From nobody Mon Jun 15 20:34:29 2026 Received: from smtpout-03.galae.net (smtpout-03.galae.net [185.246.85.4]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B426936165C; Mon, 13 Apr 2026 18:29:03 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=185.246.85.4 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776104945; cv=none; b=F8cuRtwYcpWlU5//r06NcUUmrj5zNlAeaRzKJYmdMDoxL3AqxXX5Bmn5wdw1UVejW7hgc2GTWChW/s/nbG2wDEfp82XV5S0Ec1ebY0Xwc/74q3ypTCoWK83qShXJ3tbQnp3gi5eJtcS4mEK4wTxfshV+muvmsZq86MqjzNiaJ+0= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776104945; c=relaxed/simple; bh=qyLxzf8Ns2Ft5golu4A1kMhZlxoBRSzZkWlrr38IOZg=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=aCmTgnWCdVIJ6DBEHifG1OHL9QfnX8194s5WlYQM949gqg/7VHhkqeltffURxSAPBK737cXtTwnpMp1rkcHNxE2ss5mSNAXcXVwQE/Mx6ar7EErCqdT4FX7sffXAf92G2gtAj/GxhHFLZK+m313K6wQiDhrwgdTF8lSX0JM5b1U= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=bootlin.com; spf=pass smtp.mailfrom=bootlin.com; dkim=pass (2048-bit key) header.d=bootlin.com header.i=@bootlin.com header.b=cZBSYs58; arc=none smtp.client-ip=185.246.85.4 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=bootlin.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=bootlin.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=bootlin.com header.i=@bootlin.com header.b="cZBSYs58" Received: from smtpout-01.galae.net (smtpout-01.galae.net [212.83.139.233]) by smtpout-03.galae.net (Postfix) with ESMTPS id 29DF34E42977; Mon, 13 Apr 2026 18:29:02 +0000 (UTC) Received: from mail.galae.net (mail.galae.net [212.83.136.155]) by smtpout-01.galae.net (Postfix) with ESMTPS id E99BB5FFB9; Mon, 13 Apr 2026 18:29:01 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) by localhost (Mailerdaemon) with ESMTPSA id DE28C104504C2; Mon, 13 Apr 2026 20:28:55 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=bootlin.com; s=dkim; t=1776104939; h=from:subject:date:message-id:to:cc:mime-version:content-type: content-transfer-encoding:in-reply-to:references; bh=J6w/vm8RhE1QibuAbeZrZpu+mbFZf/j6v7Old22bTNI=; b=cZBSYs587EC2pPG0T0zWnt6Rm3YWgLoLQHo/fERZmvyCcXnMbHG6UHv4UW2EhRe6AcwwK4 rLJqLN0QcpxJ+eU2wnigOQQIs5tEOULYPsd1eLcu1LilosOrM1UCnTdfl+hYwGPMfNEMV/ /5Ph0br4h41uQYEnh8/FBrJsTvpWOM11sOt/QM2ZTP7geak6StbyhdakN5Z/m5BxbpCjin o8OFL6dggWmiW+3fP5D/aD3dYrcXLqeqZdzncuDbmqmu9QPwy6ZHA14bp/bp5laVHfSfBf 7xNDlnmSlRRrNNIRvXgvQWAu27n6dhrzs7GZ2IUSyjAbZY1p1dja0IfA16reIg== From: =?utf-8?q?Alexis_Lothor=C3=A9_=28eBPF_Foundation=29?= Date: Mon, 13 Apr 2026 20:28:41 +0200 Subject: [PATCH RFC bpf-next 1/8] kasan: expose generic kasan helpers Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260413-kasan-v1-1-1a5831230821@bootlin.com> References: <20260413-kasan-v1-0-1a5831230821@bootlin.com> In-Reply-To: <20260413-kasan-v1-0-1a5831230821@bootlin.com> To: Alexei Starovoitov , Daniel Borkmann , Andrii Nakryiko , Martin KaFai Lau , Eduard Zingerman , Kumar Kartikeya Dwivedi , Song Liu , Yonghong Song , Jiri Olsa , John Fastabend , "David S. Miller" , David Ahern , Thomas Gleixner , Ingo Molnar , Borislav Petkov , Dave Hansen , x86@kernel.org, "H. Peter Anvin" , Shuah Khan , Maxime Coquelin , Alexandre Torgue , Andrey Ryabinin , Alexander Potapenko , Andrey Konovalov , Dmitry Vyukov , Vincenzo Frascino , Andrew Morton Cc: ebpf@linuxfoundation.org, Bastien Curutchet , Thomas Petazzoni , Xu Kuohai , bpf@vger.kernel.org, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, linux-kselftest@vger.kernel.org, linux-stm32@st-md-mailman.stormreply.com, linux-arm-kernel@lists.infradead.org, kasan-dev@googlegroups.com, linux-mm@kvack.org, =?utf-8?q?Alexis_Lothor=C3=A9_=28eBPF_Foundation=29?= X-Mailer: b4 0.15.1 X-Last-TLS-Session-Version: TLSv1.3 In order to prepare KASAN helpers to be called from the eBPF subsystem (to add KASAN instrumentation at runtime when JITing eBPF programs), expose the __asan_{load,store}X functions in linux/kasan.h Signed-off-by: Alexis Lothor=C3=A9 (eBPF Foundation) --- include/linux/kasan.h | 13 +++++++++++++ mm/kasan/kasan.h | 10 ---------- 2 files changed, 13 insertions(+), 10 deletions(-) diff --git a/include/linux/kasan.h b/include/linux/kasan.h index 338a1921a50a..6f580d4a39e4 100644 --- a/include/linux/kasan.h +++ b/include/linux/kasan.h @@ -710,4 +710,17 @@ void kasan_non_canonical_hook(unsigned long addr); static inline void kasan_non_canonical_hook(unsigned long addr) { } #endif /* CONFIG_KASAN_GENERIC || CONFIG_KASAN_SW_TAGS */ =20 +#ifdef CONFIG_KASAN_GENERIC +void __asan_load1(void *p); +void __asan_store1(void *p); +void __asan_load2(void *p); +void __asan_store2(void *p); +void __asan_load4(void *p); +void __asan_store4(void *p); +void __asan_load8(void *p); +void __asan_store8(void *p); +void __asan_load16(void *p); +void __asan_store16(void *p); +#endif /* CONFIG_KASAN_GENERIC */ + #endif /* LINUX_KASAN_H */ diff --git a/mm/kasan/kasan.h b/mm/kasan/kasan.h index fc9169a54766..3bfce8eb3135 100644 --- a/mm/kasan/kasan.h +++ b/mm/kasan/kasan.h @@ -594,16 +594,6 @@ void __asan_handle_no_return(void); void __asan_alloca_poison(void *, ssize_t size); void __asan_allocas_unpoison(void *stack_top, ssize_t stack_bottom); =20 -void __asan_load1(void *); -void __asan_store1(void *); -void __asan_load2(void *); -void __asan_store2(void *); -void __asan_load4(void *); -void __asan_store4(void *); -void __asan_load8(void *); -void __asan_store8(void *); -void __asan_load16(void *); -void __asan_store16(void *); void __asan_loadN(void *, ssize_t size); void __asan_storeN(void *, ssize_t size); =20 --=20 2.53.0 From nobody Mon Jun 15 20:34:29 2026 Received: from smtpout-04.galae.net (smtpout-04.galae.net [185.171.202.116]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4B405371D0A; Mon, 13 Apr 2026 18:29:06 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=185.171.202.116 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776104947; cv=none; b=ROj/MC8ImRQ6g9KvEi6SrULu8/EO54ImmyOUTOWefpMxk26gktx00Ey4Jpn0htUXyDhLg2HoRmXKSdwAMtAmZ6/XBBprN4Ck/SjueCTTG/zPTVNynzwOLPacMOGpSAIwn66iQsUCHrImI0SuMdP0htrzrWp7Gbn0lGTzeI0J2xA= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776104947; c=relaxed/simple; bh=CyXCnBYI4nO8j+gMWgeD9gHLhICP6hs4mZuFbIzDQAo=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=OmGDE9SK3B9nZx4UoDDemZ9bMgsdTi7nyu7ROO5og5sGYAqiX6o4+BKcw/qGcTicGVxnWQ73XT8LBdKwoTeDyrbpnQsTlcPExhDi1Uizrdgp0FLbM9dm/df0y4xN57okr4ktTqMyQpCMv48PtiqVaHAdogBWkVYP4QyA26TZo+A= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=bootlin.com; spf=pass smtp.mailfrom=bootlin.com; dkim=pass (2048-bit key) header.d=bootlin.com header.i=@bootlin.com header.b=KLIXIQrj; arc=none smtp.client-ip=185.171.202.116 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=bootlin.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=bootlin.