Add a test to verify the issue: kprobe_write_ctx can be abused to modify
struct pt_regs of kernel functions via kprobe_write_ctx=true freplace
progs.
Without the fix, the issue is verified:
kprobe_write_ctx=true freplace prog is allowed to attach to
kprobe_write_ctx=false kprobe prog. Then, the first arg of
bpf_fentry_test1 will be set as 0, and bpf_prog_test_run_opts() gets
-EFAULT instead of 0.
With the fix, the issue is rejected at attach time.
Signed-off-by: Leon Hwang <leon.hwang@linux.dev>
---
.../selftests/bpf/prog_tests/attach_probe.c | 64 +++++++++++++++++++
.../selftests/bpf/progs/kprobe_write_ctx.c | 19 ++++++
2 files changed, 83 insertions(+)
diff --git a/tools/testing/selftests/bpf/prog_tests/attach_probe.c b/tools/testing/selftests/bpf/prog_tests/attach_probe.c
index 9e77e5da7097..4d253900c4ad 100644
--- a/tools/testing/selftests/bpf/prog_tests/attach_probe.c
+++ b/tools/testing/selftests/bpf/prog_tests/attach_probe.c
@@ -220,11 +220,73 @@ static void test_attach_kprobe_write_ctx(void)
kprobe_write_ctx__destroy(skel);
}
+
+static void test_freplace_kprobe_write_ctx(void)
+{
+ struct bpf_program *prog_kprobe, *prog_ext, *prog_fentry;
+ struct kprobe_write_ctx *skel_kprobe, *skel_ext = NULL;
+ struct bpf_link *link_kprobe = NULL, *link_ext = NULL;
+ int err, prog_fd;
+ LIBBPF_OPTS(bpf_kprobe_opts, kprobe_opts);
+ LIBBPF_OPTS(bpf_test_run_opts, topts);
+
+ skel_kprobe = kprobe_write_ctx__open();
+ if (!ASSERT_OK_PTR(skel_kprobe, "kprobe_write_ctx__open kprobe"))
+ return;
+
+ prog_kprobe = skel_kprobe->progs.kprobe_dummy;
+ bpf_program__set_autoload(prog_kprobe, true);
+
+ prog_fentry = skel_kprobe->progs.fentry;
+ bpf_program__set_autoload(prog_fentry, true);
+
+ err = kprobe_write_ctx__load(skel_kprobe);
+ if (!ASSERT_OK(err, "kprobe_write_ctx__load kprobe"))
+ goto out;
+
+ skel_ext = kprobe_write_ctx__open();
+ if (!ASSERT_OK_PTR(skel_ext, "kprobe_write_ctx__open ext"))
+ goto out;
+
+ prog_ext = skel_ext->progs.freplace_kprobe;
+ bpf_program__set_autoload(prog_ext, true);
+
+ prog_fd = bpf_program__fd(skel_kprobe->progs.kprobe_write_ctx);
+ bpf_program__set_attach_target(prog_ext, prog_fd, "kprobe_write_ctx");
+
+ err = kprobe_write_ctx__load(skel_ext);
+ if (!ASSERT_OK(err, "kprobe_write_ctx__load ext"))
+ goto out;
+
+ prog_fd = bpf_program__fd(prog_kprobe);
+ link_ext = bpf_program__attach_freplace(prog_ext, prog_fd, "kprobe_dummy");
+ ASSERT_ERR_PTR(link_ext, "bpf_program__attach_freplace link");
+ ASSERT_EQ(errno, EINVAL, "bpf_program__attach_freplace errno");
+
+ link_kprobe = bpf_program__attach_kprobe_opts(prog_kprobe, "bpf_fentry_test1",
+ &kprobe_opts);
+ if (!ASSERT_OK_PTR(link_kprobe, "bpf_program__attach_kprobe_opts"))
+ goto out;
+
+ err = bpf_prog_test_run_opts(bpf_program__fd(prog_fentry), &topts);
+ ASSERT_OK(err, "bpf_prog_test_run_opts");
+
+out:
+ bpf_link__destroy(link_ext);
+ bpf_link__destroy(link_kprobe);
+ kprobe_write_ctx__destroy(skel_ext);
+ kprobe_write_ctx__destroy(skel_kprobe);
+}
#else
static void test_attach_kprobe_write_ctx(void)
{
test__skip();
}
+
+static void test_freplace_kprobe_write_ctx(void)
+{
+ test__skip();
+}
#endif
static void test_attach_probe_auto(struct test_attach_probe *skel)
@@ -434,6 +496,8 @@ void test_attach_probe(void)
test_attach_kprobe_long_event_name();
if (test__start_subtest("kprobe-write-ctx"))
test_attach_kprobe_write_ctx();
+ if (test__start_subtest("freplace-kprobe-write-ctx"))
+ test_freplace_kprobe_write_ctx();
cleanup:
test_attach_probe__destroy(skel);
diff --git a/tools/testing/selftests/bpf/progs/kprobe_write_ctx.c b/tools/testing/selftests/bpf/progs/kprobe_write_ctx.c
index f77aef0474d3..adbf52afe490 100644
--- a/tools/testing/selftests/bpf/progs/kprobe_write_ctx.c
+++ b/tools/testing/selftests/bpf/progs/kprobe_write_ctx.c
@@ -19,4 +19,23 @@ int kprobe_multi_write_ctx(struct pt_regs *ctx)
ctx->ax = 0;
return 0;
}
+
+SEC("?kprobe")
+int kprobe_dummy(struct pt_regs *regs)
+{
+ return 0;
+}
+
+SEC("?freplace")
+int freplace_kprobe(struct pt_regs *regs)
+{
+ regs->di = 0;
+ return 0;
+}
+
+SEC("?fentry/bpf_fentry_test1")
+int BPF_PROG(fentry)
+{
+ return 0;
+}
#endif
--
2.53.0On Thu, Mar 26, 2026 at 10:17:18PM +0800, Leon Hwang wrote:
SNIP
> + prog_fd = bpf_program__fd(skel_kprobe->progs.kprobe_write_ctx);
> + bpf_program__set_attach_target(prog_ext, prog_fd, "kprobe_write_ctx");
> +
> + err = kprobe_write_ctx__load(skel_ext);
> + if (!ASSERT_OK(err, "kprobe_write_ctx__load ext"))
> + goto out;
> +
> + prog_fd = bpf_program__fd(prog_kprobe);
> + link_ext = bpf_program__attach_freplace(prog_ext, prog_fd, "kprobe_dummy");
> + ASSERT_ERR_PTR(link_ext, "bpf_program__attach_freplace link");
> + ASSERT_EQ(errno, EINVAL, "bpf_program__attach_freplace errno");
nit, I prefer libbpf_get_error call instead, because it's not obvious
that ASSERT_ERR_PTR sets errno, smth like:
if (!ASSERT_EQ(libbpf_get_error(link_ext), -EINVAL, ..
