github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-07-27 17:47:41 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

selftests/bpf: Cover dynamic inner array lookup nullability

Browse Source 
Add a verifier regression test that looks up a constant key through a
dynamic inner array template and dereferences the result without a NULL
check.

The verifier must reject the program because BPF_F_INNER_MAP allows the
concrete runtime array to have fewer entries than the template.

Signed-off-by: Nuoqi Gui <gnq25@mails.tsinghua.edu.cn>
Acked-by: Eduard Zingerman <eddyz87@gmail.com>
Acked-by: Jiri Olsa <jolsa@kernel.org>
Link: https://lore.kernel.org/bpf/20260607-f01-v2-v2-2-da48453146e8@mails.tsinghua.edu.cn
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
This commit is contained in:
Nuoqi Gui 2026-06-07 21:24:14 +08:00 committed by Kumar Kartikeya Dwivedi
parent 53040a81ae
commit a3847994b4
No known key found for this signature in database
GPG Key ID: 472D377B63542F83
1 changed files with 40 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

40
tools/testing/selftests/bpf/progs/verifier_map_in_map.c
View File

@ -18,6 +18,20 @@ struct {
});
} map_in_map SEC(".maps");
struct {
__uint(type, BPF_MAP_TYPE_ARRAY_OF_MAPS);
__uint(max_entries, 1);
__type(key, int);
__type(value, int);
__array(values, struct {
__uint(type, BPF_MAP_TYPE_ARRAY);
__uint(map_flags, BPF_F_INNER_MAP);
__uint(max_entries, 8);
__type(key, int);
__type(value, long);
});
} map_in_map_dyn SEC(".maps");
SEC("socket")
__description("map in map access")
__success __success_unpriv __retval(0)
@ -45,6 +59,32 @@ l0_%=: r0 = 0; \
: __clobber_all);
}
SEC("socket")
__description("map in map dynamic inner array lookup is nullable")
__failure __msg("invalid mem access 'map_value_or_null'")
__naked void map_in_map_dynamic_inner_array_lookup_is_nullable(void)
{
asm volatile (" \
r1 = 0; \
*(u32*)(r10 - 4) = r1; \
r2 = r10; \
r2 += -4; \
r1 = %[map_in_map_dyn] ll; \
call %[bpf_map_lookup_elem]; \
if r0 == 0 goto l0_%=; \
*(u32*)(r10 - 8) = 4; \
r2 = r10; \
r2 += -8; \
r1 = r0; \
call %[bpf_map_lookup_elem]; \
r0 = *(u64 *)(r0 + 0); \
l0_%=: exit; \
" :
: __imm(bpf_map_lookup_elem),
__imm_addr(map_in_map_dyn)
: __clobber_all);
}
SEC("xdp")
__description("map in map state pruning")
__success __msg("processed 15 insns")