mirror of
git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
synced 2025-08-05 16:54:27 +00:00
6991ec6beb
Test referenced kptr acquired through struct_ops argument tagged with "__ref". The success case checks whether 1) a reference to the correct type is acquired, and 2) the referenced kptr argument can be accessed in multiple paths as long as it hasn't been released. In the fail cases, we first confirm that a referenced kptr acquried through a struct_ops argument is not allowed to be leaked. Then, we make sure this new referenced kptr acquiring mechanism does not accidentally allow referenced kptrs to flow into global subprograms through their arguments. Signed-off-by: Amery Hung <amery.hung@bytedance.com> Acked-by: Eduard Zingerman <eddyz87@gmail.com> Acked-by: Martin KaFai Lau <martin.lau@kernel.org> Link: https://lore.kernel.org/r/20250217190640.1748177-4-ameryhung@gmail.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>
31 lines
869 B
C
31 lines
869 B
C
#include <vmlinux.h>
|
|
#include <bpf/bpf_tracing.h>
|
|
#include "../test_kmods/bpf_testmod.h"
|
|
#include "bpf_misc.h"
|
|
|
|
char _license[] SEC("license") = "GPL";
|
|
|
|
__attribute__((nomerge)) extern void bpf_task_release(struct task_struct *p) __ksym;
|
|
|
|
/* This is a test BPF program that uses struct_ops to access a referenced
|
|
* kptr argument. This is a test for the verifier to ensure that it
|
|
* 1) recongnizes the task as a referenced object (i.e., ref_obj_id > 0), and
|
|
* 2) the same reference can be acquired from multiple paths as long as it
|
|
* has not been released.
|
|
*/
|
|
SEC("struct_ops/test_refcounted")
|
|
int BPF_PROG(refcounted, int dummy, struct task_struct *task)
|
|
{
|
|
if (dummy == 1)
|
|
bpf_task_release(task);
|
|
else
|
|
bpf_task_release(task);
|
|
return 0;
|
|
}
|
|
|
|
SEC(".struct_ops.link")
|
|
struct bpf_testmod_ops testmod_refcounted = {
|
|
.test_refcounted = (void *)refcounted,
|
|
};
|
|
|
|
|