On Mon, Jun 15, 2026 at 9:39 PM Paul Chaignon <[email protected]> wrote: > > On Mon, Jun 15, 2026 at 03:38:55PM +0800, Sun Jian wrote: > > For non-linear skbs, bpf_test_finish() derives the linear head copy > > length from copy_size - frag_size. This only matches the skb head length > > when copy_size is the full packet size. > > > > When userspace provides a short data_out buffer, copy_size is clamped to > > that buffer size. If copy_size is smaller than frag_size, the computed > > length becomes negative and bpf_test_finish() returns -ENOSPC before > > copying the packet prefix or updating data_size_out. > > Thanks for fixing this! > > > > > Compute the linear head length from the skb layout instead, and clamp the > > head copy length to copy_size. This preserves the expected partial-copy > > semantics: return -ENOSPC, copy the packet prefix that fits in data_out, > > and report the full packet length through data_size_out. > > > > Fixes: 838baa351cee ("bpf: Craft non-linear skbs in BPF_PROG_TEST_RUN") > > Wouldn't this bug actually go back to 7855e0db150ad ("bpf: test_run: > add xdp_shared_info pointer in bpf_test_finish signature") and also > affect the XDP bpf_prog_test_run_xdp()? If so, could you also add a > selftest that covers it for XDP? > > > Signed-off-by: Sun Jian <[email protected]> > > --- > > net/bpf/test_run.c | 11 ++++------- > > 1 file changed, 4 insertions(+), 7 deletions(-) > > > > diff --git a/net/bpf/test_run.c b/net/bpf/test_run.c > > index 2bc04feadfab..976e8fa31bc9 100644 > > --- a/net/bpf/test_run.c > > +++ b/net/bpf/test_run.c > > @@ -453,19 +453,16 @@ static int bpf_test_finish(const union bpf_attr > > *kattr, > > } > > > > if (data_out) { > > - int len = sinfo ? copy_size - frag_size : copy_size; > > - > > - if (len < 0) { > > - err = -ENOSPC; > > - goto out; > > - } > > + u32 head_len = size - frag_size; > > + u32 len = min(copy_size, head_len); > > > > if (copy_to_user(data_out, data, len)) > > goto out; > > > > if (sinfo) { > > - int i, offset = len; > > + u32 offset = len; > > u32 data_len; > > + int i; > > > > for (i = 0; i < sinfo->nr_frags; i++) { > > skb_frag_t *frag = &sinfo->frags[i]; > > -- > > 2.43.0 > >
Hi Paul, Thanks for taking a look. Yes, that makes sense. I'll re-check the Fixes tag against 7855e0db150ad and add XDP coverage in v2, since the issue is in the shared bpf_test_finish() path. Thanks, Sun Jian
