[PATCH bpf v3 1/2] bpf: Fix partial copy of non-linear test_run output

[Sun Jian]

For non-linear test_run output, bpf_test_finish() derives the linear
data copy length from copy_size - frag_size. This only matches the
linear data length when copy_size is the full packet size.

When userspace provides a short data_out buffer, copy_size is clamped to
that buffer size. If copy_size is smaller than frag_size, the computed
length becomes negative and bpf_test_finish() returns -ENOSPC before
copying the packet prefix or updating data_size_out.

Compute the linear data length from the packet layout instead, and clamp
the linear copy length to copy_size. This preserves the expected
partial-copy semantics: return -ENOSPC, copy the packet prefix that fits
in data_out, and report the full packet length through data_size_out.

Fixes: 7855e0db150ad ("bpf: test_run: add xdp_shared_info pointer in 
bpf_test_finish signature")
Signed-off-by: Sun Jian <sun.jian.k...@gmail.com>
---
 net/bpf/test_run.c | 8 ++------
 1 file changed, 2 insertions(+), 6 deletions(-)

diff --git a/net/bpf/test_run.c b/net/bpf/test_run.c
index 2bc04feadfab..f15c613aaa4e 100644
--- a/net/bpf/test_run.c
+++ b/net/bpf/test_run.c
@@ -453,12 +453,8 @@ static int bpf_test_finish(const union bpf_attr *kattr,
        }
 
        if (data_out) {
-               int len = sinfo ? copy_size - frag_size : copy_size;
-
-               if (len < 0) {
-                       err = -ENOSPC;
-                       goto out;
-               }
+               u32 head_len = size - frag_size;
+               u32 len = min(copy_size, head_len);
 
                if (copy_to_user(data_out, data, len))
                        goto out;
-- 
2.43.0