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=bootlin.com header.i=@bootlin.com header.b="KLIXIQrj" Received: from smtpout-01.galae.net (smtpout-01.galae.net [212.83.139.233]) by smtpout-04.galae.net (Postfix) with ESMTPS id A43C0C5B1AD; Mon, 13 Apr 2026 18:29:41 +0000 (UTC) Received: from mail.galae.net (mail.galae.net [212.83.136.155]) by smtpout-01.galae.net (Postfix) with ESMTPS id F191C5FFB9; Mon, 13 Apr 2026 18:29:04 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) by localhost (Mailerdaemon) with ESMTPSA id C7044104504B7; Mon, 13 Apr 2026 20:28:59 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=bootlin.com; s=dkim; t=1776104943; h=from:subject:date:message-id:to:cc:mime-version:content-type: content-transfer-encoding:in-reply-to:references; bh=SIbaQ9mg0ZbtaBPZTfhJW0y4Oug6knq3Mk42IMQtkEk=; b=KLIXIQrj/Dt6o6ylVSJmfcaGlqn8TQDRCQGBXVjGupGskDl9p5aoxmau6a5GMRftUxpFpP XXob2LzYqw709cOvxQ5a6hZGYrx/bejjqgSFQM7M3yCVGCevkepZRsrW22JHoJF1sJdmYj i+d3PdzlC1LjCfqZTgrnQ66Lzt9Q7VBJLIq352bEOs30qOllcgBqkwoZ+xBRxoIMSjdmbG 2XqEp8UhjW1u3aJYbkCV4oPPq+JzqKyxPU/N6g+sv8PuS6VSbWtBmO71EcZ3QVymVhCtlo qjIaEb+/iC68dcXGm9wEQ/ZTOVEQ204pR+3wpucVloW80kqFyZL8TKyYRm8oKQ== From: =?utf-8?q?Alexis_Lothor=C3=A9_=28eBPF_Foundation=29?= Date: Mon, 13 Apr 2026 20:28:42 +0200 Subject: [PATCH RFC bpf-next 2/8] bpf: mark instructions accessing program stack Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260413-kasan-v1-2-1a5831230821@bootlin.com> References: <20260413-kasan-v1-0-1a5831230821@bootlin.com> In-Reply-To: <20260413-kasan-v1-0-1a5831230821@bootlin.com> To: Alexei Starovoitov , Daniel Borkmann , Andrii Nakryiko , Martin KaFai Lau , Eduard Zingerman , Kumar Kartikeya Dwivedi , Song Liu , Yonghong Song , Jiri Olsa , John Fastabend , "David S. Miller" , David Ahern , Thomas Gleixner , Ingo Molnar , Borislav Petkov , Dave Hansen , x86@kernel.org, "H. Peter Anvin" , Shuah Khan , Maxime Coquelin , Alexandre Torgue , Andrey Ryabinin , Alexander Potapenko , Andrey Konovalov , Dmitry Vyukov , Vincenzo Frascino , Andrew Morton Cc: ebpf@linuxfoundation.org, Bastien Curutchet , Thomas Petazzoni , Xu Kuohai , bpf@vger.kernel.org, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, linux-kselftest@vger.kernel.org, linux-stm32@st-md-mailman.stormreply.com, linux-arm-kernel@lists.infradead.org, kasan-dev@googlegroups.com, linux-mm@kvack.org, =?utf-8?q?Alexis_Lothor=C3=A9_=28eBPF_Foundation=29?= X-Mailer: b4 0.15.1 X-Last-TLS-Session-Version: TLSv1.3 In order to prepare to emit KASAN checks in JITed programs, JIT compilers need to be aware about whether some load/store instructions are targeting the bpf program stack, as those should not be monitored (we already have guard pages for that, and it is difficult anyway to correctly monitor any kind of data passed on stack). To support this need, make the BPF verifier mark the instructions that access program stack: - add a setter that allows the verifier to mark instructions accessing the program stack - add a getter that allows JIT compilers to check whether instructions being JITed are accessing the stack Signed-off-by: Alexis Lothor=C3=A9 (eBPF Foundation) --- include/linux/bpf.h | 2 ++ include/linux/bpf_verifier.h | 2 ++ kernel/bpf/core.c | 10 ++++++++++ kernel/bpf/verifier.c | 7 +++++++ 4 files changed, 21 insertions(+) diff --git a/include/linux/bpf.h b/include/linux/bpf.h index b4b703c90ca9..774a0395c498 100644 --- a/include/linux/bpf.h +++ b/include/linux/bpf.h @@ -1543,6 +1543,8 @@ void bpf_jit_uncharge_modmem(u32 size); bool bpf_prog_has_trampoline(const struct bpf_prog *prog); bool bpf_insn_is_indirect_target(const struct bpf_verifier_env *env, const= struct bpf_prog *prog, int insn_idx); +bool bpf_insn_accesses_stack(const struct bpf_verifier_env *env, + const struct bpf_prog *prog, int insn_idx); #else static inline int bpf_trampoline_link_prog(struct bpf_tramp_link *link, struct bpf_trampoline *tr, diff --git a/include/linux/bpf_verifier.h b/include/linux/bpf_verifier.h index b148f816f25b..ab99ed4c4227 100644 --- a/include/linux/bpf_verifier.h +++ b/include/linux/bpf_verifier.h @@ -660,6 +660,8 @@ struct bpf_insn_aux_data { u16 const_reg_map_mask; u16 const_reg_subprog_mask; u32 const_reg_vals[10]; + /* instruction accesses stack */ + bool accesses_stack; }; =20 #define MAX_USED_MAPS 64 /* max number of maps accessed by one eBPF progra= m */ diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c index 8b018ff48875..340abfdadbed 100644 --- a/kernel/bpf/core.c +++ b/kernel/bpf/core.c @@ -1582,6 +1582,16 @@ bool bpf_insn_is_indirect_target(const struct bpf_ve= rifier_env *env, const struc insn_idx +=3D prog->aux->subprog_start; return env->insn_aux_data[insn_idx].indirect_target; } + +bool bpf_insn_accesses_stack(const struct bpf_verifier_env *env, + const struct bpf_prog *prog, int insn_idx) +{ + if (!env) + return false; + insn_idx +=3D prog->aux->subprog_start; + return env->insn_aux_data[insn_idx].accesses_stack; +} + #endif /* CONFIG_BPF_JIT */ =20 /* Base function for offset calculation. Needs to go into .text section, diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index 1e36b9e91277..7bce4fb4e540 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -3502,6 +3502,11 @@ static void mark_indirect_target(struct bpf_verifier= _env *env, int idx) env->insn_aux_data[idx].indirect_target =3D true; } =20 +static void mark_insn_accesses_stack(struct bpf_verifier_env *env, int idx) +{ + env->insn_aux_data[idx].accesses_stack =3D true; +} + #define LR_FRAMENO_BITS 3 #define LR_SPI_BITS 6 #define LR_ENTRY_BITS (LR_SPI_BITS + LR_FRAMENO_BITS + 1) @@ -6490,6 +6495,8 @@ static int check_mem_access(struct bpf_verifier_env *= env, int insn_idx, u32 regn else err =3D check_stack_write(env, regno, off, size, value_regno, insn_idx); + + mark_insn_accesses_stack(env, insn_idx); } else if (reg_is_pkt_pointer(reg)) { if (t =3D=3D BPF_WRITE && !may_access_direct_pkt_data(env, NULL, t)) { verbose(env, "cannot write into packet\n"); --=20 2.53.0 From nobody Mon Jun 15 20:34:29 2026 Received: from smtpout-03.galae.net (smtpout-03.galae.net [185.246.85.4]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B5DA2366558; Mon, 13 Apr 2026 18:29:10 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=185.246.85.4 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776104952; cv=none; b=as1QjGYw8zPqkwvrFKg101neETCt7gSmFUn0zMMlvQS/Di+0Gg291vvjVmXOUGlO/63b0RGCB8axstCy9osL7VrVTcATeOht3xR/ApDNedBUpvLu0I5EZJ2SYcsSctORjQFkrJaZe743BnRjBDYHj4AWr2scNo7W7qXhD7mzFYk= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776104952; c=relaxed/simple; bh=3ul6pNpfIDYIoIgtbAHLVhrZyDiXJucBKhqtFXPWeuA=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=VchXgQvHSF/NTDkJx32nYEz+AllYZVvrtdprkeRsWZzN98X6rxw/Rm2RQOl6xGPYM9YfFTFcHu7HkpiHNLy9VXKzY/yOkrXI7IiNC5lMTL0j8c6eRXlW/s1wfIqNkCoztLuY6nY5aEjPo2Wz2YRiNKXyyi6iKuHen48anzmORyM= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=bootlin.com; spf=pass smtp.mailfrom=bootlin.com; dkim=pass (2048-bit key) header.d=bootlin.com header.i=@bootlin.com header.b=o44sVXLe; arc=none smtp.client-ip=185.246.85.4 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=bootlin.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=bootlin.