]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
bpf: Fix partial copy of non-linear test_run output
authorSun Jian <sun.jian.kdev@gmail.com>
Wed, 17 Jun 2026 09:35:56 +0000 (17:35 +0800)
committerAlexei Starovoitov <ast@kernel.org>
Mon, 22 Jun 2026 00:55:06 +0000 (17:55 -0700)
commitb5f3534268e3f91c9d3e9dc79ee5a32555880ee9
treee25a409fca3e0d6bb4ab064832a149eeeab00445
parent3eb21c86913439043c400cf9bbc521b015084b99
bpf: Fix partial copy of non-linear test_run output

For non-linear test_run output, bpf_test_finish() derives the linear
data copy length from copy_size - frag_size. This only matches the
linear data length when copy_size is the full packet size.

When userspace provides a short data_out buffer, copy_size is clamped to
that buffer size. If copy_size is smaller than frag_size, the computed
length becomes negative and bpf_test_finish() returns -ENOSPC before
copying the packet prefix or updating data_size_out.

Compute the linear data length from the packet layout instead, and clamp
the linear copy length to copy_size. This preserves the expected
partial-copy semantics: return -ENOSPC, copy the packet prefix that fits
in data_out, and report the full packet length through data_size_out.

Fixes: 7855e0db150ad ("bpf: test_run: add xdp_shared_info pointer in bpf_test_finish signature")
Signed-off-by: Sun Jian <sun.jian.kdev@gmail.com>
Acked-by: Paul Chaignon <paul.chaignon@gmail.com>
Link: https://lore.kernel.org/r/20260617093557.63880-2-sun.jian.kdev@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
net/bpf/test_run.c