Message-ID: <sashiko-outbox-204363@kernel.org>
From: sashiko-bot@kernel.org
Subject: Re: [PATCH bpf 2/2] selftests/bpf: Test user ringbuf backlog larger
 than ring size
Reply-To: sashiko-reviews@lists.linux.dev
To: "Ren Wei" <weir@nebusec.ai>, bpf@vger.kernel.org
In-Reply-To: <080cf00ad740b4cd9af71bfc6c9e9a57a6aef693.1793951856.git.rakukuip@gmail.com>
References: <cover.1793951856.git.rakukuip@gmail.com>
 <080cf00ad740b4cd9af71bfc6c9e9a57a6aef693.1793951856.git.rakukuip@gmail.com>
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
Date: Mon, 09 Nov 2026 03:14:11 +0000
Precedence: list

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [Medium] selftests/bpf: backlog check breaks
  test_user_ringbuf_post_larger_than_ringbuf_sz()
--

commit 23d3f0e29a2def29eb8db69c2a11a7b7fed0b563
Author: Luxiao Xu <rakukuip@gmail.com>

selftests/bpf: Test user ringbuf backlog larger than ring size

This commit adds a selftest verifying that bpf_user_ringbuf_drain() returns
-EINVAL and drains no samples when producer_pos exceeds consumer_pos by more
than the ring buffer size.

> diff --git a/tools/testing/selftests/bpf/prog_tests/user_ringbuf.c b/tool=
s/testing/selftests/bpf/prog_tests/user_ringbuf.c
> index 9fd3ae9873210..b455e35d616b5 100644
> --- a/tools/testing/selftests/bpf/prog_tests/user_ringbuf.c
> +++ b/tools/testing/selftests/bpf/prog_tests/user_ringbuf.c
> @@ -280,6 +280,22 @@ static void test_user_ringbuf_post_larger_than_ringb=
uf_sz(void)
>  	user_ringbuf_success__destroy(skel);
>  }
> =20
> +static void test_user_ringbuf_post_backlog_larger_than_ringbuf_sz(void)
> +{
> +	struct user_ringbuf_success *skel;
> +	struct user_ring_buffer *ringbuf;
> +	int err;
> +	__u32 size =3D sizeof(struct sample);
> +
> +	err =3D load_skel_create_user_ringbuf(&skel, &ringbuf);
> +	if (!ASSERT_OK(err, "oversized_backlog_skel"))
> +		return;
> +
> +	manually_write_test_invalid_sample(skel, size, c_ringbuf_size * 2, -EIN=
VAL);
> +	user_ring_buffer__free(ringbuf);
> +	user_ringbuf_success__destroy(skel);
> +}

[Severity: Medium]
Does the backlog check tested here break the preceding
test_user_ringbuf_post_larger_than_ringbuf_sz() test?

test_user_ringbuf_post_larger_than_ringbuf_sz() passes size =3D c_ringbuf_s=
ize
to manually_write_test_invalid_sample(), which sets producer_pos to
c_ringbuf_size + BPF_RINGBUF_HDR_SZ and expects bpf_user_ringbuf_drain() to
return -E2BIG:

tools/testing/selftests/bpf/prog_tests/user_ringbuf.c:test_user_ringbuf_pos=
t_larger_than_ringbuf_sz() {
	...
	__u32 size =3D c_ringbuf_size;
	...
	manually_write_test_invalid_sample(skel, size, size, -E2BIG);
	...
}

With commit "bpf: Reject user ringbuf backlogs larger than total ring size",
__bpf_user_ringbuf_peek() rejects prod_pos - cons_pos >
ringbuf_total_data_sz(rb) with -EINVAL before reading the sample header:

kernel/bpf/ringbuf.c:__bpf_user_ringbuf_peek() {
	...
	if (prod_pos - cons_pos > ringbuf_total_data_sz(rb))
		return -EINVAL;
	...
	if (total_len > prod_pos - cons_pos)
		return -EINVAL;

	/* The sample must fit within the data region of the ring buffer. */
	if (total_len > ringbuf_total_data_sz(rb))
		return -E2BIG;
	...
}

Because prod_pos - cons_pos <=3D ringbuf_total_data_sz(rb) and total_len <=
=3D
prod_pos - cons_pos are both enforced first, the total_len >
ringbuf_total_data_sz(rb) check returning -E2BIG is now unreachable, and
test_user_ringbuf_post_larger_than_ringbuf_sz() fails with -EINVAL instead =
of
-E2BIG.

--=20
Sashiko AI review =C2=B7 https://sashiko.dev/#/patchset/cover.1793951856.gi=
t.rakukuip@gmail.com?part=3D2