selftests/bpf: Add test to verify the fix of kprobe_write_ctx abuse

Add a test to verify the issue: kprobe_write_ctx can be abused to modify
struct pt_regs of kernel functions via kprobe_write_ctx=true freplace
progs.

Without the fix, the issue is verified:

kprobe_write_ctx=true freplace prog is allowed to attach to
kprobe_write_ctx=false kprobe prog. Then, the first arg of
bpf_fentry_test1 will be set as 0, and bpf_prog_test_run_opts() gets
-EFAULT instead of 0.

With the fix, the issue is rejected at attach time.

Acked-by: Jiri Olsa <jolsa@kernel.org>
Signed-off-by: Leon Hwang <leon.hwang@linux.dev>
Link: https://lore.kernel.org/r/20260331145353.87606-3-leon.hwang@linux.dev
Signed-off-by: Alexei Starovoitov <ast@kernel.org>

diff --git a/tools/testing/selftests/bpf/prog_tests/attach_probe.c b/tools/testing/selftests/bpf/prog_tests/attach_probe.c
index 9e77e5da7097c3dc9c40c08ac752c13299b4fbce..38852df70c0d2e358a9f9d34eec4f558e98ee365 100644 (file)
--- a/tools/testing/selftests/bpf/prog_tests/attach_probe.c
+++ b/tools/testing/selftests/bpf/prog_tests/attach_probe.c
@@ -220,11 +220,73 @@ static void test_attach_kprobe_write_ctx(void)
 
        kprobe_write_ctx__destroy(skel);
 }
+
+static void test_freplace_kprobe_write_ctx(void)
+{
+       struct bpf_program *prog_kprobe, *prog_ext, *prog_fentry;
+       struct kprobe_write_ctx *skel_kprobe, *skel_ext = NULL;
+       struct bpf_link *link_kprobe = NULL, *link_ext = NULL;
+       int err, prog_fd;
+       LIBBPF_OPTS(bpf_kprobe_opts, kprobe_opts);
+       LIBBPF_OPTS(bpf_test_run_opts, topts);
+
+       skel_kprobe = kprobe_write_ctx__open();
+       if (!ASSERT_OK_PTR(skel_kprobe, "kprobe_write_ctx__open kprobe"))
+               return;
+
+       prog_kprobe = skel_kprobe->progs.kprobe_dummy;
+       bpf_program__set_autoload(prog_kprobe, true);
+
+       prog_fentry = skel_kprobe->progs.fentry;
+       bpf_program__set_autoload(prog_fentry, true);
+
+       err = kprobe_write_ctx__load(skel_kprobe);
+       if (!ASSERT_OK(err, "kprobe_write_ctx__load kprobe"))
+               goto out;
+
+       skel_ext = kprobe_write_ctx__open();
+       if (!ASSERT_OK_PTR(skel_ext, "kprobe_write_ctx__open ext"))
+               goto out;
+
+       prog_ext = skel_ext->progs.freplace_kprobe;
+       bpf_program__set_autoload(prog_ext, true);
+
+       prog_fd = bpf_program__fd(skel_kprobe->progs.kprobe_write_ctx);
+       bpf_program__set_attach_target(prog_ext, prog_fd, "kprobe_write_ctx");
+
+       err = kprobe_write_ctx__load(skel_ext);
+       if (!ASSERT_OK(err, "kprobe_write_ctx__load ext"))
+               goto out;
+
+       prog_fd = bpf_program__fd(prog_kprobe);
+       link_ext = bpf_program__attach_freplace(prog_ext, prog_fd, "kprobe_dummy");
+       ASSERT_ERR_PTR(link_ext, "bpf_program__attach_freplace link");
+       ASSERT_EQ(libbpf_get_error(link_ext), -EINVAL, "bpf_program__attach_freplace error");
+
+       link_kprobe = bpf_program__attach_kprobe_opts(prog_kprobe, "bpf_fentry_test1",
+                                                     &kprobe_opts);
+       if (!ASSERT_OK_PTR(link_kprobe, "bpf_program__attach_kprobe_opts"))
+               goto out;
+
+       err = bpf_prog_test_run_opts(bpf_program__fd(prog_fentry), &topts);
+       ASSERT_OK(err, "bpf_prog_test_run_opts");
+
+out:
+       bpf_link__destroy(link_ext);
+       bpf_link__destroy(link_kprobe);
+       kprobe_write_ctx__destroy(skel_ext);
+       kprobe_write_ctx__destroy(skel_kprobe);
+}
 #else
 static void test_attach_kprobe_write_ctx(void)
 {
        test__skip();
 }
+
+static void test_freplace_kprobe_write_ctx(void)
+{
+       test__skip();
+}
 #endif
 
 static void test_attach_probe_auto(struct test_attach_probe *skel)
@@ -434,6 +496,8 @@ void test_attach_probe(void)
                test_attach_kprobe_long_event_name();
        if (test__start_subtest("kprobe-write-ctx"))
                test_attach_kprobe_write_ctx();
+       if (test__start_subtest("freplace-kprobe-write-ctx"))
+               test_freplace_kprobe_write_ctx();
 
 cleanup:
        test_attach_probe__destroy(skel);

diff --git a/tools/testing/selftests/bpf/progs/kprobe_write_ctx.c b/tools/testing/selftests/bpf/progs/kprobe_write_ctx.c
index f77aef0474d3b61cd048a0207fbcdd4f6d82aa57..adbf52afe49067b038e362bdbd781c6b64fc6062 100644 (file)
--- a/tools/testing/selftests/bpf/progs/kprobe_write_ctx.c
+++ b/tools/testing/selftests/bpf/progs/kprobe_write_ctx.c
@@ -19,4 +19,23 @@ int kprobe_multi_write_ctx(struct pt_regs *ctx)
        ctx->ax = 0;
        return 0;
 }
+
+SEC("?kprobe")
+int kprobe_dummy(struct pt_regs *regs)
+{
+       return 0;
+}
+
+SEC("?freplace")
+int freplace_kprobe(struct pt_regs *regs)
+{
+       regs->di = 0;
+       return 0;
+}
+
+SEC("?fentry/bpf_fentry_test1")
+int BPF_PROG(fentry)
+{
+       return 0;
+}
 #endif