selftest/bpf: Test for use-after-free bug fix in inline_bpf_loop
authorEduard Zingerman <eddyz87@gmail.com>
Fri, 24 Jun 2022 02:06:13 +0000 (05:06 +0300)
committerDaniel Borkmann <daniel@iogearbox.net>
Fri, 24 Jun 2022 14:51:00 +0000 (16:51 +0200)
commit41188e9e9defa1678abbf860ad7f6dd1ba48ad1c
tree5dce891137cb76dba82aeaae93a6d3d990e6f75a
parentfb4e3b33e3e7f13befdf9ee232e34818c6cc5fb9
selftest/bpf: Test for use-after-free bug fix in inline_bpf_loop

This test verifies that bpf_loop() inlining works as expected when
address of `env->prog` is updated. This address is updated upon BPF
program reallocation.

Reallocation is handled by bpf_prog_realloc(), which reuses old memory
if page boundary is not crossed. The value of `len` in the test is
chosen to cross this boundary on bpf_loop() patching.

Verify that the use-after-free bug in inline_bpf_loop() reported by
Dan Carpenter is fixed.

Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/bpf/20220624020613.548108-3-eddyz87@gmail.com
tools/testing/selftests/bpf/test_verifier.c
tools/testing/selftests/bpf/verifier/bpf_loop_inline.c