selftests/bpf: Add test to verify the fix of kprobe_write_ctx abuse

Browse source

Add a test to verify the issue: kprobe_write_ctx can be abused to modify
struct pt_regs of kernel functions via kprobe_write_ctx=true freplace
progs.

Without the fix, the issue is verified:

kprobe_write_ctx=true freplace prog is allowed to attach to
kprobe_write_ctx=false kprobe prog. Then, the first arg of
bpf_fentry_test1 will be set as 0, and bpf_prog_test_run_opts() gets
-EFAULT instead of 0.

With the fix, the issue is rejected at attach time.

Acked-by: Jiri Olsa <jolsa@kernel.org>
Signed-off-by: Leon Hwang <leon.hwang@linux.dev>
Link: https://lore.kernel.org/r/20260331145353.87606-3-leon.hwang@linux.dev
Signed-off-by: Alexei Starovoitov <ast@kernel.org>

...

This commit is contained in:

Leon Hwang 2026-03-31 22:53:53 +08:00 • committed by Alexei Starovoitov

parent 611fe4b79a

commit da77f3a9aa

2 changed files with 83 additions and 0 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

64

tools/testing/selftests/bpf/prog_tests/attach_probe.c

View file

19

tools/testing/selftests/bpf/progs/kprobe_write_ctx.c

View file