Re: [PATCH bpf-next v2 2/2] selftests/bpf: Test rejection of packet dynptr slices in mutating helpers

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] selftests/bpf: wrong section type in slice_pkt_to_lwt_push_encap()
--

commit 86f6940d47fbdfababc47269242b89301ecf8dfb
Author: Luxiao Xu <rakukuip@gmail.com>

selftests/bpf: Test rejection of packet dynptr slices in mutating helpers

This commit adds negative verifier selftests in dynptr_fail.c to verify
that passing skb-backed dynptr slices or packet-backed dynptrs to mutating
helpers and global subprograms is rejected.

> diff --git a/tools/testing/selftests/bpf/progs/dynptr_fail.c b/tools/testing/selftests/bpf/progs/dynptr_fail.c
> index c2247b38c8498..11699d87ad2b1 100644
> --- a/tools/testing/selftests/bpf/progs/dynptr_fail.c
> +++ b/tools/testing/selftests/bpf/progs/dynptr_fail.c
> @@ -2279,3 +2279,93 @@ int dynptr_overwrite_ref_clone_slice_valid(void *ctx)
>  
>  	return 0;
>  }
> +
> +/* Passing a packet dynptr slice to helper changing packet data should fail */
> +SEC("?lwt_out")
> +__failure __msg("cannot pass packet pointer")
> +int slice_pkt_to_lwt_push_encap(struct __sk_buff *skb)
> +{
> +	struct bpf_dynptr ptr;
> +	void *hdr;
> +
> +	bpf_dynptr_from_skb(skb, 0, &ptr);
> +	hdr = bpf_dynptr_slice(&ptr, 0, NULL, 20);
> +	if (!hdr)
> +		return 1;
> +
> +	bpf_lwt_push_encap(skb, 0, hdr, 20);
> +	return 0;
> +}

[Severity: Medium]
Should slice_pkt_to_lwt_push_encap() use SEC("?lwt_in") or SEC("?lwt_xmit")
instead of SEC("?lwt_out")?

In net/core/filter.c, lwt_out_func_proto() does not allow
BPF_FUNC_lwt_push_encap, which is only exposed in lwt_in_func_proto() and
lwt_xmit_func_proto():

net/core/filter.c:lwt_in_func_proto() {
	switch (func_id) {
	case BPF_FUNC_lwt_push_encap:
		return &bpf_lwt_in_push_encap_proto;
	default:
		return lwt_out_func_proto(func_id, prog);
	}
}

Because of this, check_helper_call() -> bpf_get_helper_proto() rejects the
program with "program of this type cannot use helper bpf_lwt_push_encap#73"
before reaching check_func_args(), so the expected "cannot pass packet
pointer" message is never emitted and the test fails.

[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/cover.1792222148.git.rakukuip@gmail.com?part=2