bpf_prog_test_run_skb() may access IPv4/IPv6 network headers based on skb->protocol even when the provided test input only contains an Ethernet header.
Fix it by rejecting such short IPv4/IPv6 inputs before accessing the L3 headers, and add a selftest that exercises the reported bpf_skb_adjust_room() path on ETH_HLEN-sized IPv4/IPv6 EtherType inputs. Changes in v4: - Split the selftests into a separate patch. - Rework the selftest to actually execute a BPF program calling bpf_skb_adjust_room(). - Reuse a single struct ethhdr eth_hlen and initialize h_proto from the test case table. - Add the Fixes tag to the test_run.c patch. Link: https://lore.kernel.org/bpf/CABFUUZF_CWQZrRk=L9cNxO=8Z4iSgGfXi3J=hpzeytkdbfe...@mail.gmail.com/T/#mfabfe7e86bb30c0141fbc9f751b8b1cb07767f01 Sun Jian (2): bpf: reject short IPv4/IPv6 inputs in bpf_prog_test_run_skb selftests/bpf: cover short IPv4/IPv6 inputs with adjust_room net/bpf/test_run.c | 20 ++++++---- .../selftests/bpf/prog_tests/empty_skb.c | 40 +++++++++++++++++-- tools/testing/selftests/bpf/progs/empty_skb.c | 7 ++++ 3 files changed, 56 insertions(+), 11 deletions(-) base-commit: cbfffcca2bf0622b601b7eaf477aa29035169184 -- 2.43.0
