Commit d2749ae8 authored by Matt Bobrowski's avatar Matt Bobrowski Committed by Alexei Starovoitov
Browse files

selftests/bpf: add test case for BPF LSM hook bpf_lsm_mmap_file 



Add a trivial test case asserting that the BPF verifier enforces
PTR_MAYBE_NULL semantics on the struct file pointer argument of BPF
LSM hook bpf_lsm_mmap_file().

Dereferencing the struct file pointer passed into bpf_lsm_mmap_file()
without explicitly performing a NULL check first should not be
permitted by the BPF verifier as it can lead to NULL pointer
dereferences and a kernel crash.

Signed-off-by: default avatarMatt Bobrowski <mattbobrowski@google.com>
Acked-by: default avatarSong Liu <song@kernel.org>
Link: https://lore.kernel.org/r/20251216133000.3690723-2-mattbobrowski@google.com


Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
parent 94e948b7

tools/testing/selftests/bpf/progs/verifier_lsm.c

+30 −1
Original line number Diff line number Diff line 
// SPDX-License-Identifier: GPL-2.0



#include <linux/bpf.h>

#include <vmlinux.h>

#include <bpf/bpf_helpers.h>

#include <bpf/bpf_tracing.h>

#include "bpf_misc.h"



SEC("lsm/file_permission")
@@ -159,4 +160,32 @@ __naked int disabled_hook_test3(void *ctx) 
	::: __clobber_all);

}



SEC("lsm/mmap_file")

__description("not null checking nullable pointer in bpf_lsm_mmap_file")

__failure __msg("R1 invalid mem access 'trusted_ptr_or_null_'")

int BPF_PROG(no_null_check, struct file *file)

{

	struct inode *inode;



	inode = file->f_inode;

	__sink(inode);



	return 0;

}



SEC("lsm/mmap_file")

__description("null checking nullable pointer in bpf_lsm_mmap_file")

__success

int BPF_PROG(null_check, struct file *file)

{

	struct inode *inode;



	if (file) {

		inode = file->f_inode;

		__sink(inode);

	}



	return 0;

}



char _license[] SEC("license") = "GPL";