Re: [PATCH bpf-next v3 3/5] bpf: Craft non-linear skbs in BPF_PROG_TEST_RUN

[Martin KaFai Lau <martin.lau@linux.dev>]

On 9/18/25 9:47 AM, Paul Chaignon wrote:
> This patch adds support for crafting non-linear skbs in BPF test runs

I think it is useful. Thanks for working on it.

> for tc programs, via a new flag BPF_F_TEST_SKB_NON_LINEAR. When this
This commit message needs to be updated.

> flag is set, the size of the linear area is given by ctx->data_end, with
> a minimum of ETH_HLEN always pulled in the linear area.
> 
> This is particularly useful to test support for non-linear skbs in large
> codebases such as Cilium. We've had multiple bugs in the past few years
> where we were missing calls to bpf_skb_pull_data(). This support in
> BPF_PROG_TEST_RUN would allow us to automatically cover this case in our
> BPF tests.
> 
> In addition to the selftests introduced later in the series, this patch
> was tested by setting BPF_F_TEST_SKB_NON_LINEAR for all tc selftests
> programs and checking test failures were expected.
> 
> Tested-by: syzbot@syzkaller.appspotmail.com> Suggested-by: Daniel Borkmann <daniel@iogearbox.net>
> Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com>
> ---
>   net/bpf/test_run.c | 82 ++++++++++++++++++++++++++++++++++++----------
>   1 file changed, 65 insertions(+), 17 deletions(-)
> 
> diff --git a/net/bpf/test_run.c b/net/bpf/test_run.c
> index 00b12d745479..222a54c24c70 100644
> --- a/net/bpf/test_run.c
> +++ b/net/bpf/test_run.c
> @@ -660,21 +660,30 @@ BTF_ID_FLAGS(func, bpf_kfunc_call_memb_release, KF_RELEASE)
>   BTF_KFUNCS_END(test_sk_check_kfunc_ids)
>   
>   static void *bpf_test_init(const union bpf_attr *kattr, u32 user_size,
> -			   u32 size, u32 headroom, u32 tailroom)
> +			   u32 size, u32 headroom, u32 tailroom, bool nonlinear)

test_run_xdp() already has support for multi-frag/buf and doesn't need "bool 
nonlinear". It also does not have the one-page limitation. Is there a reason 
that test_run_skb() cannot follow what the test_run_xdp() does?

>   {
>   	void __user *data_in = u64_to_user_ptr(kattr->test.data_in);
> -	void *data;
> +	void *data, *dst;
>   
>   	if (user_size < ETH_HLEN || user_size > PAGE_SIZE - headroom - tailroom)
>   		return ERR_PTR(-EINVAL);
>   
> -	size = SKB_DATA_ALIGN(size);
> -	data = kzalloc(size + headroom + tailroom, GFP_USER);
> +	/* In non-linear case, data_in is copied to the paged data */
> +	if (nonlinear) {
> +		data = alloc_page(GFP_USER);
> +	} else {
> +		size = SKB_DATA_ALIGN(size);
> +		data = kzalloc(size + headroom + tailroom, GFP_USER);
> +	}
>   	if (!data)
>   		return ERR_PTR(-ENOMEM);
>   
> -	if (copy_from_user(data + headroom, data_in, user_size)) {
> -		kfree(data);
> +	if (nonlinear)
> +		dst = page_address(data);
> +	else
> +		dst = data + headroom;
> +	if (copy_from_user(dst, data_in, user_size)) {
> +		nonlinear ? __free_page(data) : kfree(data);
>   		return ERR_PTR(-EFAULT);
>   	}