mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-07-22 03:27:30 -04:00
Code Issues Packages Projects Releases Wiki Activity

selftests/bpf: Add test for stack arg read without caller write

Browse Source 
Add negative tests for the outgoing stack arg validation.
A static subprog with a 'long *' arg causes
btf_prepare_func_args() to fail after setting arg_cnt. The
validation ensures check_outgoing_stack_args() still runs.

Also update two existing tests (release_ref, stale_pkt_ptr) whose
expected error messages changed: invalidated stack arg slots are now
caught by check_outgoing_stack_args() at the call site instead of
at the callee's dereference.

Signed-off-by: Yonghong Song <yonghong.song@linux.dev>
Link: https://lore.kernel.org/r/20260515225045.822104-1-yonghong.song@linux.dev
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
This commit is contained in:
Yonghong Song
2026-05-15 15:50:45 -07:00
committed by Alexei Starovoitov
parent 4286f5deee
commit ef1b54e0db
3 changed files with 68 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
tools/testing/selftests/bpf/progs/btf__verifier_stack_arg_order.c
View File

@@ -21,6 +21,10 @@ int subprog_pruning_call_before_load_6args(int a, int b, int c, int d, int e, in
return a + b + c + d + e + f;
}
void subprog_bad_ptr_7args(long *a, int b, int c, int d, int e, int f, int g)
{
}
#else
int subprog_bad_order_6args(void)
@@ -38,4 +42,8 @@ int subprog_pruning_call_before_load_6args(void)
return 0;
}
void subprog_bad_ptr_7args(void)
{
}
#endif

4
tools/testing/selftests/bpf/progs/verifier_stack_arg.c
View File

@@ -152,7 +152,7 @@ __naked void stack_arg_pruning_type_mismatch(void)
SEC("tc")
__description("stack_arg: release_reference invalidates stack arg slot")
__failure
__msg("R{{[0-9]}} !read_ok")
__msg("callee expects 6 args, stack arg1 is not initialized")
__naked void stack_arg_release_ref(void)
{
asm volatile (
@@ -201,7 +201,7 @@ __naked void stack_arg_release_ref(void)
SEC("tc")
__description("stack_arg: pkt pointer in stack arg slot invalidated after pull_data")
__failure
__msg("R{{[0-9]}} !read_ok")
__msg("callee expects 6 args, stack arg1 is not initialized")
__naked void stack_arg_stale_pkt_ptr(void)
{
asm volatile (

58
tools/testing/selftests/bpf/progs/verifier_stack_arg_order.c
View File

@@ -112,6 +112,64 @@ __naked void stack_arg_pruning_load_after_call(void)
);
}
/*
* "bad_ptr": the first arg is 'long *', which is not a recognized pointer
* type for static subprogs (not ctx, dynptr, or tagged). btf_prepare_func_args()
* sets arg_cnt = 7 / stack_arg_cnt = 2, then fails with -EINVAL. The subprog
* is marked unreliable but the call still proceeds for static subprogs.
*/
__noinline __used __naked
static void subprog_bad_ptr_7args(long *a, int b, int c, int d, int e, int f, int g)
{
asm volatile (
"r0 = *(u64 *)(r11 + 8);"
"r1 = *(u64 *)(r11 + 16);"
"exit;"
::: __clobber_all
);
}
SEC("tc")
__description("stack_arg: read without caller write")
__failure
__msg("callee expects 7 args, stack arg1 is not initialized")
__btf_func_path("btf__verifier_stack_arg_order.bpf.o")
__naked void stack_arg_read_without_write_1(void)
{
asm volatile (
"r1 = 0;"
"r2 = 0;"
"r3 = 0;"
"r4 = 0;"
"r5 = 0;"
"call subprog_bad_ptr_7args;"
"exit;"
::: __clobber_all
);
}
SEC("tc")
__description("stack_arg: read with not-initialized caller write")
__failure
__msg("R0 !read_ok")
__btf_func_path("btf__verifier_stack_arg_order.bpf.o")
__naked void stack_arg_read_without_write_2(void)
{
asm volatile (
"r1 = 0;"
"r2 = 0;"
"r3 = 0;"
"r4 = 0;"
"r5 = 0;"
"*(u64 *)(r11 - 8) = 0;"
"*(u64 *)(r11 - 16) = 0;"
"call subprog_bad_ptr_7args;"
"call subprog_bad_ptr_7args;"
"exit;"
::: __clobber_all
);
}
#else
SEC("socket")