Re: [PATCH v2] selftests/bpf: Reject malformed IPv4/IPv6 skb test input

[Martin KaFai Lau]

On Mon, Mar 30, 2026 at 12:17:51AM +0800, Sun Jian wrote:
> bpf_prog_test_run_skb() derives skb->protocol from the Ethernet header
> through eth_type_trans(), but it does not verify that the provided
> linear input is long enough to contain the corresponding L3 base header.
> 
> This can result in an inconsistent skb being passed to test_run helpers
> such as bpf_skb_adjust_room(), where inferred protocol offsets can lead
> to operating on uninitialized memory, triggering KMSAN errors.
> 
> To reject such malformed test input, we check that the linear head is
> sufficiently large to contain the corresponding L3 base header (IPv4
> or IPv6) before running the program.
> 
> Reported-by: syzbot+619b9ef527f510a57cfc@xxxxxxxxxxxxxxxxxxxxxxxxx
> Closes: https://syzkaller.appspot.com/bug?extid=619b9ef527f510a57cfc
> Signed-off-by: Sun Jian <sun.jian.kdev@xxxxxxxxx>
> ---
> v2:
>  - Ensured that the linear head is large enough to accommodate the corresponding L3 base header (IPv4 or IPv6), before running the program.
> 
> Link: <https://lore.kernel.org/bpf/129d235b04aca276c0a57c7c3646ce48644458cdc85d9b92b25f405e2d58a9ae@xxxxxxxxxxxxxxx/>
> 
>  net/bpf/test_run.c | 19 +++++++++++++++++++
>  1 file changed, 19 insertions(+)
> 
> diff --git a/net/bpf/test_run.c b/net/bpf/test_run.c
> index 178c4738e63b..4790bee535b9 100644
> --- a/net/bpf/test_run.c
> +++ b/net/bpf/test_run.c
> @@ -1118,6 +1118,25 @@ int bpf_prog_test_run_skb(struct bpf_prog *prog, const union bpf_attr *kattr,
>  	skb->protocol = eth_type_trans(skb, dev);
>  	skb_reset_network_header(skb);
>  
> +	switch (skb->protocol) {

The implementation is poor.

> +	case htons(ETH_P_IP):
> +		if (skb_headlen(skb) < sizeof(struct iphdr)) {
> +			ret = -EINVAL;
> +			goto out;
> +		}
> +		break;
> +#if IS_ENABLED(CONFIG_IPV6)
> +	case htons(ETH_P_IPV6):
> +		if (skb_headlen(skb) < sizeof(struct ipv6hdr)) {
> +			ret = -EINVAL;
> +			goto out;
> +		}
> +		break;
> +#endif
> +	default:
> +		break;
> +	}
> +
>  	switch (skb->protocol) {

There is an exact same switch and it has the same check
on skb_headlen(skb).

A selftest is needed. Check if the tests in empty_skb.c need to be
changed also. imo, This can be bpf-next.

pw-bot: cr

>  	case htons(ETH_P_IP):
>  		sk->sk_family = AF_INET;
> 
> base-commit: cbfffcca2bf0622b601b7eaf477aa29035169184
> -- 
> 2.43.0
>