mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-08-31 11:41:29 -04:00
Code Issues Packages Projects Releases Wiki Activity

selftests/bpf: Cover MEM_ALLOC access past object bounds

Browse Source 
Add a linked_list negative loader case for a program-BTF type whose last
member is a zero-length flexible array. The program writes through the
first flexible-array element of an object allocated by bpf_obj_new().

The verifier should reject the access when the BTF walk reaches beyond the
static size of the allocated object.

Signed-off-by: Yiyang Chen <chenyy23@mails.tsinghua.edu.cn>
Acked-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://lore.kernel.org/bpf/e36fd5d2f4047809f0e5da46a7077083297e64db.1782807039.git.chenyy23@mails.tsinghua.edu.cn
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
This commit is contained in:
Yiyang Chen
2026-06-30 08:41:27 +00:00
committed by Kumar Kartikeya Dwivedi
parent 9c9ee0324c
commit 4137bbd9af
2 changed files with 24 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
tools/testing/selftests/bpf/prog_tests/linked_list.c
View File

@@ -68,6 +68,7 @@ static struct {
{ "obj_type_id_oor", "local type ID argument must be in range [0, U32_MAX]" },
{ "obj_new_no_composite", "bpf_obj_new/bpf_percpu_obj_new type ID argument must be of a struct" },
{ "obj_new_no_struct", "bpf_obj_new/bpf_percpu_obj_new type ID argument must be of a struct" },
{ "obj_new_flex_array", "access beyond struct obj_new_flex" },
{ "obj_drop_non_zero_off", "R1 must have zero offset when passed to release func" },
{ "new_null_ret", "R0 invalid mem access 'ptr_or_null_'" },
{ "obj_new_acq", "Unreleased reference id=" },

23
tools/testing/selftests/bpf/progs/linked_list_fail.c
View File

@@ -167,6 +167,16 @@ CHECK_OP(push_back);
#undef CHECK_OP
#undef INIT
struct obj_new_flex_elem {
int lo;
int hi;
};
struct obj_new_flex {
int hdr;
struct obj_new_flex_elem cells[];
};
SEC("?kprobe/xyz")
int map_compat_kprobe(void *ctx)
{
@@ -230,6 +240,19 @@ int obj_new_no_struct(void *ctx)
return 0;
}
SEC("?tc")
int obj_new_flex_array(void *ctx)
{
struct obj_new_flex *p;
p = bpf_obj_new_impl(bpf_core_type_id_local(struct obj_new_flex), NULL);
if (!p)
return 0;
p->cells[0].hi = 42;
bpf_obj_drop_impl(p, NULL);
return 0;
}
SEC("?tc")
int obj_drop_non_zero_off(void *ctx)
{