diff options
| author | Mykyta Yatsenko <yatsenko@meta.com> | 2026-04-16 11:08:08 -0700 |
|---|---|---|
| committer | Alexei Starovoitov <ast@kernel.org> | 2026-04-16 15:20:27 -0700 |
| commit | fcd11ff8bd0e526bdd5f43f534ccf7c4e67245ad (patch) | |
| tree | ca17da98c05eba692344987c6712f9616e13ebdb | |
| parent | 4d0a375887ab4d49e4da1ff10f9606cab8f7c3ad (diff) | |
| download | linux-fcd11ff8bd0e526bdd5f43f534ccf7c4e67245ad.tar.gz linux-fcd11ff8bd0e526bdd5f43f534ccf7c4e67245ad.zip | |
selftests/bpf: Reject scalar store into kptr slot
Verify that the verifier rejects a direct scalar write to a kptr map
value slot without crashing.
Signed-off-by: Mykyta Yatsenko <yatsenko@meta.com>
Link: https://lore.kernel.org/r/20260416-kptr_crash-v1-2-5589356584b4@meta.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
| -rw-r--r-- | tools/testing/selftests/bpf/progs/map_kptr_fail.c | 15 |
1 files changed, 15 insertions, 0 deletions
diff --git a/tools/testing/selftests/bpf/progs/map_kptr_fail.c b/tools/testing/selftests/bpf/progs/map_kptr_fail.c index 6443b320c732..ee053b24e6ca 100644 --- a/tools/testing/selftests/bpf/progs/map_kptr_fail.c +++ b/tools/testing/selftests/bpf/progs/map_kptr_fail.c @@ -385,4 +385,19 @@ int kptr_xchg_possibly_null(struct __sk_buff *ctx) return 0; } +SEC("?tc") +__failure __msg("invalid kptr access, R") +int reject_scalar_store_to_kptr(struct __sk_buff *ctx) +{ + struct map_value *v; + int key = 0; + + v = bpf_map_lookup_elem(&array_map, &key); + if (!v) + return 0; + + *(volatile u64 *)&v->unref_ptr = 0xBADC0DE; + return 0; +} + char _license[] SEC("license") = "GPL"; |