* [PATCH bpf 2/2] selftests/bpf: Update xdp_context_test_run test to check maximum metadata size
2026-01-05 11:47 [PATCH bpf 1/2] bpf, test_run: Subtract size of xdp_frame from allowed metadata size Toke Høiland-Jørgensen
@ 2026-01-05 11:47 ` Toke Høiland-Jørgensen
2026-01-05 18:44 ` Amery Hung
2026-01-05 18:36 ` [PATCH bpf 1/2] bpf, test_run: Subtract size of xdp_frame from allowed " Amery Hung
2026-01-06 19:50 ` patchwork-bot+netdevbpf
2 siblings, 1 reply; 6+ messages in thread
From: Toke Høiland-Jørgensen @ 2026-01-05 11:47 UTC (permalink / raw)
To: Alexei Starovoitov, Daniel Borkmann, David S. Miller,
Jakub Kicinski, Jesper Dangaard Brouer, John Fastabend,
Stanislav Fomichev
Cc: Toke Høiland-Jørgensen, Andrii Nakryiko,
Eduard Zingerman, Martin KaFai Lau, Song Liu, Yonghong Song,
KP Singh, Hao Luo, Jiri Olsa, Shuah Khan, netdev, bpf
Update the selftest to check that the metadata size check takes the
xdp_frame size into account in bpf_prog_test_run. The original
check (for meta size 256) was broken because the data frame supplied was
smaller than this, triggering a different EINVAL return. So supply a
larger data frame for this test to make sure we actually exercise the
check we think we are.
Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com>
---
.../bpf/prog_tests/xdp_context_test_run.c | 14 +++++++++++---
1 file changed, 11 insertions(+), 3 deletions(-)
diff --git a/tools/testing/selftests/bpf/prog_tests/xdp_context_test_run.c b/tools/testing/selftests/bpf/prog_tests/xdp_context_test_run.c
index ee94c281888a..24d7d6d8fea1 100644
--- a/tools/testing/selftests/bpf/prog_tests/xdp_context_test_run.c
+++ b/tools/testing/selftests/bpf/prog_tests/xdp_context_test_run.c
@@ -47,6 +47,7 @@ void test_xdp_context_test_run(void)
struct test_xdp_context_test_run *skel = NULL;
char data[sizeof(pkt_v4) + sizeof(__u32)];
char bad_ctx[sizeof(struct xdp_md) + 1];
+ char large_data[256];
struct xdp_md ctx_in, ctx_out;
DECLARE_LIBBPF_OPTS(bpf_test_run_opts, opts,
.data_in = &data,
@@ -94,9 +95,6 @@ void test_xdp_context_test_run(void)
test_xdp_context_error(prog_fd, opts, 4, sizeof(__u32), sizeof(data),
0, 0, 0);
- /* Meta data must be 255 bytes or smaller */
- test_xdp_context_error(prog_fd, opts, 0, 256, sizeof(data), 0, 0, 0);
-
/* Total size of data must be data_end - data_meta or larger */
test_xdp_context_error(prog_fd, opts, 0, sizeof(__u32),
sizeof(data) + 1, 0, 0, 0);
@@ -116,6 +114,16 @@ void test_xdp_context_test_run(void)
test_xdp_context_error(prog_fd, opts, 0, sizeof(__u32), sizeof(data),
0, 0, 1);
+ /* Meta data must be 216 bytes or smaller (256 - sizeof(struct
+ * xdp_frame)). Test both nearest invalid size and nearest invalid
+ * 4-byte-aligned size, and make sure data_in is large enough that we
+ * actually hit the cheeck on metadata length
+ */
+ opts.data_in = large_data;
+ opts.data_size_in = sizeof(large_data);
+ test_xdp_context_error(prog_fd, opts, 0, 217, sizeof(large_data), 0, 0, 0);
+ test_xdp_context_error(prog_fd, opts, 0, 220, sizeof(large_data), 0, 0, 0);
+
test_xdp_context_test_run__destroy(skel);
}
--
2.52.0
