Commit 5f3077d7 authored by Kohei Enju's avatar Kohei Enju Committed by Alexei Starovoitov
Browse files

selftests/bpf: Add selftests for load-acquire/store-release when register number is invalid 

syzbot reported out-of-bounds read in check_atomic_load/store() when the
register number is invalid in this context:
    https://syzkaller.appspot.com/bug?extid=a5964227adc0f904549c



To avoid the issue from now on, let's add tests where the register number
is invalid for load-acquire/store-release.

After discussion with Eduard, I decided to use R15 as invalid register
because the actual slab-out-of-bounds read issue occurs when the register
number is R12 or larger.

Signed-off-by: default avatarKohei Enju <enjuk@amazon.com>
Acked-by: default avatarEduard Zingerman <eddyz87@gmail.com>
Link: https://lore.kernel.org/r/20250322045340.18010-6-enjuk@amazon.com


Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
parent c03bb2fa

tools/testing/selftests/bpf/progs/verifier_load_acquire.c

+14 −0
Original line number Diff line number Diff line
@@ -189,6 +189,20 @@ __naked void load_acquire_from_sock_pointer(void) 
	: __clobber_all);

}



SEC("socket")

__description("load-acquire with invalid register R15")

__failure __failure_unpriv __msg("R15 is invalid")

__naked void load_acquire_with_invalid_reg(void)

{

	asm volatile (

	".8byte %[load_acquire_insn];" // r0 = load_acquire((u64 *)(r15 + 0));

	"exit;"

	:

	: __imm_insn(load_acquire_insn,

		     BPF_ATOMIC_OP(BPF_DW, BPF_LOAD_ACQ, BPF_REG_0, 15 /* invalid reg */, 0))

	: __clobber_all);

}



#else /* CAN_USE_LOAD_ACQ_STORE_REL */



SEC("socket")

tools/testing/selftests/bpf/progs/verifier_store_release.c

+14 −0
Original line number Diff line number Diff line
@@ -257,6 +257,20 @@ __naked void store_release_leak_pointer_to_map(void) 
	: __clobber_all);

}



SEC("socket")

__description("store-release with invalid register R15")

__failure __failure_unpriv __msg("R15 is invalid")

__naked void store_release_with_invalid_reg(void)

{

	asm volatile (

	".8byte %[store_release_insn];" // store_release((u64 *)(r15 + 0), r1);

	"exit;"

	:

	: __imm_insn(store_release_insn,

		     BPF_ATOMIC_OP(BPF_DW, BPF_STORE_REL, 15 /* invalid reg */, BPF_REG_1, 0))

	: __clobber_all);

}



#else



SEC("socket")