_shrink_frags.c
[ ... ]
> +static void test_tun(struct xdp_shrink_frags *skel)
> +{
> +	__u8 head[74], frag1[2048], frag2[2048];
> +	struct ethhdr *eth = (void *)head;
> +	int tap_fd = -1, ifindex, err;
> +	struct netns_obj *ns = NULL;
> +	struct iovec iov[3];
> +	ssize_t n;
[ ... ]
> +	memset(head, 0, sizeof(head));
> +	memset(frag1, 0x41, sizeof(frag1));
> +	memset(frag2, 0x42, sizeof(frag2));
> +	eth->h_proto = htons(ETH_P_IP);

[Severity: Medium]
Does this code violate strict aliasing rules by type-punning a byte array
into a struct pointer?

When test_tun() executes, it accesses an object declared as an array of
characters (__u8) through an unrelated larger struct pointer (struct ethhdr *).
Since this code is located in a test program running in user space (under
tools/), standard -fstrict-aliasing rules apply.

Could the compiler assume that eth does not alias head, leading it to reorder
or drop the write to eth->h_proto entirely during optimization?

> +
> +	iov[0].iov_base = head;  iov[0].iov_len = sizeof(head);
> +	iov[1].iov_base = frag1; iov[1].iov_len = sizeof(frag1);
> +	iov[2].iov_base = frag2; iov[2].iov_len = sizeof(frag2);
[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260911135711.109338-1-jiayuan.chen@linux.dev?part=2