github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-26 10:02:02 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

selftests/bpf: Reject iterator destruction through fp+0

Browse Source 
Add a verifier regression test that initializes a numeric iterator at fp-8
and attempts to destroy it through fp+0. The verifier must reject the
non-negative offset instead of treating it as the initialized stack slot.

Check the offset diagnostic to ensure rejection happens at the stack
object address check. The numeric iterator destroy operation is a no-op;
this test checks verifier rejection and does not run the program.

Signed-off-by: Xu Yunxiang <xyx2021@mail.ustc.edu.cn>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Reviewed-by: Sun Jian <sun.jian.kdev@gmail.com>
Link: https://lore.kernel.org/bpf/20260920210423.345636-3-xyx2021@mail.ustc.edu.cn
This commit is contained in:
Xu Yunxiang 2026-09-21 05:04:22 +08:00 committed by Andrii Nakryiko
parent 79a9172f3a
commit 8244668cbb
1 changed files with 22 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
tools/testing/selftests/bpf/progs/iters_state_safety.c
View File

@ -52,6 +52,28 @@ int create_and_destroy(void *ctx)
return 0;
}
/* fp+0 is not a stack slot. bpf_get_spi(0) used to alias spi 0 (fp-8). */
SEC("?raw_tp")
__failure __msg("cannot pass in iter at an offset=0")
int destroy_fp0_fail(void *ctx)
{
struct bpf_iter_num iter;
asm volatile ("r1 = %[iter];"
"r2 = 0;"
"r3 = 1000;"
"call %[bpf_iter_num_new];"
/* r10 is fp+0, one byte above the top of the BPF stack */
"r1 = r10;"
"call %[bpf_iter_num_destroy];"
:
: __imm_ptr(iter), ITER_HELPERS
: __clobber_common
);
return 0;
}
SEC("?raw_tp")
__failure __msg("Unreleased reference id=1")
int create_and_forget_to_destroy_fail(void *ctx)