netdev - Re: [PATCH bpf v1 2/2] selftests/bpf: Test using cgroup storage in a tail call callee program

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <d396eeba7daf48c871d9690857c060e4080489c5f5da9841ca186c6442bc205b@mail.kernel.org>
Date: Tue,  2 Dec 2025 00:35:08 +0000 (UTC)
From: bot+bpf-ci@...nel.org
To: ameryhung@...il.com,bpf@...r.kernel.org
Cc: netdev@...r.kernel.org,alexei.starovoitov@...il.com,andrii@...nel.org,daniel@...earbox.net,martin.lau@...nel.org,ameryhung@...il.com,kernel-team@...a.com,ast@...nel.org,andrii@...nel.org,daniel@...earbox.net,martin.lau@...nel.org,eddyz87@...il.com,yonghong.song@...ux.dev,clm@...a.com,ihor.solodrai@...ux.dev
Subject: Re: [PATCH bpf v1 2/2] selftests/bpf: Test using cgroup storage in a tail call callee program

> diff --git a/tools/testing/selftests/bpf/prog_tests/tailcalls.c b/tools/testing/selftests/bpf/prog_tests/tailcalls.c
> index 0ab36503c..e4a5287f1 100644
> --- a/tools/testing/selftests/bpf/prog_tests/tailcalls.c
> +++ b/tools/testing/selftests/bpf/prog_tests/tailcalls.c

[ ... ]

> @@ -1648,6 +1649,28 @@ static void test_tailcall_bpf2bpf_freplace(void)
>  	tc_bpf2bpf__destroy(tc_skel);
>  }
>
> +/*
> + * test_tail_call_cgrp_storage makes sure that callee programs cannot
> + * use cgroup storage
> + */
> +static void test_tailcall_cgrp_storage(void)
> +{
> +	int err, prog_fd, prog_array_fd, key = 0;
> +	struct tailcall_cgrp_storage *skel;
> +
> +	skel = tailcall_cgrp_storage__open_and_load();
> +	if (!ASSERT_OK_PTR(skel, "tailcall_cgrp_storage__open_and_load"))
> +		return;
> +
> +	prog_fd = bpf_program__fd(skel->progs.callee_prog);
> +	prog_array_fd = bpf_map__fd(skel->maps.prog_array);
                     ^^^^

Should the return values of bpf_program__fd() and bpf_map__fd() be
checked before use? Other tests in this file validate these return
values (see test_tailcall_1 and similar tests which check for < 0).

Without checking, if either function returns a negative error value,
bpf_map_update_elem() could fail for the wrong reason (invalid FD),
and ASSERT_ERR would still pass, potentially masking issues with the
actual kernel restriction being tested.

> +
> +	err = bpf_map_update_elem(prog_array_fd, &key, &prog_fd, BPF_ANY);
> +	ASSERT_ERR(err, "bpf_map_update_elem");
> +
> +	tailcall_cgrp_storage__destroy(skel);
> +}

[ ... ]


---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md

CI run summary: https://github.com/kernel-patches/bpf/actions/runs/19842130628