Re: [PATCH bpf-next 3/9] bpf: Add log support for iter link_create

[Leon Hwang <leon.hwang@linux.dev>]

On 2026/11/9 22:22, sashiko-bot@kernel.org wrote:
> Thank you for your contribution! Sashiko AI review found 1 potential
> issue to consider:
> - [Low] bpf: misattributed iter_info error log messages in
>   bpf_iter_link_attach()
> --
> 
> commit d8f64c129a2738b81f1bf280ca7bbad040d70081
> Author: Leon Hwang <leon.hwang@linux.dev>
> 
> bpf: Add log support for iter link_create
> 
> This commit passes the verifier log to bpf_iter_link_attach() and logs
> diagnostic messages when BPF_LINK_CREATE fails for iterator programs.
> 
>> diff --git a/kernel/bpf/bpf_iter.c b/kernel/bpf/bpf_iter.c
>> index f0b29a1709357..dfefa5579e033 100644
>> --- a/kernel/bpf/bpf_iter.c
>> +++ b/kernel/bpf/bpf_iter.c
> [ ... ]
>> @@ -538,24 +539,36 @@ int bpf_iter_link_attach(const union bpf_attr *attr, bpfptr_t uattr,
> [ ... ]
>>  	if (!bpfptr_is_null(ulinfo)) {
>>  		err = bpf_check_uarg_tail_zero(ulinfo, sizeof(linfo),
>>  					       linfo_len);
>> -		if (err)
>> +		if (err) {
>> +			bpf_log(log, "Invalid iter_info.\n");
>>  			return err;
>> +		}
>>  		linfo_len = min_t(u32, linfo_len, sizeof(linfo));
>> -		if (copy_from_bpfptr(&linfo, ulinfo, linfo_len))
>> +		if (copy_from_bpfptr(&linfo, ulinfo, linfo_len)) {
>> +			bpf_log(log, "Invalid iter_info_len.\n");
>>  			return -EFAULT;
>> +		}
>>  	}
> 
> [Severity: Low]
> Are the log messages for iter_info and iter_info_len swapped or
> misattributed here?
> 
> By the time copy_from_bpfptr() runs, linfo_len has already been clamped to
> sizeof(linfo), so copy_from_bpfptr() only fails when reading from the
> ulinfo pointer (attr->link_create.iter_info) faults, yet it logs "Invalid
> iter_info_len.".  Conversely, bpf_check_uarg_tail_zero() rejects linfo_len
> values larger than PAGE_SIZE with -E2BIG without touching ulinfo, which
> logs "Invalid iter_info.".
> 

Sounds reasonable to me, will swap them in the next revision.

Thanks,
Leon