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH bpf 2/2] selftests/bpf: Update xdp_context_test_run test to check maximum metadata size
2026-01-05 11:47 ` [PATCH bpf 2/2] selftests/bpf: Update xdp_context_test_run test to check maximum " Toke Høiland-Jørgensen
@ 2026-01-05 18:44 ` Amery Hung
2026-01-05 19:04 ` Toke Høiland-Jørgensen
0 siblings, 1 reply; 6+ messages in thread
From: Amery Hung @ 2026-01-05 18:44 UTC (permalink / raw)
To: Toke Høiland-Jørgensen
Cc: Alexei Starovoitov, Daniel Borkmann, David S. Miller,
Jakub Kicinski, Jesper Dangaard Brouer, John Fastabend,
Stanislav Fomichev, Andrii Nakryiko, Eduard Zingerman,
Martin KaFai Lau, Song Liu, Yonghong Song, KP Singh, Hao Luo,
Jiri Olsa, Shuah Khan, netdev, bpf
On Mon, Jan 5, 2026 at 3:48 AM Toke Høiland-Jørgensen <toke@redhat.com> wrote:
>
> Update the selftest to check that the metadata size check takes the
> xdp_frame size into account in bpf_prog_test_run. The original
> check (for meta size 256) was broken because the data frame supplied was
> smaller than this, triggering a different EINVAL return. So supply a
> larger data frame for this test to make sure we actually exercise the
> check we think we are.
>
> Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com>
> ---
> .../bpf/prog_tests/xdp_context_test_run.c | 14 +++++++++++---
> 1 file changed, 11 insertions(+), 3 deletions(-)
>
> diff --git a/tools/testing/selftests/bpf/prog_tests/xdp_context_test_run.c b/tools/testing/selftests/bpf/prog_tests/xdp_context_test_run.c
> index ee94c281888a..24d7d6d8fea1 100644
> --- a/tools/testing/selftests/bpf/prog_tests/xdp_context_test_run.c
> +++ b/tools/testing/selftests/bpf/prog_tests/xdp_context_test_run.c
> @@ -47,6 +47,7 @@ void test_xdp_context_test_run(void)
> struct test_xdp_context_test_run *skel = NULL;
> char data[sizeof(pkt_v4) + sizeof(__u32)];
> char bad_ctx[sizeof(struct xdp_md) + 1];
> + char large_data[256];
> struct xdp_md ctx_in, ctx_out;
> DECLARE_LIBBPF_OPTS(bpf_test_run_opts, opts,
> .data_in = &data,
> @@ -94,9 +95,6 @@ void test_xdp_context_test_run(void)
> test_xdp_context_error(prog_fd, opts, 4, sizeof(__u32), sizeof(data),
> 0, 0, 0);
>
> - /* Meta data must be 255 bytes or smaller */
> - test_xdp_context_error(prog_fd, opts, 0, 256, sizeof(data), 0, 0, 0);
> -
> /* Total size of data must be data_end - data_meta or larger */
> test_xdp_context_error(prog_fd, opts, 0, sizeof(__u32),
> sizeof(data) + 1, 0, 0, 0);
> @@ -116,6 +114,16 @@ void test_xdp_context_test_run(void)
> test_xdp_context_error(prog_fd, opts, 0, sizeof(__u32), sizeof(data),
> 0, 0, 1);
>
> + /* Meta data must be 216 bytes or smaller (256 - sizeof(struct
> + * xdp_frame)). Test both nearest invalid size and nearest invalid
> + * 4-byte-aligned size, and make sure data_in is large enough that we
> + * actually hit the cheeck on metadata length
nit: a typo here: cheeck -> check
> + */
> + opts.data_in = large_data;
> + opts.data_size_in = sizeof(large_data);
> + test_xdp_context_error(prog_fd, opts, 0, 217, sizeof(large_data), 0, 0, 0);
> + test_xdp_context_error(prog_fd, opts, 0, 220, sizeof(large_data), 0, 0, 0);
