Re: [PATCH v2] selftests/bpf: Reject malformed IPv4/IPv6 skb test input

[sun jian]

On Thu, Apr 2, 2026 at 10:17 AM Martin KaFai Lau <martin.lau@xxxxxxxxx> wrote:
>
> On Mon, Mar 30, 2026 at 12:17:51AM +0800, Sun Jian wrote:
> > bpf_prog_test_run_skb() derives skb->protocol from the Ethernet header
> > through eth_type_trans(), but it does not verify that the provided
> > linear input is long enough to contain the corresponding L3 base header.
> >
> > This can result in an inconsistent skb being passed to test_run helpers
> > such as bpf_skb_adjust_room(), where inferred protocol offsets can lead
> > to operating on uninitialized memory, triggering KMSAN errors.
> >
> > To reject such malformed test input, we check that the linear head is
> > sufficiently large to contain the corresponding L3 base header (IPv4
> > or IPv6) before running the program.
> >
> > Reported-by: syzbot+619b9ef527f510a57cfc@xxxxxxxxxxxxxxxxxxxxxxxxx
> > Closes: https://syzkaller.appspot.com/bug?extid=619b9ef527f510a57cfc
> > Signed-off-by: Sun Jian <sun.jian.kdev@xxxxxxxxx>
> > ---
> > v2:
> >  - Ensured that the linear head is large enough to accommodate the corresponding L3 base header (IPv4 or IPv6), before running the program.
> >
> > Link: <https://lore.kernel.org/bpf/129d235b04aca276c0a57c7c3646ce48644458cdc85d9b92b25f405e2d58a9ae@xxxxxxxxxxxxxxx/>
> >
> >  net/bpf/test_run.c | 19 +++++++++++++++++++
> >  1 file changed, 19 insertions(+)
> >
> > diff --git a/net/bpf/test_run.c b/net/bpf/test_run.c
> > index 178c4738e63b..4790bee535b9 100644
> > --- a/net/bpf/test_run.c
> > +++ b/net/bpf/test_run.c
> > @@ -1118,6 +1118,25 @@ int bpf_prog_test_run_skb(struct bpf_prog *prog, const union bpf_attr *kattr,
> >       skb->protocol = eth_type_trans(skb, dev);
> >       skb_reset_network_header(skb);
> >
> > +     switch (skb->protocol) {
>
> The implementation is poor.
>
> > +     case htons(ETH_P_IP):
> > +             if (skb_headlen(skb) < sizeof(struct iphdr)) {
> > +                     ret = -EINVAL;
> > +                     goto out;
> > +             }
> > +             break;
> > +#if IS_ENABLED(CONFIG_IPV6)
> > +     case htons(ETH_P_IPV6):
> > +             if (skb_headlen(skb) < sizeof(struct ipv6hdr)) {
> > +                     ret = -EINVAL;
> > +                     goto out;
> > +             }
> > +             break;
> > +#endif
> > +     default:
> > +             break;
> > +     }
> > +
> >       switch (skb->protocol) {
>
> There is an exact same switch and it has the same check
> on skb_headlen(skb).
>
> A selftest is needed. Check if the tests in empty_skb.c need to be
> changed also. imo, This can be bpf-next.
>
> pw-bot: cr
>
> >       case htons(ETH_P_IP):
> >               sk->sk_family = AF_INET;
> >
> > base-commit: cbfffcca2bf0622b601b7eaf477aa29035169184
> > --
> > 2.43.0
> >

Ack, I'll respin a v2.

BTW, v1 was mainly meant as a minimal proof of the fix, so I
kept the existing structure intact.

Sun Jian