Re: [PATCH bpf v2 02/11] selftests/bpf: Test dynptr slices past end of skb

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Low] test: off-by-one boundary skip in bpf_dynptr_slice test
--

commit b231913ac8efedbed65769b0e27691d0098590c1
Author: Emil Tsalapatis <emil@etsalapatis.com>

selftests/bpf: Test dynptr slices past end of skb
    
Add a selftest to ensure dynptr slices cannot include
past the end of the linear area of an skb.

> diff --git a/tools/testing/selftests/bpf/progs/dynptr_success.c b/tools/testing/selftests/bpf/progs/dynptr_success.c
> index e0745b6e467ea..b668ebd61fc79 100644
> --- a/tools/testing/selftests/bpf/progs/dynptr_success.c
> +++ b/tools/testing/selftests/bpf/progs/dynptr_success.c

[ ... ]

> @@ -211,6 +212,25 @@ int test_dynptr_skb_data(struct __sk_buff *skb)
>  	return 1;
>  }
>  
> +SEC("?tc")
> +int test_dynptr_skb_slice_non_linear(struct __sk_buff *skb)
> +{
> +	struct bpf_dynptr ptr;
> +	void *data;
> +
> +	if (bpf_dynptr_from_skb(skb, 0, &ptr)) {
> +		err = 1;
> +		return 1;
> +	}
> +
> +	/* Ensure we cannot read past the end of the buffer. */
> +	data = bpf_dynptr_slice(&ptr, TEST_SKB_LINEAR_SIZE + 1, NULL, 1);

[Severity: Low]
Does this skip the exact linear/non-linear boundary byte by adding 1 here?

Since the linear portion's size is exactly TEST_SKB_LINEAR_SIZE (34 bytes), the
first byte of the non-linear area is at index 34. By using
TEST_SKB_LINEAR_SIZE + 1 (index 35), this avoids testing the boundary directly.

If an off-by-one error existed where index 34 was incorrectly treated as linear,
this test might fail to catch it.

> +	if (data)
> +		err = 2;
> +
> +	return 1;
> +}
> +
>  SEC("?tc")
>  int test_dynptr_skb_meta_data(struct __sk_buff *skb)
>  {

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260922172028.6269-1-emil@etsalapatis.com?part=2