github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-26 10:02:02 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

selftests/bpf: Test rejection of pkt args to mutating subprogs

Browse Source 
Add a selftests that ensures that PTR_TO_PACKET arguments can
only be passed to subprogs that will never adjust the underlying
packet memory, and are rejected otherwise.

Signed-off-by: Emil Tsalapatis <emil@etsalapatis.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://patch.msgid.link/20260922172028.6269-7-emil@etsalapatis.com
This commit is contained in:
Emil Tsalapatis 2026-09-22 17:20:23 +00:00 committed by Alexei Starovoitov
parent a6c1edfbe2
commit 1ed69a54d3
No known key found for this signature in database
1 changed files with 53 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

53
tools/testing/selftests/bpf/progs/verifier_global_ptr_args.c
View File

@ -350,4 +350,57 @@ int anything_to_untrusted_mem(void *ctx)
return 0;
}
struct pkt_arg {
__u64 x;
__u8 pad[56];
};
__weak int subprog_pkt_ptr_no_change(struct pkt_arg *p)
{
if (!p)
return 0;
return p->x;
}
SEC("?tc")
__success
int pkt_ptr_to_global_mem_arg_no_change(struct __sk_buff *skb)
{
void *data = (void *)(long)skb->data;
void *data_end = (void *)(long)skb->data_end;
struct pkt_arg *p = data;
if ((void *)(p + 1) > data_end)
return 0;
return subprog_pkt_ptr_no_change(p);
}
__weak int subprog_pkt_ptr_changes_data(struct __sk_buff *skb __arg_ctx,
struct pkt_arg *p)
{
if (!p)
return 0;
bpf_skb_pull_data(skb, 0);
return p->x;
}
SEC("?tc")
__failure __log_level(2)
__msg("R2 is a packet pointer, but func#{{[0-9]+}} may change packet data")
__msg("Caller passes invalid args into func#{{[0-9]+}} ('subprog_pkt_ptr_changes_data')")
int pkt_ptr_to_global_mem_arg_changes_data(struct __sk_buff *skb)
{
void *data = (void *)(long)skb->data;
void *data_end = (void *)(long)skb->data_end;
struct pkt_arg *p = data;
if ((void *)(p + 1) > data_end)
return 0;
return subprog_pkt_ptr_changes_data(skb, p);
}
char _license[] SEC("license") = "GPL";