github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-07 06:17:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

selftests/bpf: Test helper read of a narrow stack spill

Browse Source 
Spill a 32-bit scalar into an 8-byte stack slot, leaving the other half
of the slot uninitialized. With CAP_BPF but without CAP_PERFMON the
verifier rejects the helper's read.

Signed-off-by: Hao Sun <sunhao.th@gmail.com>
Link: https://lore.kernel.org/bpf/20260925082814.1554771-2-sunhao.th@gmail.com
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
This commit is contained in:
Hao Sun 2026-09-25 10:28:14 +02:00 committed by Kumar Kartikeya Dwivedi
parent b3861495d2
commit 7af653d4eb
No known key found for this signature in database
GPG Key ID: 472D377B63542F83
1 changed files with 24 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
tools/testing/selftests/bpf/progs/verifier_spill_fill.c
View File

@ -1363,6 +1363,30 @@ __naked void stack_noperfmon_reject_atomic_on_narrow_spill(void)
::: __clobber_all);
}
SEC("socket")
__description("stack_noperfmon: reject helper read of narrow spill")
__success
__caps_unpriv(CAP_BPF)
__failure_unpriv __msg_unpriv("invalid read from stack R2 off -8+4 size 8")
__naked void stack_noperfmon_reject_helper_read_of_narrow_spill(void)
{
asm volatile (
"r1 = 1;"
"*(u32 *)(r10 - 8) = r1;"
"r1 = %[map_ringbuf] ll;"
"r2 = r10;"
"r2 += -8;"
"r3 = 8;"
"r4 = 0;"
"call %[bpf_ringbuf_output];"
"r0 = 0;"
"exit;"
:
: __imm(bpf_ringbuf_output),
__imm_addr(map_ringbuf)
: __clobber_all);
}
SEC("raw_tp")
__success
__naked void var_off_write_over_scalar_spill(void)