anyway lgtm
Acked-by: Jiri Olsa <jolsa@kernel.org>
thanks,
jirka
> +
> + link_kprobe = bpf_program__attach_kprobe_opts(prog_kprobe, "bpf_fentry_test1",
> + &kprobe_opts);
> + if (!ASSERT_OK_PTR(link_kprobe, "bpf_program__attach_kprobe_opts"))
> + goto out;
> +
> + err = bpf_prog_test_run_opts(bpf_program__fd(prog_fentry), &topts);
> + ASSERT_OK(err, "bpf_prog_test_run_opts");
> +
> +out:
> + bpf_link__destroy(link_ext);
> + bpf_link__destroy(link_kprobe);
> + kprobe_write_ctx__destroy(skel_ext);
> + kprobe_write_ctx__destroy(skel_kprobe);
> +}
> #else
> static void test_attach_kprobe_write_ctx(void)
> {
> test__skip();
> }
> +
> +static void test_freplace_kprobe_write_ctx(void)
> +{
> + test__skip();
> +}
> #endif
>
> static void test_attach_probe_auto(struct test_attach_probe *skel)
> @@ -434,6 +496,8 @@ void test_attach_probe(void)
> test_attach_kprobe_long_event_name();
> if (test__start_subtest("kprobe-write-ctx"))
> test_attach_kprobe_write_ctx();
> + if (test__start_subtest("freplace-kprobe-write-ctx"))
> + test_freplace_kprobe_write_ctx();
>
> cleanup:
> test_attach_probe__destroy(skel);
> diff --git a/tools/testing/selftests/bpf/progs/kprobe_write_ctx.c b/tools/testing/selftests/bpf/progs/kprobe_write_ctx.c
> index f77aef0474d3..adbf52afe490 100644
> --- a/tools/testing/selftests/bpf/progs/kprobe_write_ctx.c
> +++ b/tools/testing/selftests/bpf/progs/kprobe_write_ctx.c
> @@ -19,4 +19,23 @@ int kprobe_multi_write_ctx(struct pt_regs *ctx)
> ctx->ax = 0;
> return 0;
> }
> +
> +SEC("?kprobe")
> +int kprobe_dummy(struct pt_regs *regs)
> +{
> + return 0;
> +}
> +
> +SEC("?freplace")
> +int freplace_kprobe(struct pt_regs *regs)
> +{
> + regs->di = 0;
> + return 0;
> +}
> +
> +SEC("?fentry/bpf_fentry_test1")
> +int BPF_PROG(fentry)
> +{
> + return 0;
> +}
> #endif
> --
> 2.53.0
>
On 2026/3/30 17:28, Jiri Olsa wrote: > On Thu, Mar 26, 2026 at 10:17:18PM +0800, Leon Hwang wrote: > > SNIP > >> + prog_fd = bpf_program__fd(skel_kprobe->progs.kprobe_write_ctx); >> + bpf_program__set_attach_target(prog_ext, prog_fd, "kprobe_write_ctx"); >> + >> + err = kprobe_write_ctx__load(skel_ext); >> + if (!ASSERT_OK(err, "kprobe_write_ctx__load ext")) >> + goto out; >> + >> + prog_fd = bpf_program__fd(prog_kprobe); >> + link_ext = bpf_program__attach_freplace(prog_ext, prog_fd, "kprobe_dummy"); >> + ASSERT_ERR_PTR(link_ext, "bpf_program__attach_freplace link"); >> + ASSERT_EQ(errno, EINVAL, "bpf_program__attach_freplace errno"); > > nit, I prefer libbpf_get_error call instead, because it's not obvious > that ASSERT_ERR_PTR sets errno, smth like: > > if (!ASSERT_EQ(libbpf_get_error(link_ext), -EINVAL, .. > Yeah, libbpf_get_error() is better. Will use it. > anyway lgtm > > Acked-by: Jiri Olsa <jolsa@kernel.org> > Thanks for your review. Thanks, Leon [...]
© 2016 - 2026 Red Hat, Inc.