github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-22 12:44:03 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

selftests/bpf: Adjust bpf_map layout in verifier_map_ptr

Browse Source 
With write-only excl member removed from struct bpf_map, ops moves
to offset 32 and inner_map_meta to offset 40. Update the expected
verifier message for the former and retarget the latter at the sha
byte array, so the beyond-member-end rejection path stays covered:

  # LDLIBS=-static PKG_CONFIG='pkg-config --static' ./vmtest.sh -- ./test_progs -t verifier_map_ptr
  [...]
  #619/5   verifier_map_ptr/bpf_map_ptr: read non-existent field rejected:OK
  #619/6   verifier_map_ptr/bpf_map_ptr: read non-existent field rejected @unpriv:OK
  #619/7   verifier_map_ptr/bpf_map_ptr: read beyond sha field rejected:OK
  #619/8   verifier_map_ptr/bpf_map_ptr: read beyond sha field rejected @unpriv:OK
  #619/9   verifier_map_ptr/bpf_map_ptr: read ops field accepted:OK
  #619/10  verifier_map_ptr/bpf_map_ptr: read ops field accepted @unpriv:OK
  [...]
  #620     verifier_map_ptr_mixing:OK
  Summary: 2/20 PASSED, 0 SKIPPED, 0 FAILED

Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/bpf/20260708075343.358712-7-daniel@iogearbox.net
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
This commit is contained in:
Daniel Borkmann 2026-07-08 09:53:41 +02:00 committed by Kumar Kartikeya Dwivedi
parent 92c7717981
commit 77e5f3c914
No known key found for this signature in database
GPG Key ID: 472D377B63542F83
1 changed files with 12 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
tools/testing/selftests/bpf/progs/verifier_map_ptr.c
View File

@ -72,14 +72,15 @@ __naked void bpf_map_ptr_write_rejected(void)
/*
* struct bpf_map starts with the SHA256 hash sha[32] at offset 0 (a readable
* byte array), the u32 excl field at offset 32, and the ops pointer at offset
* 40. Reading a u32 at offset 41 reaches into the middle of the ops pointer,
* i.e. a partial pointer access, which is rejected.
* byte array), followed by the ops pointer at offset 32 and the inner_map_meta
* pointer at offset 40. Reading a u32 at offset 41 reaches into the middle of
* the inner_map_meta pointer, i.e. a partial pointer access, which is
* rejected.
*/
SEC("socket")
__description("bpf_map_ptr: read non-existent field rejected")
__failure
__msg("cannot access ptr member ops with moff 40 in struct bpf_map with off 41 size 4")
__msg("cannot access ptr member inner_map_meta with moff 40 in struct bpf_map with off 41 size 4")
__failure_unpriv
__msg_unpriv("access is allowed only to CAP_PERFMON and CAP_SYS_ADMIN")
__flag(BPF_F_ANY_ALIGNMENT)
@ -97,23 +98,23 @@ __naked void read_non_existent_field_rejected(void)
}
/*
* The u32 excl field spans offsets 32..35 (mend 36). Reading a u32 at offset
* 33 starts inside excl but extends past its end, which the verifier rejects
* The sha byte array spans offsets 0..31 (mend 32). Reading a u32 at offset
* 30 starts inside sha but extends past its end, which the verifier rejects
* as an out-of-bounds scalar access.
*/
SEC("socket")
__description("bpf_map_ptr: read beyond excl field rejected")
__description("bpf_map_ptr: read beyond sha field rejected")
__failure
__msg("access beyond the end of member excl (mend:36) in struct bpf_map with off 33 size 4")
__msg("access beyond the end of member sha (mend:32) in struct bpf_map with off 30 size 4")
__failure_unpriv
__msg_unpriv("access is allowed only to CAP_PERFMON and CAP_SYS_ADMIN")
__flag(BPF_F_ANY_ALIGNMENT)
__naked void read_beyond_excl_field_rejected(void)
__naked void read_beyond_sha_field_rejected(void)
{
asm volatile (" \
r6 = 0; \
r1 = %[map_array_48b] ll; \
r6 = *(u32*)(r1 + 33); \
r6 = *(u32*)(r1 + 30); \
r0 = 1; \
exit; \
" :
@ -131,7 +132,7 @@ __naked void ptr_read_ops_field_accepted(void)
asm volatile (" \
r6 = 0; \
r1 = %[map_array_48b] ll; \
r6 = *(u64*)(r1 + 40); \
r6 = *(u64*)(r1 + 32); \
r0 = 1; \
exit; \
" :