github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-13 06:17:27 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

selftests/bpf: Add reg-invariants test for speculative pointer arithmetic

Browse Source 
An unprivileged socket filter does variable pointer arithmetic on a
PTR_TO_MAP_VALUE whose offset collapses to a constant. The Spectre-v1
speculative path used to snapshot the pointer with a const offset and an
unbounded r32, which tripped reg_bounds_sanity_check() on the following
register move.

Mark the test __success_unpriv (the speculative path only runs
unprivileged) and flag it BPF_F_TEST_REG_INVARIANTS so the invariant
violation becomes a hard load failure. The unprivileged run fails without
the verifier fix and passes with it:

  verifier_bounds/spec_ptr_alu_const_offset @unpriv:FAIL   # without fix
  verifier_bounds/spec_ptr_alu_const_offset @unpriv:OK     # with fix

Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev>
Tested-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://lore.kernel.org/bpf/20260819125840.286434-2-jiayuan.chen@linux.dev
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
This commit is contained in:
Jiayuan Chen 2026-08-19 20:58:30 +08:00 committed by Kumar Kartikeya Dwivedi
parent 150aeba624
commit 7ee2f20bf2
No known key found for this signature in database
GPG Key ID: 472D377B63542F83
1 changed files with 41 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

41
tools/testing/selftests/bpf/progs/verifier_bounds.c
View File

@ -2267,6 +2267,47 @@ __naked void deduce64_from_32_wrapping_32bit(void)
: __clobber_all);
}
/*
* Unprivileged variable pointer arithmetic on a PTR_TO_MAP_VALUE whose
* offset collapses to a constant. The Spectre-v1 speculative path snapshots
* the pointer while its r32 has just been blanked but its offset not yet
* synced; the following register move used to trip reg_bounds_sanity_check()
* ("const subreg tnum out of sync with range bounds"). With
* BPF_F_TEST_REG_INVARIANTS that violation turns into a load failure, so the
* unprivileged program must still load.
*/
SEC("socket")
__success __success_unpriv
__flag(BPF_F_TEST_REG_INVARIANTS)
__naked void spec_ptr_alu_const_offset(void)
{
asm volatile (" \
call %[bpf_ktime_get_ns]; \
*(u64*)(r10 - 16) = r0; \
r1 = 0; \
*(u64*)(r10 - 8) = r1; \
r2 = r10; \
r2 += -8; \
r1 = %[map_hash_8b] ll; \
call %[bpf_map_lookup_elem]; \
if r0 == 0 goto l0_%=; \
r1 = *(u64*)(r10 - 16); \
r2 = 0x40000000; \
if r1 > r2 goto l0_%=; \
if r1 s> 1 goto l0_%=; /* r1 in [0, 1] */ \
r0 += r1; /* ptr += bounded scalar */ \
r9 = r0; /* used to trip the warning */ \
*(u8*)(r0 + 0) = r1; \
l0_%=: r0 = 0; \
exit; \
"
:
: __imm(bpf_ktime_get_ns),
__imm(bpf_map_lookup_elem),
__imm_addr(map_hash_8b)
: __clobber_all);
}
/* Check that range_within() compares cnum ranges, not min/max projections. */
SEC("socket")
__failure __msg("div by zero")