github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-07-28 10:09:10 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

selftests/bpf: Add test for stale bounds on LSM retval context load

Browse Source 
Add a verifier test that catches the stale-bounds issue fixed in the
previous patch. The test sets r6 = 0 to create known bounds, then loads
the LSM hook return value into r6 from the context. Without the fix,
the verifier intersects the retval range with the stale bounds and
incorrectly narrows r6 to a single value, pruning the fall-through
branch as dead code and missing the div-by-zero.

Suggested-by: Eduard Zingerman <eddyz87@gmail.com>
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
Acked-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://lore.kernel.org/r/20260622230123.3695446-3-tristmd@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
This commit is contained in:
Tristan Madani 2026-06-22 23:01:23 +00:00 committed by Alexei Starovoitov
parent 5e0b273e0a
commit 644332f48f
1 changed files with 15 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
tools/testing/selftests/bpf/progs/verifier_lsm.c
View File

@ -197,4 +197,19 @@ int BPF_PROG(sleepable_lsm_cgroup)
return 0;
}
SEC("lsm/file_mprotect")
__description("lsm retval load must reset stale register bounds")
__failure __msg("div by zero")
__naked int retval_load_resets_bounds(void *ctx)
{
asm volatile (
"r6 = 0;"
"r6 = *(u64 *)(r1 + 24);"
"if r6 == 0 goto +1;"
"r6 /= 0;"
"r0 = 0;"
"exit;"
::: __clobber_all);
}
char _license[] SEC("license") = "GPL";