mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-05-16 13:41:48 -04:00
Code Issues Packages Projects Releases Wiki Activity

selftests/bpf: Add test to verify the fix of kprobe_write_ctx abuse

Browse Source 
Add a test to verify the issue: kprobe_write_ctx can be abused to modify
struct pt_regs of kernel functions via kprobe_write_ctx=true freplace
progs.

Without the fix, the issue is verified:

kprobe_write_ctx=true freplace prog is allowed to attach to
kprobe_write_ctx=false kprobe prog. Then, the first arg of
bpf_fentry_test1 will be set as 0, and bpf_prog_test_run_opts() gets
-EFAULT instead of 0.

With the fix, the issue is rejected at attach time.

Acked-by: Jiri Olsa <jolsa@kernel.org>
Signed-off-by: Leon Hwang <leon.hwang@linux.dev>
Link: https://lore.kernel.org/r/20260331145353.87606-3-leon.hwang@linux.dev
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
This commit is contained in:
Leon Hwang
2026-03-31 22:53:53 +08:00
committed by Alexei Starovoitov
parent 611fe4b79a
commit da77f3a9aa
2 changed files with 83 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

64
tools/testing/selftests/bpf/prog_tests/attach_probe.c
View File

@@ -220,11 +220,73 @@ static void test_attach_kprobe_write_ctx(void)
kprobe_write_ctx__destroy(skel);
}
static void test_freplace_kprobe_write_ctx(void)
{
struct bpf_program *prog_kprobe, *prog_ext, *prog_fentry;
struct kprobe_write_ctx *skel_kprobe, *skel_ext = NULL;
struct bpf_link *link_kprobe = NULL, *link_ext = NULL;
int err, prog_fd;
LIBBPF_OPTS(bpf_kprobe_opts, kprobe_opts);
LIBBPF_OPTS(bpf_test_run_opts, topts);
skel_kprobe = kprobe_write_ctx__open();
if (!ASSERT_OK_PTR(skel_kprobe, "kprobe_write_ctx__open kprobe"))
return;
prog_kprobe = skel_kprobe->progs.kprobe_dummy;
bpf_program__set_autoload(prog_kprobe, true);
prog_fentry = skel_kprobe->progs.fentry;
bpf_program__set_autoload(prog_fentry, true);
err = kprobe_write_ctx__load(skel_kprobe);
if (!ASSERT_OK(err, "kprobe_write_ctx__load kprobe"))
goto out;
skel_ext = kprobe_write_ctx__open();
if (!ASSERT_OK_PTR(skel_ext, "kprobe_write_ctx__open ext"))
goto out;
prog_ext = skel_ext->progs.freplace_kprobe;
bpf_program__set_autoload(prog_ext, true);
prog_fd = bpf_program__fd(skel_kprobe->progs.kprobe_write_ctx);
bpf_program__set_attach_target(prog_ext, prog_fd, "kprobe_write_ctx");
err = kprobe_write_ctx__load(skel_ext);
if (!ASSERT_OK(err, "kprobe_write_ctx__load ext"))
goto out;
prog_fd = bpf_program__fd(prog_kprobe);
link_ext = bpf_program__attach_freplace(prog_ext, prog_fd, "kprobe_dummy");
ASSERT_ERR_PTR(link_ext, "bpf_program__attach_freplace link");
ASSERT_EQ(libbpf_get_error(link_ext), -EINVAL, "bpf_program__attach_freplace error");
link_kprobe = bpf_program__attach_kprobe_opts(prog_kprobe, "bpf_fentry_test1",
&kprobe_opts);
if (!ASSERT_OK_PTR(link_kprobe, "bpf_program__attach_kprobe_opts"))
goto out;
err = bpf_prog_test_run_opts(bpf_program__fd(prog_fentry), &topts);
ASSERT_OK(err, "bpf_prog_test_run_opts");
out:
bpf_link__destroy(link_ext);
bpf_link__destroy(link_kprobe);
kprobe_write_ctx__destroy(skel_ext);
kprobe_write_ctx__destroy(skel_kprobe);
}
#else
static void test_attach_kprobe_write_ctx(void)
{
test__skip();
}
static void test_freplace_kprobe_write_ctx(void)
{
test__skip();
}
#endif
static void test_attach_probe_auto(struct test_attach_probe *skel)
@@ -434,6 +496,8 @@ void test_attach_probe(void)
test_attach_kprobe_long_event_name();
if (test__start_subtest("kprobe-write-ctx"))
test_attach_kprobe_write_ctx();
if (test__start_subtest("freplace-kprobe-write-ctx"))
test_freplace_kprobe_write_ctx();
cleanup:
test_attach_probe__destroy(skel);

19
tools/testing/selftests/bpf/progs/kprobe_write_ctx.c
View File

@@ -19,4 +19,23 @@ int kprobe_multi_write_ctx(struct pt_regs *ctx)
ctx->ax = 0;
return 0;
}
SEC("?kprobe")
int kprobe_dummy(struct pt_regs *regs)
{
return 0;
}
SEC("?freplace")
int freplace_kprobe(struct pt_regs *regs)
{
regs->di = 0;
return 0;
}
SEC("?fentry/bpf_fentry_test1")
int BPF_PROG(fentry)
{
return 0;
}
#endif