Re: [PATCH bpf v3 2/2] selftests/bpf: add xdp_shrink_frags

[Jiayuan Chen <jiayuan.chen@linux.dev>]

On 9/11/26 10:46 PM, sashiko-bot@kernel.org wrote:
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> - [Medium] Type punning a byte array into a struct pointer violates strict aliasing rules.
> --
>
> commit 7d6829eaaf619b188a1baf1e3f7bf91fc5a0a765
> Author: Jiayuan Chen <jiayuan.chen@linux.dev>
>
> selftests/bpf: add xdp_shrink_frags
>
> This commit adds a BPF selftest for XDP that shrinks fragments and
> triggers a page_pool leak on a generic XDP path. The test exercises
> test_tun, test_veth, and test_veth_tx to cover different data path
> behaviors on 4K pages.
>
>> diff --git a/tools/testing/selftests/bpf/prog_tests/xdp_shrink_frags.c b/tools/testing/selftests/bpf/prog_tests/xdp_shrink_frags.c
>> new file mode 100644
>> index 0000000000000..ee8f9034a2684
>> --- /dev/null
>> +++ b/tools/testing/selftests/bpf/prog_tests/xdp_shrink_frags.c
> [ ... ]
>> +static void test_tun(struct xdp_shrink_frags *skel)
>> +{
>> +	__u8 head[74], frag1[2048], frag2[2048];
>> +	struct ethhdr *eth = (void *)head;
>> +	int tap_fd = -1, ifindex, err;
>> +	struct netns_obj *ns = NULL;
>> +	struct iovec iov[3];
>> +	ssize_t n;
> [ ... ]
>> +	memset(head, 0, sizeof(head));
>> +	memset(frag1, 0x41, sizeof(frag1));
>> +	memset(frag2, 0x42, sizeof(frag2));
>> +	eth->h_proto = htons(ETH_P_IP);
> [Severity: Medium]
> Does this code violate strict aliasing rules by type-punning a byte array
> into a struct pointer?
>
> When test_tun() executes, it accesses an object declared as an array of
> characters (__u8) through an unrelated larger struct pointer (struct ethhdr *).


I don't think there is anything wrong with

     struct foo *ptr = (struct foo *)binary


it's a pretty normal thing to do, and other tests in the same directory 
do exactly the same:

     prog_tests/xdp_context_test_run.c

     __u8 pkt[...];

     struct ethhdr *eth = (void *)pkt;

     struct ipv6hdr *ip6 = (void *)(eth + 1);

     ....


Not sure why the AI complains about this one.


> Since this code is located in a test program running in user space (under
> tools/), standard -fstrict-aliasing rules apply.
>
> Could the compiler assume that eth does not alias head, leading it to reorder
> or drop the write to eth->h_proto entirely during optimization?
>
>> +
>> +	iov[0].iov_base = head;  iov[0].iov_len = sizeof(head);
>> +	iov[1].iov_base = frag1; iov[1].iov_len = sizeof(frag1);
>> +	iov[2].iov_base = frag2; iov[2].iov_len = sizeof(frag2);
> [ ... ]
>