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=bootlin.com header.i=@bootlin.com header.b="o44sVXLe" Received: from smtpout-01.galae.net (smtpout-01.galae.net [212.83.139.233]) by smtpout-03.galae.net (Postfix) with ESMTPS id 6B07A4E42977; Mon, 13 Apr 2026 18:29:09 +0000 (UTC) Received: from mail.galae.net (mail.galae.net [212.83.136.155]) by smtpout-01.galae.net (Postfix) with ESMTPS id 40C755FFB9; Mon, 13 Apr 2026 18:29:09 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) by localhost (Mailerdaemon) with ESMTPSA id 8D5D4104504DF; Mon, 13 Apr 2026 20:29:03 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=bootlin.com; s=dkim; t=1776104947; h=from:subject:date:message-id:to:cc:mime-version:content-type: content-transfer-encoding:in-reply-to:references; bh=Y5yh+jPLjYdbpM+lAMSIEbKZx9jBkdUNIqhhBJUSD7U=; b=o44sVXLepMBqSnOEDpzehWYEkyLJ277S4ZD0mX5x0/hGbON8nbocYIKweTKmZgSaODHeop Gk1QZ0KlMKDF6U1D/i7rG0MsPoJurHcz2wDn/C9O4mxht3VdU9u8za91gWE95CrtwzSa2w o2xxrib2bvulpRAYCkWrLZAtfAw9kTqQn74z1/EQj7LuL/TVuTGJM10yXYkNFUqAiZGL5L CMOT2PZnOSIQuXQLtFWLrdTzAkeZuuzxsF2HCU5UG2JVuExsPqUjNkFb/FdLta7lUaCx8Y XLZbAmvi9zcDbQVvjBohG/kgnUmIxAsfWXAYZsXwpmK2NQb3P7FKaD7qaDJQrQ== From: =?utf-8?q?Alexis_Lothor=C3=A9_=28eBPF_Foundation=29?= Date: Mon, 13 Apr 2026 20:28:43 +0200 Subject: [PATCH RFC bpf-next 3/8] bpf: add BPF_JIT_KASAN for KASAN instrumentation of JITed programs Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260413-kasan-v1-3-1a5831230821@bootlin.com> References: <20260413-kasan-v1-0-1a5831230821@bootlin.com> In-Reply-To: <20260413-kasan-v1-0-1a5831230821@bootlin.com> To: Alexei Starovoitov , Daniel Borkmann , Andrii Nakryiko , Martin KaFai Lau , Eduard Zingerman , Kumar Kartikeya Dwivedi , Song Liu , Yonghong Song , Jiri Olsa , John Fastabend , "David S. Miller" , David Ahern , Thomas Gleixner , Ingo Molnar , Borislav Petkov , Dave Hansen , x86@kernel.org, "H. Peter Anvin" , Shuah Khan , Maxime Coquelin , Alexandre Torgue , Andrey Ryabinin , Alexander Potapenko , Andrey Konovalov , Dmitry Vyukov , Vincenzo Frascino , Andrew Morton Cc: ebpf@linuxfoundation.org, Bastien Curutchet , Thomas Petazzoni , Xu Kuohai , bpf@vger.kernel.org, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, linux-kselftest@vger.kernel.org, linux-stm32@st-md-mailman.stormreply.com, linux-arm-kernel@lists.infradead.org, kasan-dev@googlegroups.com, linux-mm@kvack.org, =?utf-8?q?Alexis_Lothor=C3=A9_=28eBPF_Foundation=29?= X-Mailer: b4 0.15.1 X-Last-TLS-Session-Version: TLSv1.3 Add a new Kconfig option CONFIG_BPF_JIT_KASAN that automatically enables KASAN (Kernel Address Sanitizer) memory access checks for JIT-compiled BPF programs, when both KASAN and JIT compiler are enabled. When enabled, the JIT compiler will emit shadow memory checks before memory loads and stores to detect use-after-free, out-of-bounds, and other memory safety bugs at runtime. The option is gated behind HAVE_EBPF_JIT_KASAN, as it needs proper arch-specific implementation. Signed-off-by: Alexis Lothor=C3=A9 (eBPF Foundation) --- kernel/bpf/Kconfig | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/kernel/bpf/Kconfig b/kernel/bpf/Kconfig index eb3de35734f0..28392adb3d7e 100644 --- a/kernel/bpf/Kconfig +++ b/kernel/bpf/Kconfig @@ -17,6 +17,10 @@ config HAVE_CBPF_JIT config HAVE_EBPF_JIT bool =20 +# KASAN support for JIT compiler +config HAVE_EBPF_JIT_KASAN + bool + # Used by archs to tell that they want the BPF JIT compiler enabled by # default for kernels that were compiled with BPF JIT support. config ARCH_WANT_DEFAULT_BPF_JIT @@ -101,4 +105,9 @@ config BPF_LSM =20 If you are unsure how to answer this question, answer N. =20 +config BPF_JIT_KASAN + bool + depends on HAVE_EBPF_JIT_KASAN + default y if BPF_JIT && KASAN_GENERIC + endmenu # "BPF subsystem" --=20 2.53.0 From nobody Mon Jun 15 20:34:29 2026 Received: from smtpout-02.galae.net (smtpout-02.galae.net [185.246.84.56]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7F216371D0A; Mon, 13 Apr 2026 18:29:15 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=185.246.84.56 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776104957; cv=none; b=JENaELVqCBQzKPk+HKbL3tIQbiHkf6jZCc9zgOZSTmyv4q31qRdlfKWCSwnVHWpoDS6QJnUBFfQA145EDxaw7xlP4Y13H2PHAXjiUbU2SbwVPIVaj1pjAzDn0uP/gi5mbetwUgZImrDsDcIoFlFa/ms94XY3Uye0+xID+XyiRGY= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776104957; c=relaxed/simple; bh=mq3W97fLxJrTDqDLRHxtzgRhpRr1N8IqnlHahE9Mo/A=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=kKkixxTBJJV+bOBLJYe22pNjBXMiNFQlqkQZdvsXTYKUAbFVo7N3HsmRLhbTDW3eNdeLpuqgtSADm5lOiZmgTyxzoMjcT+A73GjHFeGYiLxViCK52+rxlJHlBjYj525QZLoYE448siRqeXqBm25KKvsvARMfLAav00fodP5F4cQ= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=bootlin.com; spf=pass smtp.mailfrom=bootlin.com; dkim=pass (2048-bit key) header.d=bootlin.com header.i=@bootlin.com header.b=tU3LuWoK; arc=none smtp.client-ip=185.246.84.56 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=bootlin.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=bootlin.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=bootlin.com header.i=@bootlin.com header.b="tU3LuWoK" Received: from smtpout-01.galae.net (smtpout-01.galae.net [212.83.139.233]) by smtpout-02.galae.net (Postfix) with ESMTPS id 4765E1A3207; Mon, 13 Apr 2026 18:29:14 +0000 (UTC) Received: from mail.galae.net (mail.galae.net [212.83.136.155]) by smtpout-01.galae.net (Postfix) with ESMTPS id 12D465FFB9; Mon, 13 Apr 2026 18:29:14 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) by localhost (Mailerdaemon) with ESMTPSA id C1BDD104504FF; Mon, 13 Apr 2026 20:29:07 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=bootlin.com; s=dkim; t=1776104951; h=from:subject:date:message-id:to:cc:mime-version:content-type: content-transfer-encoding:in-reply-to:references; bh=EZ9QNHVh4+uhbJNai/qeDRTtUjcNGDJs+CZJDfExdHo=; b=tU3LuWoKhbTd/7Bxp1dXOKmfzCbIyM/apO7e06VCsD1jAsO4aLusD9iNvmTwRoTGhYfuwa wQZ7Rhbfb4u6sA8kE0gRYqT1AsgMWfuInBNGDoegkt/sWjx5ENCvIIXWwTgo20otsCojZP qrlqmy/FI1dRvldQRHMleciN+IrFbLo2xJNLYZvURj2eGuPQxDXbJc0BXHvub1UsIRBf4H mkvyg1Tslg616M4ELISPPqoHcW+Kxr1M5uTSiYfx3ITKBUuAg1vOl/i9+jSYHNNg73X48w ntFV2SF9Jnvw+i/JAmppuCLNjEJUuRSS7aTexPw9lUZ3mBum9FcJl9syieudEg== From: =?utf-8?q?Alexis_Lothor=C3=A9_=28eBPF_Foundation=29?= Date: Mon, 13 Apr 2026 20:28:44 +0200 Subject: [PATCH RFC bpf-next 4/8] bpf, x86: add helper to emit kasan checks in x86 JITed programs Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260413-kasan-v1-4-1a5831230821@bootlin.com> References: <20260413-kasan-v1-0-1a5831230821@bootlin.com> In-Reply-To: <20260413-kasan-v1-0-1a5831230821@bootlin.com> To: Alexei Starovoitov , Daniel Borkmann , Andrii Nakryiko , Martin KaFai Lau , Eduard Zingerman , Kumar Kartikeya Dwivedi , Song Liu , Yonghong Song , Jiri Olsa , John Fastabend , "David S. Miller" , David Ahern , Thomas Gleixner , Ingo Molnar , Borislav Petkov , Dave Hansen , x86@kernel.org, "H. Peter Anvin" , Shuah Khan , Maxime Coquelin , Alexandre Torgue , Andrey Ryabinin , Alexander Potapenko , Andrey Konovalov , Dmitry Vyukov , Vincenzo Frascino , Andrew Morton Cc: ebpf@linuxfoundation.org, Bastien Curutchet , Thomas Petazzoni , Xu Kuohai , bpf@vger.kernel.org, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, linux-kselftest@vger.kernel.org, linux-stm32@st-md-mailman.stormreply.com, linux-arm-kernel@lists.infradead.org, kasan-dev@googlegroups.com, linux-mm@kvack.org, =?utf-8?q?Alexis_Lothor=C3=A9_=28eBPF_Foundation=29?