| Message ID | 20240823014829.115038-2-shung-hsi.yu@suse.com (mailing list archive) |
|---|---|
| State | Handled Elsewhere |
| Delegated to: | BPF |
| Headers | show |
| Series | [stable,6.6,1/2] bpf: Fix a kernel verifier crash in stacksafe() | expand |
| Context | Check | Description |
|---|---|---|
| netdev/tree_selection | success | Guessing tree name failed - patch did not apply |
| bpf/vmtest-bpf-PR | fail | merge-conflict |
On Fri, Aug 23, 2024 at 09:48:29AM +0800, Shung-Hsi Yu wrote: > From: Yonghong Song <yonghong.song@linux.dev> > > [ Upstream commit 662c3e2db00f92e50c26e9dc4fe47c52223d9982 ] > > A selftest is added such that without the previous patch, > a crash can happen. With the previous patch, the test can > run successfully. The new test is written in a way which > mimics original crash case: > main_prog > static_prog_1 > static_prog_2 > where static_prog_1 has different paths to static_prog_2 > and some path has stack allocated and some other path > does not. A stacksafe() checking in static_prog_2() > triggered the crash. > > Signed-off-by: Yonghong Song <yonghong.song@linux.dev> > Link: https://lore.kernel.org/r/20240812214852.214037-1-yonghong.song@linux.dev > Signed-off-by: Alexei Starovoitov <ast@kernel.org> > Signed-off-by: Shung-Hsi Yu <shung-hsi.yu@suse.com> > --- > tools/testing/selftests/bpf/progs/iters.c | 54 +++++++++++++++++++++++ > 1 file changed, 54 insertions(+) Both now queued up,t hanks. gre gk-h
diff --git a/tools/testing/selftests/bpf/progs/iters.c b/tools/testing/selftests/bpf/progs/iters.c index c20c4e38b71c..5685c2810fe5 100644 --- a/tools/testing/selftests/bpf/progs/iters.c +++ b/tools/testing/selftests/bpf/progs/iters.c @@ -1411,4 +1411,58 @@ __naked int checkpoint_states_deletion(void) ); } +__u32 upper, select_n, result; +__u64 global; + +static __noinline bool nest_2(char *str) +{ + /* some insns (including branch insns) to ensure stacksafe() is triggered + * in nest_2(). This way, stacksafe() can compare frame associated with nest_1(). + */ + if (str[0] == 't') + return true; + if (str[1] == 'e') + return true; + if (str[2] == 's') + return true; + if (str[3] == 't') + return true; + return false; +} + +static __noinline bool nest_1(int n) +{ + /* case 0: allocate stack, case 1: no allocate stack */ + switch (n) { + case 0: { + char comm[16]; + + if (bpf_get_current_comm(comm, 16)) + return false; + return nest_2(comm); + } + case 1: + return nest_2((char *)&global); + default: + return false; + } +} + +SEC("raw_tp") +__success +int iter_subprog_check_stacksafe(const void *ctx) +{ + long i; + + bpf_for(i, 0, upper) { + if (!nest_1(select_n)) { + result = 1; + return 0; + } + } + + result = 2; + return 0; +} + char _license[] SEC("license") = "GPL";