[PATCH bpf 0/3] bpf: Fix overlapping copies in xdp and dynptr helpers

[Ayushman Rout <ayushmanrout27@gmail.com>]

My patch "bpf: Use memmove() to load bytes from an skb and an xdp_buff"
was applied as b93cf2c8a055. The AI review on it noted that the
multi-frag path of bpf_xdp_copy_buf() still copies forward with
memcpy() and breaks when the buffer is a slice of the same packet. This
series fixes that.

Commit ab08863c58b1 ("bpf: Use memmove() to store bytes in an xdp_buff") fixed the
single-segment store path and left the cross-fragment case open. Patch 1
fixes that case for both load and store.

Patch 1 fixes bpf_xdp_copy_buf().
Patch 2 fixes bpf_dynptr_copy(), which has the same problem when both
ranges overlap in one packet and cross a segment boundary.
Patch 3 adds selftests.

Testing: x86_64 QEMU VM, ./test_progs -t dynptr. With the fixes all
four new tests pass. Without them the three xdp tests fail and the skb
test passes.

I also read the other memcpy() calls that could touch packet memory.
I found no overlap path, but this is not proven, so I left them
unchanged: the sock_ops header option copies, bpf_file_fetch_bytes(),
bpf_flow_dissector_load_bytes() and bpf_lwt_seg6_store_bytes().

v2 of the earlier patch:
https://patch.msgid.link/20261022112312.31563-1-ayushmanrout27@gmail.com

Ayushman Rout (3):
  bpf: Fix bpf_xdp_copy_buf() when the buffer overlaps the packet
  bpf: Fix bpf_dynptr_copy() for overlapping ranges in one packet
  selftests/bpf: Test overlapping dynptr copies on xdp frags

 kernel/bpf/helpers.c                          |   7 +-
 net/core/filter.c                             |  59 ++++----
 .../testing/selftests/bpf/prog_tests/dynptr.c |   4 +
 .../selftests/bpf/progs/dynptr_success.c      | 128 ++++++++++++++++++
 4 files changed, 172 insertions(+), 26 deletions(-)

-- 
2.54.0