github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-07-27 17:47:41 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

selftests/bpf: Cover writable BTF field global subprog args

Browse Source 
Add a verifier test for passing a BTF-backed task_struct field pointer to a
global subprogram argument typed as writable memory.

The direct field store is already rejected.
The global subprogram path should be rejected too.
The callee must not lose the BTF pointer's read-only provenance.
It must not validate the argument as ordinary writable memory.

Signed-off-by: Nuoqi Gui <gnq25@mails.tsinghua.edu.cn>
Link: https://lore.kernel.org/bpf/20260609-f01-04-btf-writable-arg-v1-2-f449cd970669@mails.tsinghua.edu.cn
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
This commit is contained in:
Nuoqi Gui 2026-06-09 22:43:51 +08:00 committed by Kumar Kartikeya Dwivedi
parent fa75b7c85b
commit af8c3f170f
No known key found for this signature in database
GPG Key ID: 472D377B63542F83
1 changed files with 19 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
tools/testing/selftests/bpf/progs/verifier_global_ptr_args.c
View File

@ -287,6 +287,25 @@ int trusted_to_untrusted_mem(void *ctx)
return subprog_void_untrusted(bpf_get_current_task_btf());
}
__weak int subprog_write_mem_arg(int *p)
{
if (!p)
return 0;
*p = 42;
return 0;
}
SEC("?tp_btf/task_newtask")
__failure
__msg("only read is supported")
int trusted_btf_field_to_writable_mem(void *ctx)
{
struct task_struct *task = bpf_get_current_task_btf();
return subprog_write_mem_arg(&task->prio);
}
SEC("tp_btf/sys_enter")
__success
int anything_to_untrusted_mem(void *ctx)