github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-11 20:13:02 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

selftests/bpf: Precision tracking across BPF_ABS subprog exit

Browse Source 
A test case checking that the verifier properly backtracks both
fallthrough and implicit subprogram exit paths modelled for
BPF_LD | BPF_ABS instruction.

Without the previous patch:
- the verifier did not call bt_subprog_enter() on the implicit
  subprogram exit path;
- bpf_pseudo_call() branch in backtrack_insn() executed
  'bpf_bt_set_frame_reg(bt, bt->frame - 1, i);' with bt->frame == 0;
- causing a segmentation fault.

Reported-by: Nicholas Carlini <npc@anthropic.com>
Suggested-by: Nicholas Carlini <npc@anthropic.com>
Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/bpf/20260901-bug-016-backtrack-ld-abs-v1-2-59368f1be435@gmail.com
This commit is contained in:
Eduard Zingerman 2026-09-02 00:28:35 -07:00 committed by Daniel Borkmann
parent 387b1baefb
commit ce6b9e5dd8
1 changed files with 51 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

51
tools/testing/selftests/bpf/progs/verifier_subprog_precision.c
View File

@ -846,4 +846,55 @@ __naked int subprog_result_tail_call(void)
);
}
__naked __noinline __used
static int ld_abs_subprog(void)
{
asm volatile (
"r6 = r1;"
"r7 = r1;"
".8byte %[ld_abs];"
"exit;"
:
: __imm_insn(ld_abs, BPF_LD_ABS(BPF_W, 0))
: __clobber_all);
}
/*
* Buggy verifier did not properly backtrack early subprogram exit
* modelled for BPF_LD | BPF_ABS instruction, causing a segfault.
*/
SEC("socket")
__success
__log_level(2)
/* early exit path */
__msg("3: (0f) r1 += r7")
__msg("mark_precise: frame0: regs=r7 stack= before 2: (bf) r1 = r10")
__msg("mark_precise: frame0: regs=r7 stack= before 9: (20) r0 = *(u32 *)skb[0]")
__msg("mark_precise: frame1: regs= stack= before 8: (bf) r7 = r1")
__msg("mark_precise: frame1: regs= stack= before 7: (bf) r6 = r1")
__msg("mark_precise: frame1: regs= stack= before 1: (85) call pc+5")
__msg("mark_precise: frame0: regs=r7 stack= before 0: (b7) r7 = -8")
/* fallthrough path */
__msg("3: (0f) r1 += r7")
__msg("mark_precise: frame0: regs=r7 stack= before 2: (bf) r1 = r10")
__msg("mark_precise: frame0: regs=r7 stack= before 10: (95) exit")
__msg("mark_precise: frame1: regs= stack= before 9: (20) r0 = *(u32 *)skb[0]")
__msg("mark_precise: frame1: regs= stack= before 8: (bf) r7 = r1")
__msg("mark_precise: frame1: regs= stack= before 7: (bf) r6 = r1")
__msg("mark_precise: frame1: regs= stack= before 1: (85) call pc+5")
__msg("mark_precise: frame0: regs=r7 stack= before 0: (b7) r7 = -8")
__naked int ld_abs_backtrack_both_paths(void)
{
asm volatile (
"r7 = -8;"
"call ld_abs_subprog;"
"r1 = r10;"
"r1 += r7;" /* mark r7 as precise */
"*(u64 *)(r1 + 0) = 0;"
"r0 = 0;"
"exit;"
::: __clobber_all
);
}
char _license[] SEC("license") = "GPL";