fix: check length in SkBuff's load_bytes function#1469
fix: check length in SkBuff's load_bytes function#1469hsqStephenZhang wants to merge 3 commits intoaya-rs:mainfrom
Conversation
✅ Deploy Preview for aya-rs-docs ready!Built without sensitive environment variables
To edit notification comments on pull requests, go to your Netlify project configuration. |
There was a problem hiding this comment.
Pull request overview
This PR fixes a verifier error that occurred when using the load_bytes function in socket filter eBPF programs. The verifier was rejecting programs with "invalid zero-sized read" errors when attempting to load bytes from packets, even when the length was dynamically computed.
Changes:
- Added a zero-length check in
SkBuff::load_bytes()to return early when there are no bytes to read, preventing verifier rejection - Added integration test to verify the fix by loading a socket filter program that uses
load_bytes - Updated imports in test.rs to include necessary socket filter types
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
| ebpf/aya-ebpf/src/programs/sk_buff.rs | Added early return when computed length is zero to avoid passing zero-length reads to the verifier |
| test/integration-ebpf/src/test.rs | Added socket filter test program that exercises load_bytes to validate the fix |
| test/integration-test/src/tests/load_bytes.rs | Created integration test that loads the socket filter program to verify it passes verifier validation |
| test/integration-test/src/tests.rs | Registered the new load_bytes test module |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
|
sorry i did not check it on earlier versions. seems that it works on linux 6.12, but fails on 5.10 and 6.1 |
hsqStephenZhang
force-pushed
the
fix/load_bytes
branch
from
6ba02ec to
3543c78
Compare
|
kernel has done a lot of improvement on verifier in 6.x including tnum and range tracking, so it's a reasonable observation that it succeeded on 6.12 but not on earlier ones. |
|
I'm still trying to figure out at which kernel version it's fixed. |
Fix: #1207
Should i create a new file for the eBPF program? Though that seems odd in current integration-test's file structure.
This change is