github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-12 04:23:03 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

selftests/bpf: Cover signal tracepoint siginfo sentinels

Browse Source 
Add load-only verifier coverage for the signal_generate and
signal_deliver info arguments. The signal_generate case performs a NULL
check before dereferencing info, ensuring that merely making it nullable
cannot satisfy the test when the nonzero SEND_SIG_PRIV sentinel is used.

Both programs load successfully without the verifier fix, contrary to
their expected-failure annotations. With the fix, info is a scalar and
the attempted dereferences are rejected.

Also add success cases showing that plain raw tracepoint and tp_btf
programs can continue to read and compare the context word as a scalar.

Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Link: https://lore.kernel.org/r/20260903144433.1716731-3-memxor@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
This commit is contained in:
Kumar Kartikeya Dwivedi 2026-09-03 16:44:20 +02:00 committed by Alexei Starovoitov
parent 77515ab12e
commit d7719a1736
1 changed files with 36 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

36
tools/testing/selftests/bpf/progs/raw_tp_null_fail.c
View File

@ -22,3 +22,39 @@ int test_raw_tp_null_sched_pi_setprio_arg_2(void *ctx) {
asm volatile("r1 = *(u64 *)(r1 +8); r1 = *(u64 *)(r1 +0);" ::: __clobber_all);
return 0;
}
/* Plain raw tracepoint arguments remain scalar values. */
SEC("raw_tp/signal_generate")
__success
int test_raw_tp_signal_generate_info_scalar(void *ctx)
{
asm volatile("r1 = *(u64 *)(r1 +8); if r1 != 1 goto +0;" ::: __clobber_all);
return 0;
}
/* tp_btf programs may inspect the sentinel as a scalar value. */
SEC("tp_btf/signal_generate")
__success
int test_tp_btf_signal_generate_info_scalar(void *ctx)
{
asm volatile("r1 = *(u64 *)(r1 +8); if r1 != 1 goto +0;" ::: __clobber_all);
return 0;
}
/* SEND_SIG_PRIV is non-NULL, so a NULL check cannot make info safe. */
SEC("tp_btf/signal_generate")
__failure __msg("R1 invalid mem access 'scalar'")
int test_tp_btf_signal_generate_info_no_deref(void *ctx)
{
asm volatile("r1 = *(u64 *)(r1 +8); if r1 == 0 goto +1; "
"r1 = *(u32 *)(r1 +0);" ::: __clobber_all);
return 0;
}
SEC("tp_btf/signal_deliver")
__failure __msg("R1 invalid mem access 'scalar'")
int test_tp_btf_signal_deliver_info_no_deref(void *ctx)
{
asm volatile("r1 = *(u64 *)(r1 +8); r1 = *(u32 *)(r1 +0);" ::: __clobber_all);
return 0;
}