> +
> test_xdp_context_test_run__destroy(skel);
> }
Reviewed-by: Amery Hung <ameryhung@gmail.com>
>
> --
> 2.52.0
>
>
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH bpf 2/2] selftests/bpf: Update xdp_context_test_run test to check maximum metadata size
2026-01-05 18:44 ` Amery Hung
@ 2026-01-05 19:04 ` Toke Høiland-Jørgensen
0 siblings, 0 replies; 6+ messages in thread
From: Toke Høiland-Jørgensen @ 2026-01-05 19:04 UTC (permalink / raw)
To: Amery Hung
Cc: Alexei Starovoitov, Daniel Borkmann, David S. Miller,
Jakub Kicinski, Jesper Dangaard Brouer, John Fastabend,
Stanislav Fomichev, Andrii Nakryiko, Eduard Zingerman,
Martin KaFai Lau, Song Liu, Yonghong Song, KP Singh, Hao Luo,
Jiri Olsa, Shuah Khan, netdev, bpf
Amery Hung <ameryhung@gmail.com> writes:
> On Mon, Jan 5, 2026 at 3:48 AM Toke Høiland-Jørgensen <toke@redhat.com> wrote:
>>
>> Update the selftest to check that the metadata size check takes the
>> xdp_frame size into account in bpf_prog_test_run. The original
>> check (for meta size 256) was broken because the data frame supplied was
>> smaller than this, triggering a different EINVAL return. So supply a
>> larger data frame for this test to make sure we actually exercise the
>> check we think we are.
>>
>> Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com>
>> ---
>> .../bpf/prog_tests/xdp_context_test_run.c | 14 +++++++++++---
>> 1 file changed, 11 insertions(+), 3 deletions(-)
>>
>> diff --git a/tools/testing/selftests/bpf/prog_tests/xdp_context_test_run.c b/tools/testing/selftests/bpf/prog_tests/xdp_context_test_run.c
>> index ee94c281888a..24d7d6d8fea1 100644
>> --- a/tools/testing/selftests/bpf/prog_tests/xdp_context_test_run.c
>> +++ b/tools/testing/selftests/bpf/prog_tests/xdp_context_test_run.c
>> @@ -47,6 +47,7 @@ void test_xdp_context_test_run(void)
>> struct test_xdp_context_test_run *skel = NULL;
>> char data[sizeof(pkt_v4) + sizeof(__u32)];
>> char bad_ctx[sizeof(struct xdp_md) + 1];
>> + char large_data[256];
>> struct xdp_md ctx_in, ctx_out;
>> DECLARE_LIBBPF_OPTS(bpf_test_run_opts, opts,
>> .data_in = &data,
>> @@ -94,9 +95,6 @@ void test_xdp_context_test_run(void)
>> test_xdp_context_error(prog_fd, opts, 4, sizeof(__u32), sizeof(data),
>> 0, 0, 0);
>>
>> - /* Meta data must be 255 bytes or smaller */
>> - test_xdp_context_error(prog_fd, opts, 0, 256, sizeof(data), 0, 0, 0);
>> -
>> /* Total size of data must be data_end - data_meta or larger */
>> test_xdp_context_error(prog_fd, opts, 0, sizeof(__u32),
>> sizeof(data) + 1, 0, 0, 0);
>> @@ -116,6 +114,16 @@ void test_xdp_context_test_run(void)
>> test_xdp_context_error(prog_fd, opts, 0, sizeof(__u32), sizeof(data),
>> 0, 0, 1);
>>
>> + /* Meta data must be 216 bytes or smaller (256 - sizeof(struct
>> + * xdp_frame)). Test both nearest invalid size and nearest invalid
>> + * 4-byte-aligned size, and make sure data_in is large enough that we
>> + * actually hit the cheeck on metadata length
>
> nit: a typo here: cheeck -> check
Oops. Will leave this for the maintainers to fix up unless there's
another reason to respin, though...
