Re: [PATCH bpf-next v7 5/5] selftests/bpf: Test mm_struct user memory kfuncs with linux_binprm

[bot+bpf-ci]

> diff --git a/tools/testing/selftests/bpf/progs/copy_from_user_bprm.c b/tools/testing/selftests/bpf/progs/copy_from_user_bprm.c
> new file mode 100644
> index 0000000000000..07ca96d9db45f
> --- /dev/null
> +++ b/tools/testing/selftests/bpf/progs/copy_from_user_bprm.c
> @@ -0,0 +1,122 @@

[ ... ]

> +static const char expected_arg0[] = "first";
> +static const char expected_arg1[] = "second-argument";
> +static const char expected_env0[] = "SOME_ENV=a";
> +static const char expected_env1[] = "OTHER_ENV=something";

[ ... ]

> +	char arg0[32] = {};
> +	char arg1[32] = {};
> +	char env0[32] = {};
> +	char env1[32] = {};
> +	u64 offset = 0;

[ ... ]

> +	/* arg0 is at bprm->p */
> +	str_arg0_ret = bpf_copy_from_user_mm_str(arg0, sizeof(arg0),
> +						 (void *)(bprm->p + offset),
> +						 mm, BPF_F_PAD_ZEROS);
> +	if (str_arg0_ret != sizeof(expected_arg0))
> +		return 0;
> +	offset += str_arg0_ret;
> +
> +	/* arg1 is at bprm->p + sizeof(arg0) */
> +	str_arg1_ret = bpf_copy_from_user_mm_str(arg1, sizeof(arg1),
> +						 (void *)(bprm->p + offset),
> +						 mm, BPF_F_PAD_ZEROS);

Do the offset comments describe the right quantities? Looking at the
buffer declarations, arg0 is a 32-byte array (char arg0[32]) while
expected_arg0 is a 6-byte string ("first"). The comment says arg1 is at
bprm->p + sizeof(arg0), which would be +32, but the code advances offset
by str_arg0_ret, which is sizeof(expected_arg0) = 6:

  offset += str_arg0_ret;  /* str_arg0_ret is 6, not 32 */

The same pattern continues for the env0 and env1 comments - they name the
destination buffers (32 bytes each) rather than the expected strings (11
and 20 bytes). Should these reference the expected_* arrays instead?

> +	if (str_arg1_ret != sizeof(expected_arg1))
> +		return 0;
> +	offset += str_arg1_ret;
> +
> +	/* env0 is at bprm->p + sizeof(arg0) + sizeof(arg1) */
> +	str_env0_ret = bpf_copy_from_user_mm_str(env0, sizeof(env0),
> +						 (void *)(bprm->p + offset),
> +						 mm, BPF_F_PAD_ZEROS);
> +	if (str_env0_ret != sizeof(expected_env0))
> +		return 0;
> +	offset += str_env0_ret;
> +
> +	/* env1 is at bprm->p + sizeof(arg0) + sizeof(arg1) + sizeof(env0) */
> +	str_env1_ret = bpf_copy_from_user_mm_str(env1, sizeof(env1),
> +						 (void *)(bprm->p + offset),
> +						 mm, BPF_F_PAD_ZEROS);


---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md

CI run summary: https://github.com/kernel-patches/bpf/actions/runs/34946192265