From nobody Mon May 25 05:12:10 2026 Received: from out-179.mta1.migadu.com (out-179.mta1.migadu.com [95.215.58.179]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 41A76299A87 for ; Mon, 18 May 2026 14:55:54 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=95.215.58.179 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779116156; cv=none; b=ouDKUtspWbV1OzDJmMwBwhQtJI/YHkWHAvxTdW/3O/noiG5gP/nOJggCl8mEJqg2iDuWJ/Q6ihBA4Vy456fVZVQiV5gwj73SAR8IJ5zL2Ppz7qPXJ9139Gd0tlbcQ6+LUFHVuWCPZ93IdZrOEmc9ciMS6exXPHTQmLyiC0p2VWU= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779116156; c=relaxed/simple; bh=jU32sRYAampJ/AxzWYHsInO3pypPZWbjn6UgYtcB5uo=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=qJZ73NfZH8I+eviF9PWZjP4pWwLP3wX2RqRCuWnokfZzG2Uyr2I058EYhWEY01bb1V2WcET8tFhG+EzKLAuTvzCGZz9mfTZ6+8E3dBKzaIpRrgjFxl32ltVrmSsi1GPZtft7SPxNL8CSGHfsMlZA5GckxgbZbXcpU8AU+FuzhU0= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=ZgML7De+; arc=none smtp.client-ip=95.215.58.179 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="ZgML7De+" X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1779116152; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=WZ9pGaJgcvAYuZq+EY3vbtim0GdS1hYwFfNMO482RPw=; b=ZgML7De+IVipfNqpdsYegZ5AGnzGW77FemBci1bdABfkhjPlIgQfAUrLcsSg5+fNckz5Ig 9K0O31/yvWNT1SGbRV76geBnABkpQ1E9g8VR3rL5dhlRyGvLbGVLGse9A2ycKrzs/dMpIE gTrURGjbaPjSpKX5HkWtJtMxdL1RnOY= From: Leon Hwang To: bpf@vger.kernel.org Cc: Alexei Starovoitov , Daniel Borkmann , Andrii Nakryiko , Martin KaFai Lau , Eduard Zingerman , Kumar Kartikeya Dwivedi , Shuah Khan , Leon Hwang , linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org, kernel-patches-bot@fb.com Subject: [PATCH bpf-next 1/5] bpf: Check tail zero of bpf_common_attr using offsetofend Date: Mon, 18 May 2026 22:54:42 +0800 Message-ID: <20260518145446.6794-2-leon.hwang@linux.dev> In-Reply-To: <20260518145446.6794-1-leon.hwang@linux.dev> References: <20260518145446.6794-1-leon.hwang@linux.dev> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Migadu-Flow: FLOW_OUT Content-Type: text/plain; charset="utf-8" Because of the 8-byte alignment, the compiler will pad struct bpf_common_attr to 24 bytes. That said, sizeof(attr_common) is 24 instead of 20. When check tail zero using sizeof(attr_common) in bpf_check_uarg_tail_zero(), there will be 4 bytes that won't be checked. To also check the padding 4 bytes, replace sizeof(attr_common) with offsetofend(struct bpf_common_attr, log_true_size). Fixes: f28771c0691b ("bpf: Extend BPF syscall with common attributes suppor= t") Signed-off-by: Leon Hwang --- kernel/bpf/syscall.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c index 6600e126fbfb..83de8fb9b9aa 100644 --- a/kernel/bpf/syscall.c +++ b/kernel/bpf/syscall.c @@ -6278,7 +6278,9 @@ static int __sys_bpf(enum bpf_cmd cmd, bpfptr_t uattr= , unsigned int size, =20 memset(&attr_common, 0, sizeof(attr_common)); if (cmd & BPF_COMMON_ATTRS) { - err =3D bpf_check_uarg_tail_zero(uattr_common, sizeof(attr_common), size= _common); + err =3D bpf_check_uarg_tail_zero(uattr_common, + offsetofend(struct bpf_common_attr, log_true_size), + size_common); if (err) return err; =20 --=20 2.54.0 From nobody Mon May 25 05:12:10 2026 Received: from out-171.mta1.migadu.com (out-171.mta1.migadu.com [95.215.58.171]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0AC242C0260 for ; Mon, 18 May 2026 14:56:18 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=95.215.58.171 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779116182; cv=none; b=dEN92WEL545nPTUa8h17tLM1B7QsKuAB/oSNngLyMj75obqJMQKnc4x+lLUd7E9Bh4OYDWJcTIgrQUVZeyBBpQIiEw/CjmvdB+9VqoVeQYMeXg9MmnIIeyO0v5JEe7ZUJr1sF5LIdFz6nOBuZBfyDKzAp5B4SntI7FVLRlOu7ek= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779116182; c=relaxed/simple; bh=d12FHVGA8hv5Fy901cw7hrsXXwWJys4dKS7YeItZkuI=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=Ga+19/PH6XMl7MXl2CA1RvuN+ajd0bfPBa5uHOLZ6kOtNyyar5C9lkJBjg+xjIvJkQncWqGMne5hAWaIzAp6B4uVzYX9hXtxMGvv7dPTz0B798Apwo3DNBa0BKIuND4IHMo26fGPokbL0tsacpmIsobiTWP+9gd9xxH/5u8Hmg0= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=OktUflEI; arc=none smtp.client-ip=95.215.58.171 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="OktUflEI" X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1779116175; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=8MdM+gON6cwas8DfDd9lHSjt1u4dRrEGGU3GktE4vic=; b=OktUflEIfivkW4XKnUDQRF2r+VraTIn8Ccblj4+2ZZeF0kiLp9aoqQkwtfKZxgVYQtWcvu DZUoqdyCohok5kQ8U162Q24duLJUiGd0X8YDAQVHQpV8NfPiY11R0bbqElpxXIFz9AqvXg dzXNOeC0J+MtR2Mlgwt46n745UR/jC0= From: Leon Hwang To: bpf@vger.kernel.org Cc: Alexei Starovoitov , Daniel Borkmann , Andrii Nakryiko , Martin KaFai Lau , Eduard Zingerman , Kumar Kartikeya Dwivedi , Shuah Khan , Leon Hwang , linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org, kernel-patches-bot@fb.com Subject: [PATCH bpf-next 2/5] bpf: Fix concurrent regression in map_create() Date: Mon, 18 May 2026 22:54:43 +0800 Message-ID: <20260518145446.6794-3-leon.hwang@linux.dev> In-Reply-To: <20260518145446.6794-1-leon.hwang@linux.dev> References: <20260518145446.6794-1-leon.hwang@linux.dev> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Migadu-Flow: FLOW_OUT Content-Type: text/plain; charset="utf-8" Because there is time gap between bpf_map_new_fd() and close_fd(), a concurrent thread is able to close the new fd and opens a new, unrelated file with the exact same fd number. Thereafter, this close_fd() might inadvertently close the unrelated file. To avoid such regression, drop close_fd() and override err when failed to create map and failed to finalize the log. In other word, when succeed in creating map but fail to finalize log, users will get the map fd instead of the finalization error. Fixes: 49f9b2b2a18c ("bpf: Add syscall common attributes support for map_cr= eate") Signed-off-by: Leon Hwang --- kernel/bpf/syscall.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c index 83de8fb9b9aa..322865a88b3a 100644 --- a/kernel/bpf/syscall.c +++ b/kernel/bpf/syscall.c @@ -1647,11 +1647,18 @@ static int map_create(union bpf_attr *attr, bpfptr_= t uattr, struct bpf_common_at =20 /* preserve original error even if log finalization is successful */ ret =3D bpf_log_attr_finalize(&attr_log, log); - if (ret) { - if (err >=3D 0) - close_fd(err); + if (ret && err < 0) + /* + * Failed to finalize the log. + * Should not close_fd(err) here. Since the bpf_map_new_fd() + * has published the map fd, if a concurrent thread closes the + * fd, then opens new, unrelated file that receives the exact + * same fd number, close_fd(err) might inadvertently close the + * unrelated file. + * As a trade-off, override the err only when failed to finalize + * the log