= X-Mailer: b4 0.15.1 X-Last-TLS-Session-Version: TLSv1.3 Add the emit_kasan_check() function that emits KASAN shadow memory checks before memory accesses in JIT-compiled BPF programs. The implementation relies on the existing __asan_{load,store}X functions from KASAN subsystem. The helper: - ensures that the kasan instrumention is actually needed: if the instruction being processed accesses the program stack, we skip the instrumentation, as those accesses are already protected with page guards - saves registers. This includes caller-saved registers, but also temporary registers, as those were possibly used by the affected program - computes the accessed address and stores it in %rdi - calls the relevant function, depending on the instruction being a load or a store, and the size of the access. - restores registeres The special care needed when inserting this instrumentation comes at the cost of a non negligeable increase in JITed code size. For example, a bare mov 0x0(%si),rbx # Load in rbx content at address stored in rsi becomes push %rax push %rcx push %rdx push %rsi push %rdi push %r8 push %r9 push %r10 push %r11 sub $0x8,%rsp mov %rsi,%rdi call 0xffffffff81da0a60 <__asan_load8> add $0x8,%rsp pop %r11 pop %r10 pop %r9 pop %r8 pop %rdi pop %rsi pop %rdx pop %rcx pop %rax mov 0x0(%rsi),rbx Signed-off-by: Alexis Lothor=C3=A9 (eBPF Foundation) --- arch/x86/net/bpf_jit_comp.c | 93 +++++++++++++++++++++++++++++++++++++++++= ++++ 1 file changed, 93 insertions(+) diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c index ea9e707e8abf..b90103bd0080 100644 --- a/arch/x86/net/bpf_jit_comp.c +++ b/arch/x86/net/bpf_jit_comp.c @@ -20,6 +20,10 @@ #include #include =20 +#ifdef CONFIG_BPF_JIT_KASAN +#include +#endif + static bool all_callee_regs_used[4] =3D {true, true, true, true}; =20 static u8 *emit_code(u8 *ptr, u32 bytes, unsigned int len) @@ -1301,6 +1305,95 @@ static void emit_store_stack_imm64(u8 **pprog, int r= eg, int stack_off, u64 imm64 emit_stx(pprog, BPF_DW, BPF_REG_FP, reg, stack_off); } =20 +static int emit_kasan_check(u8 **pprog, u32 addr_reg, struct bpf_insn *ins= n, + u8 *ip, bool accesses_stack) +{ +#ifdef CONFIG_BPF_JIT_KASAN + bool is_write =3D BPF_CLASS(insn->code) =3D=3D BPF_STX; + u32 bpf_size =3D BPF_SIZE(insn->code); + s32 off =3D insn->off; + u8 *prog =3D *pprog; + void *kasan_func; + + if (accesses_stack) + return 0; + + /* Derive KASAN check function from access type and size */ + switch (bpf_size) { + case BPF_B: + kasan_func =3D is_write ? __asan_store1 : __asan_load1; + break; + case BPF_H: + kasan_func =3D is_write ? __asan_store2 : __asan_load2; + break; + case BPF_W: + kasan_func =3D is_write ? __asan_store4 : __asan_load4; + break; + case BPF_DW: + kasan_func =3D is_write ? __asan_store8 : __asan_load8; + break; + default: + return -EINVAL; + } + + /* Save rax */ + EMIT1(0x50); + /* Save rcx */ + EMIT1(0x51); + /* Save rdx */ + EMIT1(0x52); + /* Save rsi */ + EMIT1(0x56); + /* Save rdi */ + EMIT1(0x57); + /* Save r8 */ + EMIT2(0x41, 0x50); + /* Save r9 */ + EMIT2(0x41, 0x51); + /* Save r10 */ + EMIT2(0x41, 0x52); + /* Save r11 */ + EMIT2(0x41, 0x53); + /* We have pushed 72 bytes, realign stack to 16 bytes: sub rsp, 8 */ + EMIT4(0x48, 0x83, 0xEC, 8); + + /* mov rdi, addr_reg */ + EMIT_mov(BPF_REG_1, addr_reg); + + /* add rdi, off (if offset is non-zero) */ + if (off) { + if (is_imm8(off)) { + /* add rdi, imm8 */ + EMIT4(0x48, 0x83, 0xC7, (u8)off); + } else { + /* add rdi, imm32 */ + EMIT3_off32(0x48, 0x81, 0xC7, off); + } + } + + /* Adjust ip to account for the instrumentation generated so far */ + ip +=3D (prog - *pprog); + /* call kasan_func */ + if (emit_call(&prog, kasan_func, ip)) + return -ERANGE; + + /* Restore registers */ + EMIT4(0x48, 0x83, 0xC4, 8); + EMIT2(0x41, 0x5B); + EMIT2(0x41, 0x5A); + EMIT2(0x41, 0x59); + EMIT2(0x41, 0x58); + EMIT1(0x5F); + EMIT1(0x5E); + EMIT1(0x5A); + EMIT1(0x59); + EMIT1(0x58); + + *pprog =3D prog; +#endif /* CONFIG_BPF_JIT_KASAN */ + return 0; +} + static int emit_atomic_rmw(u8 **pprog, u32 atomic_op, u32 dst_reg, u32 src_reg, s16 off, u8 bpf_size) { --=20 2.53.0 From nobody Mon Jun 15 20:34:29 2026 Received: from smtpout-03.galae.net (smtpout-03.galae.net [185.246.85.4]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0B8F638645A for ; Mon, 13 Apr 2026 18:29:19 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=185.246.85.4 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776104961; cv=none; b=pHyGkyHzBx0GZ/iCHlfg2Jvm1CRc3t3gzpGNA5fIRMAOOp7DCIEbiqDTGlDFV75oeCAmmEyLAObNjmiy4tZF21x/59UYWUoEoB2jDkKMaMHLVdhohu8gPXkXN6WjpMvZSkDVq4VdkxAFhfByRXJDYMAhQ4EbkHokUsKR1z1dTck= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776104961; c=relaxed/simple; bh=C3KSUrt0pBx1xyZoYOhbOvRg22YYGyMtepsdmFRljXY=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=NX/o+e/BWSV87ljx/AcqHf3ckbfCsL2fC7igx6VkT2fMee7RDsOinoI3/+nPBx2GMLwBqk8ZOyYr/5UpQxmL08sleEx96TqRQWkFe1pSzZhWCuYv7X/xUaOXcytRgY9u8fIkrlfUNcv4quKSRVwCvFqcfcHsX3gC8FrTACIi5oM= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=bootlin.com; spf=pass smtp.mailfrom=bootlin.com; dkim=pass (2048-bit key) header.d=bootlin.com header.i=@bootlin.com header.b=plX1wAia; arc=none smtp.client-ip=185.246.85.4 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=bootlin.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=bootlin.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=bootlin.com header.i=@bootlin.com header.b="plX1wAia" Received: from smtpout-01.galae.net (smtpout-01.galae.net [212.83.139.233]) by smtpout-03.galae.net (Postfix) with ESMTPS id B52194E42986; Mon, 13 Apr 2026 18:29:18 +0000 (UTC) Received: from mail.galae.net (mail.galae.net [212.83.136.155]) by smtpout-01.galae.net (Postfix) with ESMTPS id 8A00C5FFB9; Mon, 13 Apr 2026 18:29:18 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) by localhost (Mailerdaemon) with ESMTPSA id 9615210450503; Mon, 13 Apr 2026 20:29:12 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=bootlin.com; s=dkim; t=1776104956; h=from:subject:date:message-id:to:cc:mime-version:content-type: content-transfer-encoding:in-reply-to:references; bh=lEqpkfSG4bvQgxtPI4x8t4f5ElxNEGTXzPOFRzqjwCY=; b=plX1wAiahNNvYLrmKHyngjgbUZTsjXMi0XkNrQqatZIZfwi5y+MpfMYnpaPSrFPPIx5z1o DjTmJalfQiDo3KOvAbGJ1qE8SiwJJI0z30hz7Hh1mg2vocPtrjUgfmRmqgaiTA1AVxu05f TSmPLflLKUoX/QhZnH3X4nY86J0jvLHmL8Prsn2b5oH9X82bb0dFnuzoVhoZEXNtsuu8LG RYUj2X6gdbavH0vUvSLXR3PcQcqHbq/u/pQ6CScqPoDPnGCm0BxblVPKU5DjB93iCZrcYO uXojuVumNxIojmUJCrrBnPbAjhBsiAlqNEnuhQUM5TcX823OQvFjhzlelwNoqg== From: =?utf-8?q?Alexis_Lothor=C3=A9_=28eBPF_Foundation=29?= Date: Mon, 13 Apr 2026 20:28:45 +0200 Subject: [PATCH RFC bpf-next 5/8] bpf, x86: emit KASAN checks into x86 JITed programs Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260413-kasan-v1-5-1a5831230821@bootlin.com> References: <20260413-kasan-v1-0-1a5831230821@bootlin.com> In-Reply-To: <20260413-kasan-v1-0-1a5831230821@bootlin.com> To: Alexei Starovoitov , Daniel Borkmann , Andrii Nakryiko , Martin KaFai Lau , Eduard Zingerman , Kumar Kartikeya Dwivedi , Song Liu , Yonghong Song , Jiri Olsa , John Fastabend , "David S. Miller" , David Ahern , Thomas Gleixner , Ingo Molnar , Borislav Petkov , Dave Hansen , x86@kernel.org, "H. Peter Anvin" , Shuah Khan , Maxime Coquelin , Alexandre Torgue , Andrey Ryabinin , Alexander Potapenko , Andrey Konovalov , Dmitry Vyukov , Vincenzo Frascino , Andrew Morton Cc: ebpf@linuxfoundation.org, Bastien Curutchet , Thomas Petazzoni , Xu Kuohai , bpf@vger.kernel.org, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, linux-kselftest@vger.kernel.org, linux-stm32@st-md-mailman.stormreply.com, linux-arm-kernel@lists.infradead.org, kasan-dev@googlegroups.com, linux-mm@kvack.org, =?utf-8?q?Alexis_Lothor=C3=A9_=28eBPF_Foundation=29?