selftests/bpf: Test kfunc returning zero-sized allocation buffer

Browse source

Add a test passing an explicit rdwr_buf_size of 0 to
bpf_kfunc_call_test_get_rdwr_mem() and then reading the returned R0.
R0 should be a zero-sized PTR_TO_MEM, so the access must be rejected
with "min value is outside of the allowed memory range".

This covers the pre-existing bug where a zero size argument was
treated as "no size argument": the verifier fell through to
btf_resolve_size() and sized R0 after the pointed-to return type,
wrongly allowing the read.

Suggested-by: Eduard Zingerman <eddyz87@gmail.com>
Signed-off-by: Amery Hung <ameryhung@gmail.com>
Link: https://lore.kernel.org/bpf/20260715064047.1793790-6-ameryhung@gmail.com
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>

...

This commit is contained in:

Amery Hung 2026-07-14 23:40:45 -07:00 • committed by Kumar Kartikeya Dwivedi

parent 8faaa93b9f

commit 1e63cd6be0

No known key found for this signature in database

GPG key ID: 472D377B63542F83

2 changed files with 28 additions and 0 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

1

tools/testing/selftests/bpf/prog_tests/kfunc_call.c

View file

27

tools/testing/selftests/bpf/progs/kfunc_call_fail.c

View file