and failed to create map. + */ err =3D ret; - } =20 kfree(log); return err; --=20 2.54.0 From nobody Mon May 25 05:12:10 2026 Received: from out-178.mta1.migadu.com (out-178.mta1.migadu.com [95.215.58.178]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 12BF22DC764 for ; Mon, 18 May 2026 14:56:36 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=95.215.58.178 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779116199; cv=none; b=X0bKYEdfr4bZhS49SNaUwc1FpBOyJ/X56HeTKnm9Y6WSCM8vel87gNMOjJ+lfCVGtFYJ3caVgc3pWlAeB04NOLk1qnsw2CkBw0XpVHlTCTXPdnB5I4xGp8GJSI4M1nRnrhjVI85JjGzrVcSnwZlPWPsGp5LGh+WoRMq7/JdATBE= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779116199; c=relaxed/simple; bh=pGrid/MoHWKOyHGr/hGYclFjSiLInLI58doTfChTiyQ=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=Hdhhqzhg9WC/ZxlLcHG+KPm2EuWfZv6nF55+1z2h6hI7Y0gUfNE7xwlyexXIkhZ2FFKBtYoFtzgToMqtQikEcDa6f4zEvoivYktdpZmA3g7mrvHjaKXfd56IabEOyXVYQSFrMDaf5G0eeFYGkielLBuz4No3osWVZtId933Oj78= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=e/0vf8k+; arc=none smtp.client-ip=95.215.58.178 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="e/0vf8k+" X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1779116193; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=JC5CXjDD2n44DjeRg6Hk4TrBdiWxB43TsPTPXprvrLI=; b=e/0vf8k+zvPIjaqDXm1ASgVyj7Egcg+D9gfqhxX+glr+LfFzw4zzd9tq08yGjv+oyS/PGI BVQpfhmhat/dfaDW0j3/ExK0iMkV6O5JY+Hr06iGM1IL2Y15TyegFlcedYnBmuCwckxfLl Nj4tEdRLTka2uBLyqNGyML6+fiYsccM= From: Leon Hwang To: bpf@vger.kernel.org Cc: Alexei Starovoitov , Daniel Borkmann , Andrii Nakryiko , Martin KaFai Lau , Eduard Zingerman , Kumar Kartikeya Dwivedi , Shuah Khan , Leon Hwang , linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org, kernel-patches-bot@fb.com Subject: [PATCH bpf-next 3/5] libbpf: Add OPTS_VALID() for log_opts in bpf_map_create Date: Mon, 18 May 2026 22:54:44 +0800 Message-ID: <20260518145446.6794-4-leon.hwang@linux.dev> In-Reply-To: <20260518145446.6794-1-leon.hwang@linux.dev> References: <20260518145446.6794-1-leon.hwang@linux.dev> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Migadu-Flow: FLOW_OUT Content-Type: text/plain; charset="utf-8" There should be an OPTS_VALID() check for log_opts before extracting its fields. If no such OPTS_VALID() check and an application compiled against a future libbpf header passes a log_opts with new, non-zero fields to libbpf.so, those fields will be ignored silently. Fixes: 702259006f93 ("libbpf: Add syscall common attributes support for map= _create") Signed-off-by: Leon Hwang --- tools/lib/bpf/bpf.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/tools/lib/bpf/bpf.c b/tools/lib/bpf/bpf.c index 483c02cf21d1..3cd705802330 100644 --- a/tools/lib/bpf/bpf.c +++ b/tools/lib/bpf/bpf.c @@ -246,6 +246,9 @@ int bpf_map_create(enum bpf_map_type map_type, attr.excl_prog_hash_size =3D OPTS_GET(opts, excl_prog_hash_size, 0); =20 log_opts =3D OPTS_GET(opts, log_opts, NULL); + if (!OPTS_VALID(log_opts, bpf_log_opts)) + return libbpf_err(-EINVAL); + if (log_opts && feat_supported(NULL, FEAT_BPF_SYSCALL_COMMON_ATTRS)) { memset(&attr_common, 0, attr_common_sz); attr_common.log_buf =3D ptr_to_u64(OPTS_GET(log_opts, buf, NULL)); --=20 2.54.0 From nobody Mon May 25 05:12:10 2026 Received: from out-188.mta1.migadu.com (out-188.mta1.migadu.com [95.215.58.188]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A5C592D46CE for ; Mon, 18 May 2026 14:56:45 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=95.215.58.188 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779116208; cv=none; b=tFgzEEn9JB71XI8TjzJOkuIT9FFj1nzQQtSXsRFkq8zdbbQksdJs2M7ZKPSuKLlMJoxX2BXChYUzCBWVlDk8fu5DqS8tcTQ14KYn/zsq+AzDXftjuU13NOv9mW+F9iel8Tl3yAHXlZWxDXTvyGUSw6dDHh9VyU1Ew375YnSxiFM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779116208; c=relaxed/simple; bh=GXs/KXHx/biQ2Ip988P1+V15pfIjsDzmesKmjpqYRzE=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=un88wSxe9eXCg4P5JaCVfDWEf0Mu+SkenHvSi+DEVI56jK5lSTgzprCkOg88LZgGl/lfwI3hoc20OB9kLSWv4OeaDpMEX8vaoMKll+FMq5pebjboU4iY6SIu2MVk2agL8TypBhU+Rx1gVSiWyApoRl2HUwWcNKvxxomdax247qI= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=BNPyEbeB; arc=none smtp.client-ip=95.215.58.188 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="BNPyEbeB" X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1779116203; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=bERCOBouP45WRdBJGQNPQaxTPk4LlRukZpEH/2D3fus=; b=BNPyEbeByasyGqHsJgOR1yS2SAqKvsLJaPe99p7mK5862kWPA6WcvOJ0YhNg5TPVNmeHDB JH4DY3PZNbm21r51zQ5qmVAVM/iF8Q6B51cAs428XiISWDeFWQ5Ge9Ulb9nmFTi3yC4msM n8EzgHHGt9IUA6rXO9pLK/XYLiGhjVs= From: Leon Hwang To: bpf@vger.kernel.org Cc: Alexei Starovoitov , Daniel Borkmann , Andrii Nakryiko , Martin KaFai Lau , Eduard Zingerman , Kumar Kartikeya Dwivedi , Shuah Khan , Leon Hwang , linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org, kernel-patches-bot@fb.com Subject: [PATCH bpf-next 4/5] selftests/bpf: Use -1 as token_fd in map create failure test Date: Mon, 18 May 2026 22:54:45 +0800 Message-ID: <20260518145446.6794-5-leon.hwang@linux.dev> In-Reply-To: <20260518145446.6794-1-leon.hwang@linux.dev> References: <20260518145446.6794-1-leon.hwang@linux.dev> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Migadu-Flow: FLOW_OUT Content-Type: text/plain; charset="utf-8" Because 0xFF can be an open BPF token fd in the test runner that will fail test_invalid_token_fd(), change token_fd from 0xFF to -1 to avoid such test failure. Fixes: f675483cac1d ("selftests/bpf: Add tests to verify map create failure= log") Signed-off-by: Leon Hwang --- tools/testing/selftests/bpf/prog_tests/map_init.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tools/testing/selftests/bpf/prog_tests/map_init.c b/tools/test= ing/selftests/bpf/prog_tests/map_init.c index 5c61c8e37306..b0b902d5783d 100644 --- a/tools/testing/selftests/bpf/prog_tests/map_init.c +++ b/tools/testing/selftests/bpf/prog_tests/map_init.c @@ -306,7 +306,7 @@ static void test_invalid_token_fd(void) const char *msg =3D "Invalid map_token_fd.\n"; LIBBPF_OPTS(bpf_map_create_opts, opts, .map_flags =3D BPF_F_TOKEN_FD, - .token_fd =3D 0xFF, + .token_fd =3D -1, ); =20 test_map_create_array(&opts, msg); --=20 2.54.0 From nobody Mon May 25 05:12:10 2026 Received: from out-179.mta0.migadu.com (out-179.mta0.migadu.com [91.218.175.179]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7DCC62D3A75 for ; Mon, 18 May 2026 14:57:40 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=91.218.175.179 