Re: [PATCH bpf-next 2/2] selftests/bpf: Add a test for udp_bpf_recvmsg() with a stuck backlog

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] bpf: out-of-bounds stack read in bpf_map_update_elem() due to size mismatch
--

commit b1443b15549bc27b1d37fdde6146f87e16092cd2
Author: Yuan Chen <chenyuan@kylinos.cn>
Subject: selftests/bpf: Add a test for udp_bpf_recvmsg() with a stuck backlog

This commit adds a BPF selftest for udp_bpf_recvmsg(). It verifies that reading
from a socket where a verdict program redirects every skb back to the socket
itself falls back to the plain UDP receive path and correctly handles timeouts.

> diff --git a/tools/testing/selftests/bpf/prog_tests/sockmap_udp_backlog.c b/tools/testing/selftests/bpf/prog_tests/sockmap_udp_backlog.c
> --- /dev/null
> +++ b/tools/testing/selftests/bpf/prog_tests/sockmap_udp_backlog.c
[ ... ]
> +static int run_child(void)
> +{
> +	struct test_sockmap_udp_backlog *skel;
> +	struct timeval tv = { .tv_sec = RCV_TIMEOUT_MS / 1000 };
> +	struct sockaddr_in addr = {};
> +	struct timespec t0, t1;
> +	socklen_t addrlen = sizeof(addr);
> +	int zero = 0, sfd, ret, err, exit_code = 1;
[ ... ]
> +	err = bpf_prog_attach(bpf_program__fd(skel->progs.redir_to_self),
> +			      bpf_map__fd(skel->maps.sock_map),
> +			      BPF_SK_SKB_VERDICT, 0);
> +	if (!ASSERT_OK(err, "prog_attach"))
> +		goto close;
> +
> +	err = bpf_map_update_elem(bpf_map__fd(skel->maps.sock_map),
> +				  &zero, &sfd, BPF_ANY);

[Severity: Medium]
Will this cause an out-of-bounds stack read?

The map is defined to expect an 8-byte value:

tools/testing/selftests/bpf/progs/test_sockmap_udp_backlog.c:sock_map:
    struct {
        __uint(type, BPF_MAP_TYPE_SOCKMAP);
        __uint(max_entries, 1);
        __type(key, __u32);
        __type(value, __u64);
    } sock_map SEC(".maps");

Since sfd is declared as a 4-byte integer in run_child(), passing it as the 
value pointer to bpf_map_update_elem() will cause the kernel to read past 
the bounds of the variable. 

If the 4 bytes of adjacent stack memory cause the 64-bit value to exceed
S32_MAX, the map update can be rejected by sock_map_update_elem_sys(), 
leading to random test failures with -EINVAL.

> +	if (!ASSERT_OK(err, "map_update"))
> +		goto close;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260929083447.558818-1-chenyuan_fl@163.com?part=2