github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-23 05:04:02 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

selftests/bpf: Verify no non-zeroed kernel heap memory exposure

Browse Source 
When lookup element from those per-CPU maps, which have special field
in their values and their value size is not equal to roundup(value_sz, 8),
the padding size of temporary non-zeroed kernel heap memory allocated by
kvmalloc should not be exposed to user space.

Without the fix:

test_map_uninit_mem_exposure:FAIL:zeroed tail bytes unexpected memory mismatch
actual:
	2B 2B 2B 2B
expected:
	00 00 00 00

Assisted-by: Codex:gpt-5.5

Signed-off-by: Leon Hwang <leon.hwang@linux.dev>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/bpf/20260624155115.85196-3-leon.hwang@linux.dev
This commit is contained in:
Leon Hwang 2026-06-24 23:51:15 +08:00 committed by Andrii Nakryiko
parent 7cf9cd98cf
commit 163944262f
2 changed files with 80 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

68
tools/testing/selftests/bpf/prog_tests/test_map_uninit.c Normal file
View File

@ -0,0 +1,68 @@
// SPDX-License-Identifier: GPL-2.0
#include <test_progs.h>
#include "map_kptr.skel.h"
void test_map_uninit_mem_exposure(void)
{
size_t value_sz, slot_sz, lookup_sz, tail_sz;
int err, key, nr_cpus, cpu, map_fd;
__u8 *value = NULL, *zero = NULL;
struct bpf_program *prog;
struct map_kptr *skel;
nr_cpus = libbpf_num_possible_cpus();
if (!ASSERT_GT(nr_cpus, 0, "libbpf_num_possible_cpus"))
return;
skel = map_kptr__open();
if (!ASSERT_OK_PTR(skel, "map_kptr__open"))
return;
bpf_object__for_each_program(prog, skel->obj) {
err = bpf_program__set_autoload(prog, false);
if (!ASSERT_OK(err, "bpf_program__set_autoload"))
goto out;
}
err = map_kptr__load(skel);
if (!ASSERT_OK(err, "map_kptr__load"))
goto out;
value_sz = bpf_map__value_size((skel)->maps.pcpu_array);
slot_sz = roundup(value_sz, 8);
tail_sz = slot_sz - value_sz;
if (!ASSERT_NEQ(tail_sz, 0, "tail_sz"))
goto out;
lookup_sz = slot_sz * nr_cpus;
map_fd = bpf_map__fd(skel->maps.pcpu_array);
value = malloc(lookup_sz);
zero = calloc(1, tail_sz);
if (!ASSERT_OK_PTR(value, "malloc value") || !ASSERT_OK_PTR(zero, "calloc zero"))
goto out;
key = 0;
memset(value, 0x2B, lookup_sz);
err = bpf_map_update_elem(map_fd, &key, value, BPF_ANY);
if (!ASSERT_OK(err, "bpf_map_update_elem"))
goto out;
memset(value, 0xFF, lookup_sz);
err = bpf_map_lookup_elem(map_fd, &key, value);
if (!ASSERT_OK(err, "bpf_map_lookup_elem"))
goto out;
for (cpu = 0; cpu < nr_cpus; cpu++) {
__u8 *tail = value + cpu * slot_sz + value_sz;
if (!ASSERT_MEMEQ(tail, zero, tail_sz, "zeroed tail bytes"))
goto out;
}
out:
free(zero);
free(value);
map_kptr__destroy(skel);
}

12
tools/testing/selftests/bpf/progs/map_kptr.c
View File

@ -4,6 +4,18 @@
#include <bpf/bpf_helpers.h>
#include "../test_kmods/bpf_testmod_kfunc.h"
struct map_uninit_value {
struct prog_test_ref_kfunc __kptr_untrusted *unref_ptr;
__u32 data;
} __attribute__((packed));
struct {
__uint(type, BPF_MAP_TYPE_PERCPU_ARRAY);
__type(key, int);
__type(value, struct map_uninit_value);
__uint(max_entries, 1);
} pcpu_array SEC(".maps");
struct map_value {
struct prog_test_ref_kfunc __kptr_untrusted *unref_ptr;
struct prog_test_ref_kfunc __kptr *ref_ptr;