>> + */
>> + opts.data_in = large_data;
>> + opts.data_size_in = sizeof(large_data);
>> + test_xdp_context_error(prog_fd, opts, 0, 217, sizeof(large_data), 0, 0, 0);
>> + test_xdp_context_error(prog_fd, opts, 0, 220, sizeof(large_data), 0, 0, 0);
>> +
>> test_xdp_context_test_run__destroy(skel);
>> }
>
> Reviewed-by: Amery Hung <ameryhung@gmail.com>
Thanks!
-Toke
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH bpf 1/2] bpf, test_run: Subtract size of xdp_frame from allowed metadata size
2026-01-05 11:47 [PATCH bpf 1/2] bpf, test_run: Subtract size of xdp_frame from allowed metadata size Toke Høiland-Jørgensen
2026-01-05 11:47 ` [PATCH bpf 2/2] selftests/bpf: Update xdp_context_test_run test to check maximum " Toke Høiland-Jørgensen
@ 2026-01-05 18:36 ` Amery Hung
2026-01-06 19:50 ` patchwork-bot+netdevbpf
2 siblings, 0 replies; 6+ messages in thread
From: Amery Hung @ 2026-01-05 18:36 UTC (permalink / raw)
To: Toke Høiland-Jørgensen
Cc: Alexei Starovoitov, Daniel Borkmann, Andrii Nakryiko,
Martin KaFai Lau, Eduard Zingerman, Song Liu, Yonghong Song,
John Fastabend, KP Singh, Stanislav Fomichev, Hao Luo, Jiri Olsa,
David S. Miller, Jakub Kicinski, Jesper Dangaard Brouer,
Yinhao Hu, Kaiyan Mei, Eric Dumazet, Paolo Abeni, Simon Horman,
bpf, netdev
On Mon, Jan 5, 2026 at 3:48 AM Toke Høiland-Jørgensen <toke@redhat.com> wrote:
>
> The xdp_frame structure takes up part of the XDP frame headroom,
> limiting the size of the metadata. However, in bpf_test_run, we don't
> take this into account, which makes it possible for userspace to supply
> a metadata size that is too large (taking up the entire headroom).
>
> If userspace supplies such a large metadata size in live packet mode,
> the xdp_update_frame_from_buff() call in xdp_test_run_init_page() call
> will fail, after which packet transmission proceeds with an
> uninitialised frame structure, leading to the usual Bad Stuff.
>
> The commit in the Fixes tag fixed a related bug where the second check
> in xdp_update_frame_from_buff() could fail, but did not add any
> additional constraints on the metadata size. Complete the fix by adding
> an additional check on the metadata size. Reorder the checks slightly to
> make the logic clearer and add a comment.
