selftests/bpf: Reject scalar store into kptr slot

Verify that the verifier rejects a direct scalar write to a kptr map
value slot without crashing.

Signed-off-by: Mykyta Yatsenko <yatsenko@meta.com>
Link: https://lore.kernel.org/r/20260416-kptr_crash-v1-2-5589356584b4@meta.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>

diff --git a/tools/testing/selftests/bpf/progs/map_kptr_fail.c b/tools/testing/selftests/bpf/progs/map_kptr_fail.c
index 6443b320c732414c19bde9a43795e9c7b6c8e773..ee053b24e6ca6f54a2ffbd2d89bcb69cacb30c32 100644 (file)
--- a/tools/testing/selftests/bpf/progs/map_kptr_fail.c
+++ b/tools/testing/selftests/bpf/progs/map_kptr_fail.c
@@ -385,4 +385,19 @@ int kptr_xchg_possibly_null(struct __sk_buff *ctx)
        return 0;
 }
 
+SEC("?tc")
+__failure __msg("invalid kptr access, R")
+int reject_scalar_store_to_kptr(struct __sk_buff *ctx)
+{
+       struct map_value *v;
+       int key = 0;
+
+       v = bpf_map_lookup_elem(&array_map, &key);
+       if (!v)
+               return 0;
+
+       *(volatile u64 *)&v->unref_ptr = 0xBADC0DE;
+       return 0;
+}
+
 char _license[] SEC("license") = "GPL";