On Tue Jun 16, 2026 at 1:42 AM EDT, Yiyang Chen wrote: > Add a conntrack kfunc regression check for opts__sz values that do not > cover opts->error. The BPF program initializes opts->error with a guard > value, calls the lookup and allocation kfuncs with opts__sz set to > sizeof(opts->netns_id), and verifies that the guard is still intact > after the kfunc returns NULL. > > Without the conntrack wrapper guard, the kfunc error path overwrites > that guard with -EINVAL even though the verifier checked only the first > four bytes of the options object. > > Signed-off-by: Yiyang Chen <[email protected]>
Reviewed-by: Emil Tsalapatis <[email protected]> > --- > .../testing/selftests/bpf/prog_tests/bpf_nf.c | 6 +++++ > .../testing/selftests/bpf/progs/test_bpf_nf.c | 26 +++++++++++++++++++ > 2 files changed, 32 insertions(+) > > diff --git a/tools/testing/selftests/bpf/prog_tests/bpf_nf.c > b/tools/testing/selftests/bpf/prog_tests/bpf_nf.c > index b33dba4b126e2..14d4c1793aed5 100644 > --- a/tools/testing/selftests/bpf/prog_tests/bpf_nf.c > +++ b/tools/testing/selftests/bpf/prog_tests/bpf_nf.c > @@ -5,6 +5,8 @@ > #include "test_bpf_nf.skel.h" > #include "test_bpf_nf_fail.skel.h" > > +#define CT_OPTS_ERROR_GUARD 0x12345678 > + > static char log_buf[1024 * 1024]; > > struct { > @@ -119,6 +121,10 @@ static void test_bpf_nf_ct(int mode) > ASSERT_EQ(skel->bss->test_einval_reserved_new, -EINVAL, "Test EINVAL > for reserved in new struct not set to 0"); > ASSERT_EQ(skel->bss->test_einval_netns_id, -EINVAL, "Test EINVAL for > netns_id < -1"); > ASSERT_EQ(skel->bss->test_einval_len_opts, -EINVAL, "Test EINVAL for > len__opts != NF_BPF_CT_OPTS_SZ"); > + ASSERT_EQ(skel->bss->test_einval_len_opts_small_lookup, > CT_OPTS_ERROR_GUARD, > + "Test no error write for lookup opts__sz before error field"); > + ASSERT_EQ(skel->bss->test_einval_len_opts_small_alloc, > CT_OPTS_ERROR_GUARD, > + "Test no error write for alloc opts__sz before error field"); > ASSERT_EQ(skel->bss->test_eproto_l4proto, -EPROTO, "Test EPROTO for > l4proto != TCP or UDP"); > ASSERT_EQ(skel->bss->test_enonet_netns_id, -ENONET, "Test ENONET for > bad but valid netns_id"); > ASSERT_EQ(skel->bss->test_enoent_lookup, -ENOENT, "Test ENOENT for > failed lookup"); > diff --git a/tools/testing/selftests/bpf/progs/test_bpf_nf.c > b/tools/testing/selftests/bpf/progs/test_bpf_nf.c > index 076fbf03a1268..df43649ecb785 100644 > --- a/tools/testing/selftests/bpf/progs/test_bpf_nf.c > +++ b/tools/testing/selftests/bpf/progs/test_bpf_nf.c > @@ -10,6 +10,8 @@ > #define EINVAL 22 > #define ENOENT 2 > > +#define CT_OPTS_ERROR_GUARD 0x12345678 > + > #define NF_CT_ZONE_DIR_ORIG (1 << IP_CT_DIR_ORIGINAL) > #define NF_CT_ZONE_DIR_REPL (1 << IP_CT_DIR_REPLY) > > @@ -19,6 +21,8 @@ int test_einval_reserved = 0; > int test_einval_reserved_new = 0; > int test_einval_netns_id = 0; > int test_einval_len_opts = 0; > +int test_einval_len_opts_small_lookup = 0; > +int test_einval_len_opts_small_alloc = 0; > int test_eproto_l4proto = 0; > int test_enonet_netns_id = 0; > int test_enoent_lookup = 0; > @@ -124,6 +128,28 @@ nf_ct_test(struct nf_conn *(*lookup_fn)(void *, struct > bpf_sock_tuple *, u32, > else > test_einval_len_opts = opts_def.error; > > + opts_def.error = CT_OPTS_ERROR_GUARD; > + ct = lookup_fn(ctx, &bpf_tuple, sizeof(bpf_tuple.ipv4), &opts_def, > + sizeof(opts_def.netns_id)); > + if (ct) { > + bpf_ct_release(ct); > + test_einval_len_opts_small_lookup = -EINVAL; > + } else { > + test_einval_len_opts_small_lookup = opts_def.error; > + } > + > + opts_def.error = CT_OPTS_ERROR_GUARD; > + ct = alloc_fn(ctx, &bpf_tuple, sizeof(bpf_tuple.ipv4), &opts_def, > + sizeof(opts_def.netns_id)); > + if (ct) { > + ct = bpf_ct_insert_entry(ct); > + if (ct) > + bpf_ct_release(ct); > + test_einval_len_opts_small_alloc = -EINVAL; > + } else { > + test_einval_len_opts_small_alloc = opts_def.error; > + } > + > opts_def.l4proto = IPPROTO_ICMP; > ct = lookup_fn(ctx, &bpf_tuple, sizeof(bpf_tuple.ipv4), &opts_def, > sizeof(opts_def));