= X-Mailer: b4 0.15.1 X-Last-TLS-Session-Version: TLSv1.3 Insert KASAN shadow memory checks before memory load and store operations in JIT-compiled BPF programs. This helps detect memory safety bugs such as use-after-free and out-of-bounds accesses at runtime. The main instructions being targeted are BPF_LDX and BPF_STX, but not all of them are being instrumented: - if the load/store instruction is in fact accessing the program stack, emit_kasan_check silently skips the instrumentation, as we already have page guards to monitor stack accesses. Stack accesses _could_ be monitored more finely by adding kasan checks, but it would need JIT compiler to insert red zones around any variable on stack, and we likely do not have enough info in JIT compiler to do so. - if the load/store instruction is a BPF_PROBE_MEM or a BPF_PROBE_ATOMIC instruction, we do not instrument it, as the passed address can fault (hence the custom fault management with BPF_PROBE_XXX instructions), and so the corresponding kasan check could fault as well. Signed-off-by: Alexis Lothor=C3=A9 (eBPF Foundation) --- This RFC also ignores for now atomic operations, because I am not perfectly clear yet about how they are JITed and so how much kasan instrumentation is legitimate here. --- arch/x86/net/bpf_jit_comp.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c index b90103bd0080..111fe1d55121 100644 --- a/arch/x86/net/bpf_jit_comp.c +++ b/arch/x86/net/bpf_jit_comp.c @@ -1811,6 +1811,7 @@ static int do_jit(struct bpf_verifier_env *env, struc= t bpf_prog *bpf_prog, int * const s32 imm32 =3D insn->imm; u32 dst_reg =3D insn->dst_reg; u32 src_reg =3D insn->src_reg; + bool accesses_stack; u8 b2 =3D 0, b3 =3D 0; u8 *start_of_ldx; s64 jmp_offset; @@ -1831,6 +1832,7 @@ static int do_jit(struct bpf_verifier_env *env, struc= t bpf_prog *bpf_prog, int * EMIT_ENDBR(); =20 ip =3D image + addrs[i - 1] + (prog - temp); + accesses_stack =3D bpf_insn_accesses_stack(env, bpf_prog, i - 1); =20 switch (insn->code) { /* ALU */ @@ -2242,6 +2244,11 @@ st: if (is_imm8(insn->off)) case BPF_STX | BPF_MEM | BPF_H: case BPF_STX | BPF_MEM | BPF_W: case BPF_STX | BPF_MEM | BPF_DW: + err =3D emit_kasan_check(&prog, dst_reg, insn, + image + addrs[i - 1], + accesses_stack); + if (err) + return err; emit_stx(&prog, BPF_SIZE(insn->code), dst_reg, src_reg, insn->off); break; =20 @@ -2390,6 +2397,12 @@ st: if (is_imm8(insn->off)) /* populate jmp_offset for JAE above to jump to start_of_ldx */ start_of_ldx =3D prog; end_of_jmp[-1] =3D start_of_ldx - end_of_jmp; + } else { + err =3D emit_kasan_check(&prog, src_reg, insn, + image + addrs[i - 1], + accesses_stack); + if (err) + return err; } if (BPF_MODE(insn->code) =3D=3D BPF_PROBE_MEMSX || BPF_MODE(insn->code) =3D=3D BPF_MEMSX) --=20 2.53.0 From nobody Mon Jun 15 20:34:29 2026 Received: from smtpout-04.galae.net (smtpout-04.galae.net [185.171.202.116]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 14CCE386568; Mon, 13 Apr 2026 18:29:23 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=185.171.202.116 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776104965; cv=none; b=WQDysKdBbPUIy95HZbqGyDB+Fq1D/Sy56orh5z14M8Dh2GGvoAsa+pKVSzH2QrPtC2ZyBHyEvj0KfmxeJtEDxRcde4AtiyLJLxBD/zRv8+NizST0D3S2/y+MmFbCC3KcKnxP6CScN8cHbSs485Wqguubsje29sS3cN/q4b9PXyk= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776104965; c=relaxed/simple; bh=BevlIxTzUDRXccwwwze05xuxQei2ZoL9Gz54NwPDCXE=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=atxG2dndn98ifrlFOdAOWR3DALexJ53yc0eSurTt/nQGE384UEge8AwuxR0so7oN3oIXPoexacP9y6de2PukBBoGG/joXkTO6lhhpzAcSc94UZ6KX019pzm/LyLgr7c0SeOdY1lyDB04gQp/gzkRdzzbtAZ/Xt0U8YtM7THF+ps= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=bootlin.com; spf=pass smtp.mailfrom=bootlin.com; dkim=pass (2048-bit key) header.d=bootlin.com header.i=@bootlin.com header.b=Qm0jaSwT; arc=none smtp.client-ip=185.171.202.116 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=bootlin.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=bootlin.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=bootlin.com header.i=@bootlin.com header.b="Qm0jaSwT" Received: from smtpout-01.galae.net (smtpout-01.galae.net [212.83.139.233]) by smtpout-04.galae.net (Postfix) with ESMTPS id 792FDC5B1AD; Mon, 13 Apr 2026 18:29:59 +0000 (UTC) Received: from mail.galae.net (mail.galae.net [212.83.136.155]) by smtpout-01.galae.net (Postfix) with ESMTPS id C3B5B5FFB9; Mon, 13 Apr 2026 18:29:22 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) by localhost (Mailerdaemon) with ESMTPSA id 001941045055E; Mon, 13 Apr 2026 20:29:16 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=bootlin.com; s=dkim; t=1776104960; h=from:subject:date:message-id:to:cc:mime-version:content-type: content-transfer-encoding:in-reply-to:references; bh=nPa2ZZONaBOGLFMfEfBDzaDZgsD31jakJQraeqbgRCw=; b=Qm0jaSwT24/GdK/EsyzadjCMRmdSwzojdFiBoEhz9mF9mr7uXKqUeMuFzrXmwZ8OzPseYj rTiosoU1qw/9rhsO2QAeObwHnb3U0BdA/GKu2X7zqF4XwbXU+sdENJYYJMHV+epMpE+WAE 5wXX4mFLdnQpzrapducllk94LpMksGi5QQSsfjn+ECbIMOEFADC7qab70hxaKQz0r/EyiW +qT+y9jj+fwS4YIkWHcExGPabkcLddCDpfG8oxYqSCHg5OjMFegpaJ+esDIoGjiCGVX++x o1cerD3IbFhwDzv5lAIPNVJ37KUVFvTRPwtdsH6wD3ffqjvZudD30QIMdhw1KQ== From: =?utf-8?q?Alexis_Lothor=C3=A9_=28eBPF_Foundation=29?= Date: Mon, 13 Apr 2026 20:28:46 +0200 Subject: [PATCH RFC bpf-next 6/8] selftests/bpf: do not run verifier JIT tests when BPF_JIT_KASAN is enabled Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260413-kasan-v1-6-1a5831230821@bootlin.com> References: <20260413-kasan-v1-0-1a5831230821@bootlin.com> In-Reply-To: <20260413-kasan-v1-0-1a5831230821@bootlin.com> To: Alexei Starovoitov , Daniel Borkmann , Andrii Nakryiko , Martin KaFai Lau , Eduard Zingerman , Kumar Kartikeya Dwivedi , Song Liu , Yonghong Song , Jiri Olsa , John Fastabend , "David S. Miller" , David Ahern , Thomas Gleixner , Ingo Molnar , Borislav Petkov , Dave Hansen , x86@kernel.org, "H. Peter Anvin" , Shuah Khan , Maxime Coquelin , Alexandre Torgue , Andrey Ryabinin , Alexander Potapenko , Andrey Konovalov , Dmitry Vyukov , Vincenzo Frascino , Andrew Morton Cc: ebpf@linuxfoundation.org, Bastien Curutchet , Thomas Petazzoni , Xu Kuohai , bpf@vger.kernel.org, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, linux-kselftest@vger.kernel.org, linux-stm32@st-md-mailman.stormreply.com, linux-arm-kernel@lists.infradead.org, kasan-dev@googlegroups.com, linux-mm@kvack.org, =?utf-8?q?Alexis_Lothor=C3=A9_=28eBPF_Foundation=29?