diff options
| author | Kohei Enju <enjuk@amazon.com> | 2025-03-22 13:52:56 +0900 |
|---|---|---|
| committer | Alexei Starovoitov <ast@kernel.org> | 2025-03-22 06:19:09 -0700 |
| commit | 5f3077d7fcd4d777b52473a7d8d6fd065a7deb20 (patch) | |
| tree | 993a4903cf9b49124c6cea0c33739ce65d8f1072 | |
| parent | c03bb2fa327e4c25d6c5360a8803a4b1cdc2d0b9 (diff) | |
selftests/bpf: Add selftests for load-acquire/store-release when register number is invalid
syzbot reported out-of-bounds read in check_atomic_load/store() when the
register number is invalid in this context:
https://syzkaller.appspot.com/bug?extid=a5964227adc0f904549c
To avoid the issue from now on, let's add tests where the register number
is invalid for load-acquire/store-release.
After discussion with Eduard, I decided to use R15 as invalid register
because the actual slab-out-of-bounds read issue occurs when the register
number is R12 or larger.
Signed-off-by: Kohei Enju <enjuk@amazon.com>
Acked-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://lore.kernel.org/r/20250322045340.18010-6-enjuk@amazon.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
| -rw-r--r-- | tools/testing/selftests/bpf/progs/verifier_load_acquire.c | 14 | ||||
| -rw-r--r-- | tools/testing/selftests/bpf/progs/verifier_store_release.c | 14 |
2 files changed, 28 insertions, 0 deletions
diff --git a/tools/testing/selftests/bpf/progs/verifier_load_acquire.c b/tools/testing/selftests/bpf/progs/verifier_load_acquire.c index 1babe9ad9b43..77698d5a19e4 100644 --- a/tools/testing/selftests/bpf/progs/verifier_load_acquire.c +++ b/tools/testing/selftests/bpf/progs/verifier_load_acquire.c @@ -189,6 +189,20 @@ __naked void load_acquire_from_sock_pointer(void) : __clobber_all); } +SEC("socket") +__description("load-acquire with invalid register R15") +__failure __failure_unpriv __msg("R15 is invalid") +__naked void load_acquire_with_invalid_reg(void) +{ + asm volatile ( + ".8byte %[load_acquire_insn];" // r0 = load_acquire((u64 *)(r15 + 0)); + "exit;" + : + : __imm_insn(load_acquire_insn, + BPF_ATOMIC_OP(BPF_DW, BPF_LOAD_ACQ, BPF_REG_0, 15 /* invalid reg */, 0)) + : __clobber_all); +} + #else /* CAN_USE_LOAD_ACQ_STORE_REL */ SEC("socket") diff --git a/tools/testing/selftests/bpf/progs/verifier_store_release.c b/tools/testing/selftests/bpf/progs/verifier_store_release.c index cd6f1e5f378b..c0442d5bb049 100644 --- a/tools/testing/selftests/bpf/progs/verifier_store_release.c +++ b/tools/testing/selftests/bpf/progs/verifier_store_release.c @@ -257,6 +257,20 @@ __naked void store_release_leak_pointer_to_map(void) : __clobber_all); } +SEC("socket") +__description("store-release with invalid register R15") +__failure __failure_unpriv __msg("R15 is invalid") +__naked void store_release_with_invalid_reg(void) +{ + asm volatile ( + ".8byte %[store_release_insn];" // store_release((u64 *)(r15 + 0), r1); + "exit;" + : + : __imm_insn(store_release_insn, + BPF_ATOMIC_OP(BPF_DW, BPF_STORE_REL, 15 /* invalid reg */, BPF_REG_1, 0)) + : __clobber_all); +} + #else SEC("socket") |