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779116262; cv=none; b=eZ1JqxumuAQnscFDusKj7hlO/21N39bi1QwUSTZEsOTYSMbq0MFMBXCFduwlAe0hfx1YNv1UquXJDkm6XUOKRRbc5JuFrMNUn72yUD6b/lDOVlNKypkL/rm4K9o20nZPY7LlGAd0lHkpsERIKKCOqhXDN//CKqfNySjuwnVo+ns= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779116262; c=relaxed/simple; bh=MBjxKxbXAwK9VAwBTFxKQYBX2TTKUE3ckNh3M8lySQw=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=iw2FmwEYJfC/JEx+iLbQNwD9cFDiAbGpb+rkDtjmh1OEtQxos9qkwkjFA49DYLhYqkw064n6DtLukU4/mbQYOpuOgnuLxrq//YtfAVuG3pKaJ3j3W8GidxaChRVkC9acp4GPgvFqqE3k8rqp9FIwf9S7XoYwcZgskqHSYBy3OQw= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=agOkZaUZ; arc=none smtp.client-ip=91.218.175.179 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="agOkZaUZ" X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1779116247; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=GfHKvl493EpE5JNIeT3IZgK04LdQ681Vp919WD94XH0=; b=agOkZaUZGYP1r8wrsO9K2nCyYh/duMvwluGlrLTWipuARFqwSihB9YNbQNYSphr/7Qabax jU6rJOn2SXUwHIre5mjewtgWnM8dKsoZyDYIAvmGp6Fd1oSPx4kRisLrGwR48IEmmmLfBs SKkeF1PYbvrQP2RB/ppqulD9CTqRNhk= From: Leon Hwang To: bpf@vger.kernel.org Cc: Alexei Starovoitov , Daniel Borkmann , Andrii Nakryiko , Martin KaFai Lau , Eduard Zingerman , Kumar Kartikeya Dwivedi , Shuah Khan , Leon Hwang , linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org, kernel-patches-bot@fb.com Subject: [PATCH bpf-next 5/5] selftests/bpf: Add test to verify checking padding bytes for BPF syscall common attributes Date: Mon, 18 May 2026 22:54:46 +0800 Message-ID: <20260518145446.6794-6-leon.hwang@linux.dev> In-Reply-To: <20260518145446.6794-1-leon.hwang@linux.dev> References: <20260518145446.6794-1-leon.hwang@linux.dev> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Migadu-Flow: FLOW_OUT Content-Type: text/plain; charset="utf-8" Add a test to verify that the tailing padding 4 bytes are checked in syscall.c::__sys_bpf() using bpf_check_uarg_tail_zero(). Without the fix, the test fails with: test_common_attr_padding:FAIL:syscall unexpected syscall: actual 4 >=3D ex= pected 0 #213/12 map_create_failure/common_attr_padding:FAIL Signed-off-by: Leon Hwang --- .../selftests/bpf/prog_tests/map_init.c | 26 +++++++++++++++++++ 1 file changed, 26 insertions(+) diff --git a/tools/testing/selftests/bpf/prog_tests/map_init.c b/tools/test= ing/selftests/bpf/prog_tests/map_init.c index b0b902d5783d..c804c3ce9be9 100644 --- a/tools/testing/selftests/bpf/prog_tests/map_init.c +++ b/tools/testing/selftests/bpf/prog_tests/map_init.c @@ -353,6 +353,30 @@ static void test_excl_prog_hash_size_2(void) test_map_create_array(&opts, msg); } =20 +static void test_common_attr_padding(void) +{ + struct bpf_common_attr_fake { + __u8 attrs[offsetofend(struct bpf_common_attr, log_true_size)]; + __u32 pad; + } attr_common =3D { + .pad =3D 1, + }; + union bpf_attr attr =3D { + .map_type =3D BPF_MAP_TYPE_ARRAY, + .key_size =3D 4, + .value_size =3D 4, + .max_entries =3D 1, + }; + int fd; + + fd =3D syscall(__NR_bpf, BPF_MAP_CREATE | BPF_COMMON_ATTRS, &attr, sizeof= (attr), &attr_common, + sizeof(attr_common)); + if (!ASSERT_LT(fd, 0, "syscall")) + close(fd); + else + ASSERT_EQ(errno, E2BIG, "errno"); +} + void test_map_create_failure(void) { if (test__start_subtest("invalid_vmlinux_value_type_id_struct_ops")) @@ -377,4 +401,6 @@ void test_map_create_failure(void) test_excl_prog_hash_size_1(); if (test__start_subtest("invalid_excl_prog_hash_size_2")) test_excl_prog_hash_size_2(); + if (test__start_subtest("common_attr_padding")) + test_common_attr_padding(); } --=20 2.54.0