= X-Mailer: b4 0.15.1 X-Last-TLS-Session-Version: TLSv1.3 Multiple verifier tests validate the exact list of JITed instructions. Even if the test offers some flexibility in its checks (eg: not enforcing the first instruction to be verified right at the beginning of jited code, but rather searching where the expected JIT instructions could be located), it is confused by the new KASAN instrumentation JITed in programs: this instrumentation can be inserted anywhere in-between searched instructions, leading to test failures despite the correct instructions being generated. Prevent those failures by skipping tests involving JITed instructions checks when kernel is built with KASAN _and_ JIT is enabled, as those two conditions lead the JITed code to contains KASAN checks. Signed-off-by: Alexis Lothor=C3=A9 (eBPF Foundation) --- tools/testing/selftests/bpf/test_loader.c | 5 +++++ tools/testing/selftests/bpf/unpriv_helpers.c | 5 +++++ tools/testing/selftests/bpf/unpriv_helpers.h | 1 + 3 files changed, 11 insertions(+) diff --git a/tools/testing/selftests/bpf/test_loader.c b/tools/testing/self= tests/bpf/test_loader.c index c4c34cae6102..d2c0062ef31a 100644 --- a/tools/testing/selftests/bpf/test_loader.c +++ b/tools/testing/selftests/bpf/test_loader.c @@ -1175,6 +1175,11 @@ void run_subtest(struct test_loader *tester, return; } =20 + if (is_jit_enabled() && subspec->jited.cnt && get_kasan_jit_enabled()) { + test__skip(); + return; + } + if (unpriv) { if (!can_execute_unpriv(tester, spec)) { test__skip(); diff --git a/tools/testing/selftests/bpf/unpriv_helpers.c b/tools/testing/s= elftests/bpf/unpriv_helpers.c index f997d7ec8fd0..25bd08648f5f 100644 --- a/tools/testing/selftests/bpf/unpriv_helpers.c +++ b/tools/testing/selftests/bpf/unpriv_helpers.c @@ -142,3 +142,8 @@ bool get_unpriv_disabled(void) } return mitigations_off; } + +bool get_kasan_jit_enabled(void) +{ + return config_contains("CONFIG_BPF_JIT_KASAN=3Dy"); +} diff --git a/tools/testing/selftests/bpf/unpriv_helpers.h b/tools/testing/s= elftests/bpf/unpriv_helpers.h index 151f67329665..bc5f4c953c9d 100644 --- a/tools/testing/selftests/bpf/unpriv_helpers.h +++ b/tools/testing/selftests/bpf/unpriv_helpers.h @@ -5,3 +5,4 @@ #define UNPRIV_SYSCTL "kernel/unprivileged_bpf_disabled" =20 bool get_unpriv_disabled(void); +bool get_kasan_jit_enabled(void); --=20 2.53.0 From nobody Mon Jun 15 20:34:29 2026 Received: from smtpout-03.galae.net (smtpout-03.galae.net [185.246.85.4]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D425C383C86 for ; Mon, 13 Apr 2026 18:29:28 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=185.246.85.4 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776104970; cv=none; b=rUJAhbn1QnY8dLfal1dcwHHqu8M0EvViYAdx9si34tIGdwjO33J6meHcAQAjJJxqSrnUWbrVAh9snOATuxxZiRVGNj+/byMKLsICJnCaH2VBXr3PVfKXGP0wjbersk7F2beiwHL/+PZ+F8LMoBpjEPw49idY9hxjRZmHtYR0MX0= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776104970; c=relaxed/simple; bh=Z+p0lXPLcxCUBVq93qdqRZm5rZEjIkitMdoMPF9CNLo=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=WuLtUDIlCgG7+uFynKYANSmQaM9WTD2zSsTu0vN2ohyPbvKEbOhjHH45tQDzSRxkfnJ1FJUs3UR67dJXkSfNSWXhwiULVv2tKYBg9LGuGtRLs1kx8O9RkHCgLKUt6Y+AgiHGQZmW2cGh/lJiMLIaBGNJld6uLswCEkmC8MzvH9w= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=bootlin.com; spf=pass smtp.mailfrom=bootlin.com; dkim=pass (2048-bit key) header.d=bootlin.com header.i=@bootlin.com header.b=MWPBldvW; arc=none smtp.client-ip=185.246.85.4 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=bootlin.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=bootlin.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=bootlin.com header.i=@bootlin.com header.b="MWPBldvW" Received: from smtpout-01.galae.net (smtpout-01.galae.net [212.83.139.233]) by smtpout-03.galae.net (Postfix) with ESMTPS id 823474E429D5; Mon, 13 Apr 2026 18:29:27 +0000 (UTC) Received: from mail.galae.net (mail.galae.net [212.83.136.155]) by smtpout-01.galae.net (Postfix) with ESMTPS id 4E7C55FFB9; Mon, 13 Apr 2026 18:29:27 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) by localhost (Mailerdaemon) with ESMTPSA id 65DB41045056A; Mon, 13 Apr 2026 20:29:21 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=bootlin.com; s=dkim; t=1776104965; h=from:subject:date:message-id:to:cc:mime-version:content-type: content-transfer-encoding:in-reply-to:references; bh=Mdcp4bv1eu+3+1zz5d2KPvXdiRfH0YZIH1Hih1O/yps=; b=MWPBldvWBlMlRLB7YRsCB6BeBrxux7LP6MczGCYn9+gqLTpdPE4XjlTfrNInbkuHOU245w rnCCzBg/4H0eg0CCDktwD7qx8pXICwn9sDOLbeEbNFGXIaEQd2iOWyygEb+ZKxDXkwN0Ze 3dLeaz/gU2DpaSNYvL9S6agidNul6GvFXrdnBQZ08Z1FGLVkWAVpx7UGogUMYF545oxiEK cFdj+JTBc6ATUzw9po+Hw78YsxbuHGYR/K9YxFGuCsKwEUPY7zCalMX2s1SlgVn3BdG29p BhSdIs+8pFh68+m0Vck/uK+J+HK7zfcanYuNTj4q1HRWPFXDcHSDTEsKjMjwrw== From: =?utf-8?q?Alexis_Lothor=C3=A9_=28eBPF_Foundation=29?= Date: Mon, 13 Apr 2026 20:28:47 +0200 Subject: [PATCH RFC bpf-next 7/8] bpf, x86: enable KASAN for JITed programs on x86 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260413-kasan-v1-7-1a5831230821@bootlin.com> References: <20260413-kasan-v1-0-1a5831230821@bootlin.com> In-Reply-To: <20260413-kasan-v1-0-1a5831230821@bootlin.com> To: Alexei Starovoitov , Daniel Borkmann , Andrii Nakryiko , Martin KaFai Lau , Eduard Zingerman , Kumar Kartikeya Dwivedi , Song Liu , Yonghong Song , Jiri Olsa , John Fastabend , "David S. Miller" , David Ahern , Thomas Gleixner , Ingo Molnar , Borislav Petkov , Dave Hansen , x86@kernel.org, "H. Peter Anvin" , Shuah Khan , Maxime Coquelin , Alexandre Torgue , Andrey Ryabinin , Alexander Potapenko , Andrey Konovalov , Dmitry Vyukov , Vincenzo Frascino , Andrew Morton Cc: ebpf@linuxfoundation.org, Bastien Curutchet , Thomas Petazzoni , Xu Kuohai , bpf@vger.kernel.org, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, linux-kselftest@vger.kernel.org, linux-stm32@st-md-mailman.stormreply.com, linux-arm-kernel@lists.infradead.org, kasan-dev@googlegroups.com, linux-mm@kvack.org, =?utf-8?q?Alexis_Lothor=C3=A9_=28eBPF_Foundation=29?= X-Mailer: b4 0.15.1 X-Last-TLS-Session-Version: TLSv1.3 Mark x86 as supporting KASAN checks in JITed programs so that the corresponding JIT compiler inserts checks on the translated instructions. Signed-off-by: Alexis Lothor=C3=A9 (eBPF Foundation) --- arch/x86/Kconfig | 1 + 1 file changed, 1 insertion(+) diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig index e2df1b147184..a50aa9a0b93c 100644 --- a/arch/x86/Kconfig +++ b/arch/x86/Kconfig @@ -234,6 +234,7 @@ config X86 select HAVE_SAMPLE_FTRACE_DIRECT if X86_64 select HAVE_SAMPLE_FTRACE_DIRECT_MULTI if X86_64 select HAVE_EBPF_JIT + select HAVE_EBPF_JIT_KASAN if X86_64 select HAVE_EFFICIENT_UNALIGNED_ACCESS select HAVE_EISA if X86_32 select HAVE_EXIT_THREAD --=20 2.53.0 From nobody Mon Jun 15 20:34:29 2026 Received: from smtpout-03.galae.net (smtpout-03.galae.net [185.246.85.4]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 26602366570 for ; Mon, 13 Apr 2026 18:29:33 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=185.246.85.4 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776104974; cv=none; b=nsuMizz6UIm+mqBX/1O2/e35hdiHJjXltvLjIV8QyDj4H3ryFRu2ofGZoaU3eisYikg6QIkI4PPY+aacX6AKkuhgmvFKYl4hjuEBgiewqnYwUbQ4fjspsWIdQfu6e69FcZ7nmV5I+USlLpx3oD0LDG/XFTgmiKE889okDggbYiY= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776104974; c=relaxed/simple; bh=2ArdSjKR2RlI+jqmygWwNX6zIeyTDO5eF6SkrpbWQO8=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=WLwwD40Yg5qcGxwLhg8kMrAybNcEj9dd77kCxFCNZxCj5d58X9yxhpqf/ofZy17LU+8zckngynHusyCQzAcz8DDYCPIyQEaVxjC0tTGVLoWkd4QeWLaiLQFGBPwJcNj7eZPLqq0YaHxl8xmGvUz4OLoBlcz1zjzS+y76sneQEcs= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=bootlin.com; spf=pass smtp.mailfrom=bootlin.com; dkim=pass (2048-bit key) header.d=bootlin.com header.i=@bootlin.com header.b=l+QWbYiW; arc=none smtp.client-ip=185.246.85.4 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=bootlin.