github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-12 12:34:02 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

selftests/bpf: Test imprecise scalar kptr stores

Browse Source 
Add a verifier regression where an imprecise zero scalar reaches a kptr
store first and a nonzero scalar reaches the same instruction on a second
path.

Without the corresponding verifier fix, the second path is pruned and the
program is unexpectedly accepted. With the fix, the scalar range is
compared and the invalid store is rejected.

Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Link: https://lore.kernel.org/r/20260904104203.345917-7-memxor@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
This commit is contained in:
Kumar Kartikeya Dwivedi 2026-09-04 12:41:57 +02:00 committed by Alexei Starovoitov
parent ecdc504379
commit 9dcddf30ac
1 changed files with 37 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

37
tools/testing/selftests/bpf/progs/map_kptr_fail.c
View File

@ -409,4 +409,41 @@ int reject_scalar_store_to_kptr(struct __sk_buff *ctx)
return 0;
}
SEC("?tc")
__description("reject imprecise scalar store to kptr after state pruning")
__failure __msg("invalid kptr access, R7 type=scalar")
__naked void reject_imprecise_scalar_store_to_kptr(void)
{
asm volatile (
"r0 = 0;"
"*(u32 *)(r10 - 4) = r0;"
"r2 = r10;"
"r2 += -4;"
"r1 = %[array_map] ll;"
"call %[bpf_map_lookup_elem];"
"if r0 == 0 goto l2_%=;"
"r6 = r0;"
"r9 = *(u64 *)(r6 + 0);"
"if r9 != 0 goto l0_%=;"
"r7 = 0;"
".rept 10;"
"r5 = 1;"
".endr;"
"goto l1_%=;"
"l0_%=:"
"r7 = 0x4141414141414141 ll;"
".rept 10;"
"r5 = 1;"
".endr;"
"l1_%=:"
"*(u64 *)(r6 + 8) = r7;"
"l2_%=:"
"r0 = 0;"
"exit;"
:
: __imm(bpf_map_lookup_elem),
__imm_addr(array_map)
: __clobber_all);
}
char _license[] SEC("license") = "GPL";