Re: [PATCH bpf-next v2] selftests/bpf: add XDP test for per-flow LRU_HASH window updates

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] bpf: xdp_lru_window parses TCP header incorrectly ignoring IPv4 ihl
--

commit 76a8e18822036a1270d2ff9fde06bd760faa505b
Author: Anil Kaushik <anilkaushikwireless@gmail.com>

selftests/bpf: add XDP test for per-flow LRU_HASH window updates

This commit introduces a new XDP program and BPF selftest to verify bounds
checking of value-internal arrays and per-flow key isolation. It simulates an
LRU_HASH map updating a rolling window based on TCP packet lengths.

> diff --git a/tools/testing/selftests/bpf/progs/xdp_lru_window.c b/tools/testing/selftests/bpf/progs/xdp_lru_window.c
> new file mode 100644
> index 0000000000000..27aa1509e6c02
> --- /dev/null
> +++ b/tools/testing/selftests/bpf/progs/xdp_lru_window.c

[ ... ]

> +SEC("xdp")
> +int xdp_lru_window(struct xdp_md *ctx)
> +{
> +	void *data_end = (void *)(long)ctx->data_end;
> +	void *data = (void *)(long)ctx->data;

[ ... ]

> +	iph = (void *)(eth + 1);
> +	if ((void *)(iph + 1) > data_end)
> +		return XDP_PASS;
> +	if (iph->protocol != IPPROTO_TCP)
> +		return XDP_PASS;
> +
> +	th = (void *)(iph + 1);
> +	if ((void *)(th + 1) > data_end)
> +		return XDP_PASS;

[Severity: Medium]
Does this parsing logic incorrectly assume a fixed 20-byte IPv4 header?

If an IPv4 packet contains IP options (where iph->ihl > 5), taking (iph + 1)
statically advances by the size of the IP header struct instead of the actual
length specified by iph->ihl * 4. 

This could cause the flow tracking logic to extract the source and destination
ports from attacker-controlled IP options rather than the actual TCP header,
potentially allowing flow pollution.

Should the calculation advance by the dynamic length using iph->ihl?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261002042201.3483076-1-anilkaushikwireless@gmail.com?part=1