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=bootlin.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=bootlin.com header.i=@bootlin.com header.b="l+QWbYiW" Received: from smtpout-01.galae.net (smtpout-01.galae.net [212.83.139.233]) by smtpout-03.galae.net (Postfix) with ESMTPS id DEF614E429D5; Mon, 13 Apr 2026 18:29:31 +0000 (UTC) Received: from mail.galae.net (mail.galae.net [212.83.136.155]) by smtpout-01.galae.net (Postfix) with ESMTPS id B31185FFB9; Mon, 13 Apr 2026 18:29:31 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) by localhost (Mailerdaemon) with ESMTPSA id EB7DD104504B7; Mon, 13 Apr 2026 20:29:25 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=bootlin.com; s=dkim; t=1776104969; h=from:subject:date:message-id:to:cc:mime-version:content-type: content-transfer-encoding:in-reply-to:references; bh=15vke5PQWZFrVkgnnIyubbncfs+/GAw/Iqj1wymNY98=; b=l+QWbYiWMGIz4qwFLYvxVvMGDaqNYLxl8K1kxh6kptb7szLGWRQXA8zBqpP99PBjYfp8qF hoA1ZbpPykPq9PL8Qqxin+5v7f2di/xPCQjqjFU6MHvnHnb7DzKKp7Kxr2TzD0HFALS1qP 5ngtttZu6iq7pgtx9fYP2GUHSigLJA/zant3mcWAwXJWO57o7EYixDOPIMLE+oxnKesxjF k+Q6hecUSaC5jbC0cNStpOirpqlYFEaQFckGdH4/SvkvwlJl/Ra4Hd/e9I1L+OYr5wYV4c pl4AOaTC3FiTflrqPJAOjxm2TiiwfD3O7esj3A9Z/06x97gRP2S9RRjFwaQYsA== From: =?utf-8?q?Alexis_Lothor=C3=A9_=28eBPF_Foundation=29?= Date: Mon, 13 Apr 2026 20:28:48 +0200 Subject: [PATCH RFC bpf-next 8/8] selftests/bpf: add tests to validate KASAN on JIT programs Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260413-kasan-v1-8-1a5831230821@bootlin.com> References: <20260413-kasan-v1-0-1a5831230821@bootlin.com> In-Reply-To: <20260413-kasan-v1-0-1a5831230821@bootlin.com> To: Alexei Starovoitov , Daniel Borkmann , Andrii Nakryiko , Martin KaFai Lau , Eduard Zingerman , Kumar Kartikeya Dwivedi , Song Liu , Yonghong Song , Jiri Olsa , John Fastabend , "David S. Miller" , David Ahern , Thomas Gleixner , Ingo Molnar , Borislav Petkov , Dave Hansen , x86@kernel.org, "H. Peter Anvin" , Shuah Khan , Maxime Coquelin , Alexandre Torgue , Andrey Ryabinin , Alexander Potapenko , Andrey Konovalov , Dmitry Vyukov , Vincenzo Frascino , Andrew Morton Cc: ebpf@linuxfoundation.org, Bastien Curutchet , Thomas Petazzoni , Xu Kuohai , bpf@vger.kernel.org, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, linux-kselftest@vger.kernel.org, linux-stm32@st-md-mailman.stormreply.com, linux-arm-kernel@lists.infradead.org, kasan-dev@googlegroups.com, linux-mm@kvack.org, =?utf-8?q?Alexis_Lothor=C3=A9_=28eBPF_Foundation=29?= X-Mailer: b4 0.15.1 X-Last-TLS-Session-Version: TLSv1.3 Add a basic KASAN test runner that loads and test-run programs that can trigger memory management bugs. The test captures kernel logs and ensure that the expected KASAN splat is emitted by searching for the corresponding first lines in the report. This version implements two faulty programs triggering either a user-after-free, or an out-of-bounds memory usage. The bugs are triggered thanks to some dedicated kfuncs in bpf_testmod.c, but two different techniques are used, as some cases can be quite hard to trigger in a pure "black box" approach: - for reads, we can make the used kfuncs return some faulty pointers that ebpf programs will manipulate, they will generate legitimate kasan reports as a consequence - applying the same trick for faulty writes is harder, as ebpf programs can't write kernel data freely. So ebpf programs can call another specific testing kfunc that will alter the shadow memory matching the passed memory (eg: a map). When the program will try to write to the corresponding memory, it will trigger a report as well. Signed-off-by: Alexis Lothor=C3=A9 (eBPF Foundation) --- The way of bringing kasan_poison into bpf_testmod is definitely not ideal. But I would like to validate the testing approach (triggering real faulty accesses, which is hard on some cases, VS manually poisoning BPF-manipulated memory) before eventually making clean bridges between KASAN APIs and bpf_testmod.c, if the latter approach is the valid one. --- tools/testing/selftests/bpf/prog_tests/kasan.c | 165 +++++++++++++++++= ++++ tools/testing/selftests/bpf/progs/kasan.c | 146 ++++++++++++++++++ .../testing/selftests/bpf/test_kmods/bpf_testmod.c | 79 ++++++++++ 3 files changed, 390 insertions(+) diff --git a/tools/testing/selftests/bpf/prog_tests/kasan.c b/tools/testing= /selftests/bpf/prog_tests/kasan.c new file mode 100644 index 000000000000..fd628aaa8005 --- /dev/null +++ b/tools/testing/selftests/bpf/prog_tests/kasan.c @@ -0,0 +1,165 @@ +// SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause +#include +#include +#include +#include +#include +#include +#include "kasan.skel.h" + +#define SUBTEST_NAME_MAX_LEN 64 +#define SYSLOG_ACTION_READ_ALL 3 +#define SYSLOG_ACTION_CLEAR 5 + +#define MAX_LOG_SIZE (8*1024) +#define READ_CHUNK_SIZE 128 + +#define KASAN_PATTERN_SLAB_UAF "BUG: KASAN: slab-use-after-free in bpf_pro= g_" +#define KASAN_PATTERN_GLOBAL_OOB "BUG: KASAN: global-out-of-bounds in bpf_= prog_" + +static char klog_buffer[MAX_LOG_SIZE]; + +static int read_kernel_logs(char *buf, size_t max_len) +{ + return klogctl(SYSLOG_ACTION_READ_ALL, buf, max_len); +} + +static int clear_kernel_logs(void) +{ + return klogctl(SYSLOG_ACTION_CLEAR, NULL, 0); +} + +static int kernel_logs_have_matching_kasan_report(char *buf, char *pattern, + bool is_write, int size) +{ + char *access_desc_start, *access_desc_end, *tmp; + char access_log[READ_CHUNK_SIZE]; + char *kasan_report_start; + int hsize, nsize; + /* Searched kasan report is valid if + * - it contains the expected kasan pattern + * - the next line is the description of the faulty access + * - faulty access properties match the tested type and size + */ + kasan_report_start =3D strstr(buf, pattern); + + if (!kasan_report_start) + return 1; + + /* Find next line */ + access_desc_start =3D strchr(kasan_report_start, '\n'); + if (!access_desc_start) + return 1; + access_desc_start++; + + access_desc_end =3D strchr(access_desc_start, '\n'); + if (!access_desc_end) + return 1; + + nsize =3D snprintf(access_log, READ_CHUNK_SIZE, "%s of size %d at addr", + is_write ? "Write" : "Read", size); + + hsize =3D access_desc_end - access_desc_start; + tmp =3D memmem(access_desc_start, hsize, access_log, nsize); + + if (!tmp) + return 1; + + return 0; +} + +struct test_spec { + char *prog_name; + char *expected_report_pattern; +}; + +static struct test_spec tests[] =3D { + { + .prog_name =3D "bpf_kasan_uaf", + .expected_report_pattern =3D KASAN_PATTERN_SLAB_UAF + }, + { + .prog_name =3D "bpf_kasan_oob", + .expected_report_pattern =3D KASAN_PATTERN_GLOBAL_OOB + } +}; + +static void run_test_with_type_and_size(struct kasan *skel, + struct test_spec *test, bool is_write, + int access_size) +{ + char subtest_name[SUBTEST_NAME_MAX_LEN]; + struct bpf_program *prog; + uint8_t buf[ETH_HLEN]; + int ret; + + prog =3D