Re: [PATCH bpf-next v3] bpf: reject short IPv4/IPv6 inputs in bpf_prog_test_run_skb

[sun jian]

On Tue, Apr 7, 2026 at 2:58 AM Martin KaFai Lau <martin.lau@xxxxxxxxx> wrote:
>
> On Fri, Apr 03, 2026 at 12:01:47AM +0800, Sun Jian wrote:
> > diff --git a/net/bpf/test_run.c b/net/bpf/test_run.c
> > index 178c4738e63b..300e2bfc5a62 100644
> > --- a/net/bpf/test_run.c
> > +++ b/net/bpf/test_run.c
> > @@ -1120,19 +1120,23 @@ int bpf_prog_test_run_skb(struct bpf_prog *prog, const union bpf_attr *kattr,
> >
> >       switch (skb->protocol) {
> >       case htons(ETH_P_IP):
> > -             sk->sk_family = AF_INET;
> > -             if (sizeof(struct iphdr) <= skb_headlen(skb)) {
> > -                     sk->sk_rcv_saddr = ip_hdr(skb)->saddr;
> > -                     sk->sk_daddr = ip_hdr(skb)->daddr;
> > +             if (skb_headlen(skb) < sizeof(struct iphdr)) {
> > +                     ret = -EINVAL;
> > +                     goto out;
> >               }
> > +             sk->sk_family = AF_INET;
> > +             sk->sk_rcv_saddr = ip_hdr(skb)->saddr;
> > +             sk->sk_daddr = ip_hdr(skb)->daddr;
> >               break;
> >  #if IS_ENABLED(CONFIG_IPV6)
> >       case htons(ETH_P_IPV6):
> > -             sk->sk_family = AF_INET6;
> > -             if (sizeof(struct ipv6hdr) <= skb_headlen(skb)) {
> > -                     sk->sk_v6_rcv_saddr = ipv6_hdr(skb)->saddr;
> > -                     sk->sk_v6_daddr = ipv6_hdr(skb)->daddr;
> > +             if (skb_headlen(skb) < sizeof(struct ipv6hdr)) {
> > +                     ret = -EINVAL;
> > +                     goto out;
> >               }
> > +             sk->sk_family = AF_INET6;
> > +             sk->sk_v6_rcv_saddr = ipv6_hdr(skb)->saddr;
> > +             sk->sk_v6_daddr = ipv6_hdr(skb)->daddr;
> >               break;
> >  #endif
> >       default:
> > diff --git a/tools/testing/selftests/bpf/prog_tests/empty_skb.c b/tools/testing/selftests/bpf/prog_tests/empty_skb.c
> > index 438583e1f2d1..d53567e9cd77 100644
> > --- a/tools/testing/selftests/bpf/prog_tests/empty_skb.c
> > +++ b/tools/testing/selftests/bpf/prog_tests/empty_skb.c
> > @@ -12,6 +12,8 @@ void test_empty_skb(void)
> >       struct bpf_program *prog;
> >       char eth_hlen_pp[15];
> >       char eth_hlen[14];
> > +     char ipv4_eth_hlen[14];
> > +     char ipv6_eth_hlen[14];
>
> The eth_hlen_pp and eth_hlen needs to memset zero now.
>
> Instead of adding two more ethhdrs, just reuse the current eth_hlen and
> define it as 'struct ethhdr eth_hlen;' instead of a char array.
> Add 'h_proto' to the anonymous 'struct { } tests[]'.  Initialize
> the eth_hlen.h_proto based on the tests[i].h_proto.
>
> Also, this test does not actually reproduce the reading uninit memeory.
> It needs a bpf prog to actually trigger it by calling bpf_skb_adjust_room()
> based on the report in the "Closes" link. The test should be able
> to trigger it without the change in test_run.c
>
> The ai-review has flagged again that it is missing a "Fixes" tag. This
> probably started since the bpf_skb_adjust_room helper was introduced.
>
> The selftests should also be in a separate patch 2 following the patch 1
> changes in test_run.c.
>
> pw-bot: cr

Ack. I'll split this into two patches and rework the selftest accordingly.