The data length of skb frags + frag_list may be greater than 0xffff, and skb_header_pointer can not handle negative offset and negative len. So here INT_MAX is used to check the validity of offset and len. And add the test case for the change. Liu Jian (3): net: Enlarge offset check value from 0xffff to INT_MAX in bpf_skb_load_bytes net: change skb_ensure_writable()'s write_len param to unsigned int type selftests: bpf: add test for skb_load_bytes include/linux/skbuff.h | 2 +- net/core/filter.c | 4 +- net/core/skbuff.c | 2 +- .../selftests/bpf/prog_tests/skb_load_bytes.c | 45 +++++++++++++++++++ .../selftests/bpf/progs/skb_load_bytes.c | 19 ++++++++ 5 files changed, 68 insertions(+), 4 deletions(-) create mode 100644 tools/testing/selftests/bpf/prog_tests/skb_load_bytes.c create mode 100644 tools/testing/selftests/bpf/progs/skb_load_bytes.c -- 2.17.1