From: sashiko-bot@kernel.org
To: "Emil Tsalapatis" <emil@etsalapatis.com>
Cc: bpf@vger.kernel.org
Subject: Re: [PATCH bpf 02/11] selftests/bpf: Test dynptr slices past end of skb
Date: Wed, 16 Sep 2026 05:18:37 +0000 [thread overview]
Message-ID: <20260916051837.BC1F21F000FF@smtp.kernel.org> (raw)
In-Reply-To: <20260916050830.8774-3-emil@etsalapatis.com>
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] bpf: test misses exact boundary condition for non-linear slices
--
commit 1de6d61a90f0dec0227f3a07a5bdda96d9ca4516
Author: Emil Tsalapatis <emil@etsalapatis.com>
selftests/bpf: Test dynptr slices past end of skb
This commit adds a BPF selftest to verify that dynptr slices cannot read
past the end of the linear area of an skb.
> diff --git a/tools/testing/selftests/bpf/progs/dynptr_success.c b/tools/testing/selftests/bpf/progs/dynptr_success.c
> index e0745b6e467ea..b668ebd61fc79 100644
> --- a/tools/testing/selftests/bpf/progs/dynptr_success.c
> +++ b/tools/testing/selftests/bpf/progs/dynptr_success.c
[ ... ]
> @@ -211,6 +212,25 @@ int test_dynptr_skb_data(struct __sk_buff *skb)
> return 1;
> }
>
> +SEC("?tc")
> +int test_dynptr_skb_slice_non_linear(struct __sk_buff *skb)
> +{
> + struct bpf_dynptr ptr;
> + void *data;
> +
> + if (bpf_dynptr_from_skb(skb, 0, &ptr)) {
> + err = 1;
> + return 1;
> + }
> +
> + /* Ensure we cannot read past the end of the buffer. */
> + data = bpf_dynptr_slice(&ptr, TEST_SKB_LINEAR_SIZE + 1, NULL, 1);
[Severity: Medium]
Does this test miss the exact boundary condition?
TEST_SKB_LINEAR_SIZE defines the exact size of the linear portion of the
SKB. By requesting an offset of TEST_SKB_LINEAR_SIZE + 1, the test skips
the exact boundary offset and leaves a one-byte gap in test coverage.
An off-by-one error in the kernel's bpf_dynptr_slice boundary check might
not be caught by this test.
> + if (data)
> + err = 2;
> +
> + return 1;
> +}
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260916050830.8774-1-emil@etsalapatis.com?part=2
next prev parent reply other threads:[~2026-09-16 5:18 UTC|newest]
Thread overview: 23+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-09-16 5:08 [PATCH bpf 00/11] skb/arena bugfixes Emil Tsalapatis
2026-09-16 5:08 ` [PATCH bpf 01/11] bpf: Fix bounds check for skb-backed dynptrs Emil Tsalapatis
2026-09-16 11:52 ` Jiayuan Chen
2026-09-16 23:08 ` Jakub Kicinski
2026-09-16 5:08 ` [PATCH bpf 02/11] selftests/bpf: Test dynptr slices past end of skb Emil Tsalapatis
2026-09-16 5:18 ` sashiko-bot [this message]
2026-09-16 5:08 ` [PATCH bpf 03/11] bpf: Fix bpf_sock context code generation Emil Tsalapatis
2026-09-16 12:21 ` Jiayuan Chen
2026-09-16 5:08 ` [PATCH bpf 04/11] selftests/bpf: Add selftests for rx_queue_mapping context access Emil Tsalapatis
2026-09-16 5:08 ` [PATCH bpf 05/11] bpf: Reject pkt arguments in mutating subprogs Emil Tsalapatis
2026-09-16 5:57 ` Amery Hung
2026-09-16 5:58 ` Amery Hung
2026-09-16 18:41 ` Emil Tsalapatis
2026-09-16 19:26 ` Amery Hung
2026-09-16 5:08 ` [PATCH bpf 06/11] selftests/bpf: Test rejection of pkt args to " Emil Tsalapatis
2026-09-16 5:08 ` [PATCH bpf 07/11] bpf: Prevent variable arena/non-arena register contents Emil Tsalapatis
2026-09-16 5:08 ` [PATCH bpf 08/11] selftests/bpf: Test for mixed arena/nonarena code paths Emil Tsalapatis
2026-09-16 5:17 ` sashiko-bot
2026-09-16 5:08 ` [PATCH bpf 09/11] bpf: Track whether dynptr type is known Emil Tsalapatis
2026-09-16 5:22 ` sashiko-bot
2026-09-16 18:41 ` Emil Tsalapatis
2026-09-16 5:08 ` [PATCH bpf 10/11] bpf: Track skb memory invalidation by packet-backed dynptrs Emil Tsalapatis
2026-09-16 5:08 ` [PATCH bpf 11/11] selftests/bpf: Test dynptr slice invalidation on skb clobber Emil Tsalapatis
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260916051837.BC1F21F000FF@smtp.kernel.org \
--to=sashiko-bot@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=emil@etsalapatis.com \
--cc=sashiko-reviews@lists.linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox