When BPF_PROG_TEST_RUN returns non-linear output and userspace provides a short data_out buffer, bpf_test_finish() can return -ENOSPC before copying the packet prefix or updating data_size_out.
Fix this by deriving the linear copy length from the packet layout rather than from the already-clamped copy_size. Add selftest coverage for both non-linear skb and XDP frags paths. Changes in v3: * Keep the fix patch minimal by leaving the existing offset declaration unchanged. * Drop unnecessary memset() calls from the new selftests. * Keep the pass-through TC program and larger test packet for the skb case. pkt_v4 is too small once the short IPv4 input check is accounted for, and the existing packet-access program fails before reaching the partial copy-out path with such a short linear area. Changes in v2: * Fix the Fixes tag to point to the commit that introduced the shared non-linear copy-out logic. * Drop skb-specific wording from the fix commit. * Move the selftest from skb_load_bytes.c to prog_run_opts.c. * Add XDP frags coverage in addition to non-linear skb coverage. v2: https://lore.kernel.org/bpf/[email protected]/ v1: https://lore.kernel.org/bpf/[email protected]/ Tested with: ./test_progs -t prog_run_opts -v ./test_progs -t skb_load_bytes -v ./test_progs -t xdp_pull_data -v Sun Jian (2): bpf: Fix partial copy of non-linear test_run output selftests/bpf: Cover partial copy of non-linear test_run output net/bpf/test_run.c | 8 +-- .../selftests/bpf/prog_tests/prog_run_opts.c | 70 +++++++++++++++++++ .../selftests/bpf/progs/test_pkt_access.c | 12 ++++ 3 files changed, 84 insertions(+), 6 deletions(-) -- 2.43.0
