selftests/bpf: don't modify the skb in the strparser parser prog

sockmap_parse_prog.c is attached as an SK_SKB stream parser and modifies
the skb: it calls bpf_skb_pull_data() and writes a byte into the packet.
A stream parser runs on strparser's message head and must not modify it.
A resize frees the frag_list segments strparser still tracks, leading to
a use-after-free.

Make the parser read-only. It only needs to return the message length,
which keeps it attaching once packet-modifying parsers are rejected.

Reviewed-by: Jiayuan Chen <jiayuan.chen@linux.dev>
Signed-off-by: Sechang Lim <rhkrqnwk98@gmail.com>
Link: https://lore.kernel.org/r/20260620024423.4141004-2-rhkrqnwk98@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>

diff --git a/tools/testing/selftests/bpf/progs/sockmap_parse_prog.c b/tools/testing/selftests/bpf/progs/sockmap_parse_prog.c
index c9abfe3a11afaa9181d48bf26c1a2b033ebe60ef..56e9aebf05f24c93c5199fc707ade78d4f6dc363 100644 (file)
--- a/tools/testing/selftests/bpf/progs/sockmap_parse_prog.c
+++ b/tools/testing/selftests/bpf/progs/sockmap_parse_prog.c
@@ -5,28 +5,6 @@
 SEC("sk_skb1")
 int bpf_prog1(struct __sk_buff *skb)
 {
-       void *data_end = (void *)(long) skb->data_end;
-       void *data = (void *)(long) skb->data;
-       __u8 *d = data;
-       int err;
-
-       if (data + 10 > data_end) {
-               err = bpf_skb_pull_data(skb, 10);
-               if (err)
-                       return SK_DROP;
-
-               data_end = (void *)(long)skb->data_end;
-               data = (void *)(long)skb->data;
-               if (data + 10 > data_end)
-                       return SK_DROP;
-       }
-
-       /* This write/read is a bit pointless but tests the verifier and
-        * strparser handler for read/write pkt data and access into sk
-        * fields.
-        */
-       d = data;
-       d[7] = 1;
        return skb->len;
 }