>
> Link: https://lore.kernel.org/r/fa2be179-bad7-4ee3-8668-4903d1853461@hust.edu.cn
> Fixes: b6f1f780b393 ("bpf, test_run: Fix packet size check for live packet mode")
> Reported-by: Yinhao Hu <dddddd@hust.edu.cn>
> Reported-by: Kaiyan Mei <M202472210@hust.edu.cn>
> Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com>
> ---
> net/bpf/test_run.c | 18 +++++++++++++-----
> 1 file changed, 13 insertions(+), 5 deletions(-)
>
> diff --git a/net/bpf/test_run.c b/net/bpf/test_run.c
> index 655efac6f133..e6c0ad204b92 100644
> --- a/net/bpf/test_run.c
> +++ b/net/bpf/test_run.c
> @@ -1294,8 +1294,6 @@ int bpf_prog_test_run_xdp(struct bpf_prog *prog, const union bpf_attr *kattr,
> batch_size = NAPI_POLL_WEIGHT;
> else if (batch_size > TEST_XDP_MAX_BATCH)
> return -E2BIG;
> -
> - headroom += sizeof(struct xdp_page_head);
> } else if (batch_size) {
> return -EINVAL;
> }
> @@ -1308,16 +1306,26 @@ int bpf_prog_test_run_xdp(struct bpf_prog *prog, const union bpf_attr *kattr,
> /* There can't be user provided data before the meta data */
> if (ctx->data_meta || ctx->data_end > kattr->test.data_size_in ||
> ctx->data > ctx->data_end ||
> - unlikely(xdp_metalen_invalid(ctx->data)) ||
> (do_live && (kattr->test.data_out || kattr->test.ctx_out)))
> goto free_ctx;
> - /* Meta data is allocated from the headroom */
> - headroom -= ctx->data;
>
> meta_sz = ctx->data;
> + if (xdp_metalen_invalid(meta_sz) || meta_sz > headroom - sizeof(struct xdp_frame))
> + goto free_ctx;
> +
> + /* Meta data is allocated from the headroom */
> + headroom -= meta_sz;
> linear_sz = ctx->data_end;
> }
>
> + /* The xdp_page_head structure takes up space in each page, limiting the
> + * size of the packet data; add the extra size to headroom here to make
> + * sure it's accounted in the length checks below, but not in the
> + * metadata size check above.
> + */
> + if (do_live)
> + headroom += sizeof(struct xdp_page_head);
> +
> max_linear_sz = PAGE_SIZE - headroom - tailroom;
> linear_sz = min_t(u32, linear_sz, max_linear_sz);
The fix makes sense to me.
Reviewed-by: Amery Hung <ameryhung@gmail.com>
>
> --
> 2.52.0
>
>
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [PATCH bpf 1/2] bpf, test_run: Subtract size of xdp_frame from allowed metadata size
2026-01-05 11:47 [PATCH bpf 1/2] bpf, test_run: Subtract size of xdp_frame from allowed metadata size Toke Høiland-Jørgensen
2026-01-05 11:47 ` [PATCH bpf 2/2] selftests/bpf: Update xdp_context_test_run test to check maximum " Toke Høiland-Jørgensen
2026-01-05 18:36 ` [PATCH bpf 1/2] bpf, test_run: Subtract size of xdp_frame from allowed " Amery Hung
@ 2026-01-06 19:50 ` patchwork-bot+netdevbpf
2 siblings, 0 replies; 6+ messages in thread
From: patchwork-bot+netdevbpf @ 2026-01-06 19:50 UTC (permalink / raw)
To: =?utf-8?b?VG9rZSBIw7hpbGFuZC1Kw7hyZ2Vuc2VuIDx0b2tlQHJlZGhhdC5jb20+?=
Cc: ast, daniel, andrii, martin.lau, eddyz87, song, yonghong.song,
john.fastabend, kpsingh, sdf, haoluo, jolsa, davem, kuba, hawk,
dddddd, M202472210, edumazet, pabeni, horms, bpf, netdev
Hello:
This series was applied to bpf/bpf.git (master)
by Alexei Starovoitov <ast@kernel.org>:
On Mon, 5 Jan 2026 12:47:45 +0100 you wrote:
> The xdp_frame structure takes up part of the XDP frame headroom,
> limiting the size of the metadata. However, in bpf_test_run, we don't
> take this into account, which makes it possible for userspace to supply
> a metadata size that is too large (taking up the entire headroom).
>
> If userspace supplies such a large metadata size in live packet mode,
> the xdp_update_frame_from_buff() call in xdp_test_run_init_page() call
> will fail, after which packet transmission proceeds with an
> uninitialised frame structure, leading to the usual Bad Stuff.
>
> [...]
Here is the summary with links:
- [bpf,1/2] bpf, test_run: Subtract size of xdp_frame from allowed metadata size
https://git.kernel.org/bpf/bpf/c/e558cca21779
- [bpf,2/2] selftests/bpf: Update xdp_context_test_run test to check maximum metadata size
(no matching commit)
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply [flat|nested] 6+ messages in thread