selftest/bpf: Test for use-after-free bug fix in inline_bpf_loop

Browse source

This test verifies that bpf_loop() inlining works as expected when
address of `env->prog` is updated. This address is updated upon BPF
program reallocation.

Reallocation is handled by bpf_prog_realloc(), which reuses old memory
if page boundary is not crossed. The value of `len` in the test is
chosen to cross this boundary on bpf_loop() patching.

Verify that the use-after-free bug in inline_bpf_loop() reported by
Dan Carpenter is fixed.

Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/bpf/20220624020613.548108-3-eddyz87@gmail.com

...

This commit is contained in:

Eduard Zingerman 2022-06-24 05:06:13 +03:00 • committed by Daniel Borkmann

parent fb4e3b33e3

commit 41188e9e9d

2 changed files with 50 additions and 0 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

39

tools/testing/selftests/bpf/test_verifier.c

View file

11

tools/testing/selftests/bpf/verifier/bpf_loop_inline.c

View file