selftests/bpf: Test dynptr slices past end of skb

Add a selftest to ensure dynptr slices cannot include
past the end of the linear area of an skb.

Signed-off-by: Emil Tsalapatis <emil@etsalapatis.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://patch.msgid.link/20260922172028.6269-3-emil@etsalapatis.com
This commit is contained in:
Emil Tsalapatis 2026-09-22 17:20:19 +00:00 committed by Alexei Starovoitov
parent ed6eec97b5
commit 4fd72eb9f1
No known key found for this signature in database
2 changed files with 30 additions and 0 deletions

View File

@ -9,6 +9,7 @@
enum test_setup_type {
SETUP_SYSCALL_SLEEP,
SETUP_SKB_PROG,
SETUP_SKB_PROG_NONLINEAR,
SETUP_SKB_PROG_TP,
SETUP_XDP_PROG,
};
@ -32,6 +33,7 @@ static struct {
{"test_ringbuf", SETUP_SYSCALL_SLEEP},
{"test_skb_readonly", SETUP_SKB_PROG},
{"test_dynptr_skb_data", SETUP_SKB_PROG},
{"test_dynptr_skb_slice_non_linear", SETUP_SKB_PROG_NONLINEAR},
{"test_dynptr_skb_meta_data", SETUP_SKB_PROG},
{"test_dynptr_skb_meta_flags", SETUP_SKB_PROG},
{"test_adjust", SETUP_SYSCALL_SLEEP},
@ -94,7 +96,9 @@ static void verify_success(const char *prog_name, enum test_setup_type setup_typ
bpf_link__destroy(link);
break;
case SETUP_SKB_PROG:
case SETUP_SKB_PROG_NONLINEAR:
{
struct __sk_buff ctx = {};
int prog_fd;
char buf[64];
@ -106,6 +110,12 @@ static void verify_success(const char *prog_name, enum test_setup_type setup_typ
.repeat = 1,
);
if (setup_type == SETUP_SKB_PROG_NONLINEAR) {
ctx.data_end = ETH_HLEN + sizeof(struct iphdr);
topts.ctx_in = &ctx;
topts.ctx_size_in = sizeof(ctx);
}
prog_fd = bpf_program__fd(prog);
if (!ASSERT_GE(prog_fd, 0, "prog_fd"))
goto cleanup;

View File

@ -10,6 +10,7 @@
#include "errno.h"
#define PAGE_SIZE_64K 65536
#define TEST_SKB_LINEAR_SIZE (sizeof(struct ethhdr) + sizeof(struct iphdr))
char _license[] SEC("license") = "GPL";
@ -211,6 +212,25 @@ int test_dynptr_skb_data(struct __sk_buff *skb)
return 1;
}
SEC("?tc")
int test_dynptr_skb_slice_non_linear(struct __sk_buff *skb)
{
struct bpf_dynptr ptr;
void *data;
if (bpf_dynptr_from_skb(skb, 0, &ptr)) {
err = 1;
return 1;
}
/* Ensure we cannot read past the end of the buffer. */
data = bpf_dynptr_slice(&ptr, TEST_SKB_LINEAR_SIZE + 1, NULL, 1);
if (data)
err = 2;
return 1;
}
SEC("?tc")
int test_dynptr_skb_meta_data(struct __sk_buff *skb)
{