Message-ID: <sashiko-outbox-205082@kernel.org>
From: sashiko-bot@kernel.org
Subject: Re: [PATCH bpf-next 3/9] bpf: Add log support for iter link_create
Reply-To: sashiko-reviews@lists.linux.dev
To: "Leon Hwang" <leon.hwang@linux.dev>, bpf@vger.kernel.org
Cc: linux-trace-kernel@vger.kernel.org
In-Reply-To: <20261109140816.5196-4-leon.hwang@linux.dev>
References: <20261109140816.5196-1-leon.hwang@linux.dev>
 <20261109140816.5196-4-leon.hwang@linux.dev>
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
Date: Mon, 09 Nov 2026 14:22:26 +0000
Precedence: list

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [Low] bpf: misattributed iter_info error log messages in
  bpf_iter_link_attach()
--

commit d8f64c129a2738b81f1bf280ca7bbad040d70081
Author: Leon Hwang <leon.hwang@linux.dev>

bpf: Add log support for iter link_create

This commit passes the verifier log to bpf_iter_link_attach() and logs
diagnostic messages when BPF_LINK_CREATE fails for iterator programs.

> diff --git a/kernel/bpf/bpf_iter.c b/kernel/bpf/bpf_iter.c
> index f0b29a1709357..dfefa5579e033 100644
> --- a/kernel/bpf/bpf_iter.c
> +++ b/kernel/bpf/bpf_iter.c
[ ... ]
> @@ -538,24 +539,36 @@ int bpf_iter_link_attach(const union bpf_attr *attr=
, bpfptr_t uattr,
[ ... ]
>  	if (!bpfptr_is_null(ulinfo)) {
>  		err =3D bpf_check_uarg_tail_zero(ulinfo, sizeof(linfo),
>  					       linfo_len);
> -		if (err)
> +		if (err) {
> +			bpf_log(log, "Invalid iter_info.\n");
>  			return err;
> +		}
>  		linfo_len =3D min_t(u32, linfo_len, sizeof(linfo));
> -		if (copy_from_bpfptr(&linfo, ulinfo, linfo_len))
> +		if (copy_from_bpfptr(&linfo, ulinfo, linfo_len)) {
> +			bpf_log(log, "Invalid iter_info_len.\n");
>  			return -EFAULT;
> +		}
>  	}

[Severity: Low]
Are the log messages for iter_info and iter_info_len swapped or
misattributed here?

By the time copy_from_bpfptr() runs, linfo_len has already been clamped to
sizeof(linfo), so copy_from_bpfptr() only fails when reading from the
ulinfo pointer (attr->link_create.iter_info) faults, yet it logs "Invalid
iter_info_len.".  Conversely, bpf_check_uarg_tail_zero() rejects linfo_len
values larger than PAGE_SIZE with -E2BIG without touching ulinfo, which
logs "Invalid iter_info.".

--=20
Sashiko AI review =C2=B7 https://sashiko.dev/#/patchset/20261109140816.5196=
-1-leon.hwang@linux.dev?part=3D3