feat: Added bounds check for SkBuff::load_bytes and relevant integration test.

ebpf/aya-ebpf/src/programs/sk_buff.rs

@@ -7,7 +7,7 @@ use aya_ebpf_bindings::helpers::{
 };
 use aya_ebpf_cty::c_long;
 
-use crate::{EbpfContext, bindings::__sk_buff};
+use crate::{EbpfContext, bindings::__sk_buff, check_bounds_signed};
 
 pub struct SkBuff {
     pub skb: *mut __sk_buff,
@@ -85,8 +85,12 @@ impl SkBuff {
     #[inline(always)]
     pub fn load_bytes(&self, offset: usize, dst: &mut [u8]) -> Result<usize, c_long> {
         let len = usize::try_from(self.len()).map_err(|core::num::TryFromIntError { .. }| -1)?;
+        // 0 byte reads will trip the verifier. We need to ensure that the valid range of values for len is at least 1.
         let len = len.checked_sub(offset).ok_or(-1)?;
         let len = len.min(dst.len());
+        if !check_bounds_signed(len as i64, 1, dst.len() as i64) {
+            return Err(-1);
+        }
         let len_u32 = u32::try_from(len).map_err(|core::num::TryFromIntError { .. }| -1)?;
         let ret = unsafe {
             bpf_skb_load_bytes(

test/integration-ebpf/Cargo.toml

@@ -135,3 +135,7 @@ path = "src/printk_test.rs"
 [[bin]]
 name = "prog_array"
 path = "src/prog_array.rs"
+
+[[bin]]
+name = "socket_filter"
+path = "src/socket_filter.rs"

test/integration-ebpf/src/socket_filter.rs

@@ -0,0 +1,17 @@
+#![no_std]
+#![no_main]
+#![expect(unused_crate_dependencies, reason = "used in other bins")]
+
+use aya_ebpf::{macros::socket_filter, programs::SkBuffContext};
+
+#[cfg(not(test))]
+extern crate ebpf_panic;
+
+#[socket_filter]
+fn read_one(ctx: SkBuffContext) -> i64 {
+    // Read 1 byte
+    let mut dst = [0; 2];
+    let _result: Result<_, _> = ctx.load_bytes(0, &mut dst);
+
+    0
+}

test/integration-test/src/lib.rs

@@ -67,6 +67,7 @@ bpf_file!(
     UPROBE_COOKIE => "uprobe_cookie",
     PRINTK_TEST => "printk_test",
     PROG_ARRAY => "prog_array",
+    SOCKET_FILTER => "socket_filter",
 );
 
 #[cfg(test)]

test/integration-test/src/tests.rs

@@ -35,6 +35,7 @@ mod relocations;
 mod ring_buf;
 mod sk_storage;
 mod smoke;
+mod socket_filter;
 mod strncmp;
 mod tcx;
 mod uprobe_cookie;

test/integration-test/src/tests/socket_filter.rs

@@ -0,0 +1,8 @@
+use aya::{Ebpf, programs::SocketFilter};
+
+#[test]
+fn socket_filter_load() {
+    let mut bpf = Ebpf::load(crate::SOCKET_FILTER).unwrap();
+    let prog: &mut SocketFilter = bpf.program_mut("read_one").unwrap().try_into().unwrap();
+    prog.load().unwrap();
+}