mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
synced 2026-08-19 22:55:43 -04:00
da77f3a9aa
Add a test to verify the issue: kprobe_write_ctx can be abused to modify struct pt_regs of kernel functions via kprobe_write_ctx=true freplace progs. Without the fix, the issue is verified: kprobe_write_ctx=true freplace prog is allowed to attach to kprobe_write_ctx=false kprobe prog. Then, the first arg of bpf_fentry_test1 will be set as 0, and bpf_prog_test_run_opts() gets -EFAULT instead of 0. With the fix, the issue is rejected at attach time. Acked-by: Jiri Olsa <jolsa@kernel.org> Signed-off-by: Leon Hwang <leon.hwang@linux.dev> Link: https://lore.kernel.org/r/20260331145353.87606-3-leon.hwang@linux.dev Signed-off-by: Alexei Starovoitov <ast@kernel.org>
42 lines
607 B
C
42 lines
607 B
C
// SPDX-License-Identifier: GPL-2.0
|
|
#include "vmlinux.h"
|
|
#include <bpf/bpf_helpers.h>
|
|
#include <bpf/bpf_tracing.h>
|
|
|
|
char _license[] SEC("license") = "GPL";
|
|
|
|
#if defined(__TARGET_ARCH_x86)
|
|
SEC("kprobe")
|
|
int kprobe_write_ctx(struct pt_regs *ctx)
|
|
{
|
|
ctx->ax = 0;
|
|
return 0;
|
|
}
|
|
|
|
SEC("kprobe.multi")
|
|
int kprobe_multi_write_ctx(struct pt_regs *ctx)
|
|
{
|
|
ctx->ax = 0;
|
|
return 0;
|
|
}
|
|
|
|
SEC("?kprobe")
|
|
int kprobe_dummy(struct pt_regs *regs)
|
|
{
|
|
return 0;
|
|
}
|
|
|
|
SEC("?freplace")
|
|
int freplace_kprobe(struct pt_regs *regs)
|
|
{
|
|
regs->di = 0;
|
|
return 0;
|
|
}
|
|
|
|
SEC("?fentry/bpf_fentry_test1")
|
|
int BPF_PROG(fentry)
|
|
{
|
|
return 0;
|
|
}
|
|
#endif
|