bpf_object__find_program_by_name(skel->obj, test->prog_name); + if (!ASSERT_OK_PTR(prog, "find test prog")) + return; + + snprintf(subtest_name, SUBTEST_NAME_MAX_LEN, "%s_%s_%d", + test->prog_name, is_write ? "write" : "read", access_size); + + if (!test__start_subtest(subtest_name)) + return; + + ret =3D clear_kernel_logs(); + if (!ASSERT_OK(ret, "reset log buffer")) + return; + + LIBBPF_OPTS(bpf_test_run_opts, topts); + topts.sz =3D sizeof(struct bpf_test_run_opts); + topts.data_size_in =3D ETH_HLEN; + topts.data_in =3D buf; + skel->bss->is_write =3D is_write; + skel->bss->access_size =3D access_size; + ret =3D bpf_prog_test_run_opts(bpf_program__fd(prog), &topts); + if (!ASSERT_OK(ret, "run prog")) + return; + + ret =3D read_kernel_logs(klog_buffer, MAX_LOG_SIZE); + if (ASSERT_GE(ret, 0, "read kernel logs")) + ASSERT_OK(kernel_logs_have_matching_kasan_report( + klog_buffer, test->expected_report_pattern, + is_write, access_size), + test->prog_name); +} + +static void run_test_with_type(struct kasan *skel, struct test_spec *test, + bool is_write) +{ + run_test_with_type_and_size(skel, test, is_write, 1); + run_test_with_type_and_size(skel, test, is_write, 2); + run_test_with_type_and_size(skel, test, is_write, 4); + run_test_with_type_and_size(skel, test, is_write, 8); +} + +static void run_test(struct kasan *skel, struct test_spec *test) +{ + run_test_with_type(skel, test, false); + run_test_with_type(skel, test, true); +} + +void test_kasan(void) +{ + struct test_spec *test; + struct kasan *skel; + int i; + + if (!is_jit_enabled() || !get_kasan_jit_enabled()) { + test__skip(); + return; + } + + skel =3D kasan__open_and_load(); + if (!ASSERT_OK_PTR(skel, "open and load prog")) + return; + + for (i =3D 0; i < ARRAY_SIZE(tests); i++) { + test =3D &tests[i]; + + run_test(skel, test); + } + + kasan__destroy(skel); +} diff --git a/tools/testing/selftests/bpf/progs/kasan.c b/tools/testing/self= tests/bpf/progs/kasan.c new file mode 100644 index 000000000000..f713c9b7c9ce --- /dev/null +++ b/tools/testing/selftests/bpf/progs/kasan.c @@ -0,0 +1,146 @@ +// SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause + +#include +#include +#include + +#define KASAN_SLAB_FREE 0xFB +#define KASAN_GLOBAL_REDZONE 0xF9 + +extern __u8 *bpf_kfunc_kasan_uaf_1(void) __ksym; +extern __u16 *bpf_kfunc_kasan_uaf_2(void) __ksym; +extern __u32 *bpf_kfunc_kasan_uaf_4(void) __ksym; +extern __u64 *bpf_kfunc_kasan_uaf_8(void) __ksym; +extern __u8 *bpf_kfunc_kasan_oob_1(void) __ksym; +extern __u16 *bpf_kfunc_kasan_oob_2(void) __ksym; +extern __u32 *bpf_kfunc_kasan_oob_4(void) __ksym; +extern __u64 *bpf_kfunc_kasan_oob_8(void) __ksym; +extern void bpf_kfunc_kasan_poison(void *mem, __u32 mem__sz, __u8 byte) __= ksym; + +int access_size; +int is_write; + +struct kasan_write_val { + __u8 data_1; + __u16 data_2; + __u32 data_4; + __u64 data_8; +}; + +struct { + __uint(type, BPF_MAP_TYPE_ARRAY); + __uint(max_entries, 1); + __type(key, __u32); + __type(value, struct kasan_write_val); +} test_map SEC(".maps"); + +static void bpf_kasan_faulty_write(int size, __u8 poison_byte) +{ + struct kasan_write_val *val; + __u32 key =3D 0; + + val =3D bpf_map_lookup_elem(&test_map, &key); + if (!val) + return; + + bpf_kfunc_kasan_poison(val, sizeof(struct kasan_write_val), + poison_byte); + switch (size) { + case 1: + val->data_1 =3D 0xAA; + break; + case 2: + val->data_2 =3D 0xAA; + break; + case 4: + val->data_4 =3D 0xAA; + break; + case 8: + val->data_8 =3D 0xAA; + break; + } + bpf_kfunc_kasan_poison(val, sizeof(struct kasan_write_val), 0x00); +} + + +static int bpf_kasan_uaf_read(int size) +{ + __u8 *result_1; + __u16 *result_2; + __u32 *result_4; + __u64 *result_8; + int ret =3D 0; + + switch (size) { + case 1: + result_1 =3D bpf_kfunc_kasan_uaf_1(); + ret =3D result_1[0] ? 1 : 0; + break; + case 2: + result_2 =3D bpf_kfunc_kasan_uaf_2(); + ret =3D result_2[0] ? 1 : 0; + break; + case 4: + result_4 =3D bpf_kfunc_kasan_uaf_4(); + ret =3D result_4[0] ? 1 : 0; + break; + case 8: + result_8 =3D bpf_kfunc_kasan_uaf_8(); + ret =3D result_8[0] ? 1 : 0; + break; + } + return ret; +} + +SEC("tcx/ingress") +int bpf_kasan_uaf(struct __sk_buff *skb) +{ + if (is_write) { + bpf_kasan_faulty_write(access_size, KASAN_SLAB_FREE); + return 0; + } + + return bpf_kasan_uaf_read(access_size); +} + +static int bpf_kasan_oob_read(int size) +{ + __u8 *result_1; + __u16 *result_2; + __u32 *result_4; + __u64 *result_8; + int ret =3D 0; + + switch (size) { + case 1: + result_1 =3D bpf_kfunc_kasan_oob_1(); + ret =3D result_1[0] ? 1 : 0; + break; + case 2: + result_2 =3D bpf_kfunc_kasan_oob_2(); + ret =3D result_2[0] ? 1 : 0; + break; + case 4: + result_4 =3D bpf_kfunc_kasan_oob_4(); + ret =3D result_4[0] ? 1 : 0; + break; + case 8: + result_8 =3D bpf_kfunc_kasan_oob_8(); + ret =3D result_8[0] ? 1 : 0; + break; + } + return ret; +} + +SEC("tcx/ingress") +int bpf_kasan_oob(struct __sk_buff *skb) +{ + if (is_write) { + bpf_kasan_faulty_write(access_size, KASAN_GLOBAL_REDZONE); + return 0; + } + + return bpf_kasan_oob_read(access_size); +} + +char LICENSE[] SEC("license") =3D "GPL"; diff --git a/tools/testing/selftests/bpf/test_kmods/bpf_testmod.c b/tools/t= esting/selftests/bpf/test_kmods/bpf_testmod.c index d876314a4d67..01554bcbbbb0 100644 --- a/tools/testing/selftests/bpf/test_kmods/bpf_testmod.c +++ b/tools/testing/selftests/bpf/test_kmods/bpf_testmod.c @@ -271,6 +271,76 @@ __bpf_kfunc void bpf_kfunc_put_default_trusted_ptr_tes= t(struct prog_test_member */ } =20 +static void *kasan_uaf(void) +{ + void *p =3D kmalloc(64, GFP_ATOMIC); + + if (!p) + return NULL; + memset(p, 0xAA, 64); + kfree(p); + + return p; +} + +#ifdef CONFIG_KASAN_GENERIC +extern void kasan_poison(const void *addr, size_t size, u8 value, bool ini= t); + +__bpf_kfunc void bpf_kfunc_kasan_poison(void *mem, u32 mem__sz, u8 byte) +{ + kasan_poison(mem, mem__sz, byte, false); +} +#else +__bpf_kfunc void bpf_kfunc_kasan_poison(void *mem, u32 mem__sz, u8 byte) {= } +#endif + +__bpf_kfunc u8 *bpf_kfunc_kasan_uaf_1(void) +{ + return kasan_uaf(); +} + +__bpf_kfunc u16 *bpf_kfunc_kasan_uaf_2(void) +{ + return kasan_uaf(); +} + +__bpf_kfunc u32 *bpf_kfunc_kasan_uaf_4(void) +{ + return kasan_uaf(); +} + +__bpf_kfunc u64 *bpf_kfunc_kasan_uaf_8(void) +{ + return kasan_uaf(); +} + +static u8 test_oob_buffer[64]; + +static void *bpf_kfunc_kasan_oob(void) +{ + return test_oob_buffer+64; +} + +__bpf_kfunc u8 *bpf_kfunc_kasan_oob_1(void) +{ + return bpf_kfunc_kasan_oob(); +} + +__bpf_kfunc u16 *bpf_kfunc_kasan_oob_2(void) +{ + return bpf_kfunc_kasan_oob(); +} + +__bpf_kfunc u32 *bpf_kfunc_kasan_oob_4(void) +{ + return bpf_kfunc_kasan_oob(); +} + +__bpf_kfunc u64 *bpf_kfunc_kasan_oob_8(void) +{ + return bpf_kfunc_kasan_oob(); +} + __bpf_kfunc struct bpf_testmod_ctx * bpf_testmod_ctx_create(int *err) { @@ -740,6 +810,15 @@ BTF_ID_FLAGS(func, bpf_testmod_ops3_call_test_1) BTF_ID_FLAGS(func, bpf_testmod_ops3_call_test_2) BTF_ID_FLAGS(func, bpf_kfunc_get_default_trusted_ptr_test); BTF_ID_FLAGS(func, bpf_kfunc_put_default_trusted_ptr_test); +BTF_ID_FLAGS(func, bpf_kfunc_kasan_poison) +BTF_ID_FLAGS(func, bpf_kfunc_kasan_uaf_1) +BTF_ID_FLAGS(func, bpf_kfunc_kasan_uaf_2) +BTF_ID_FLAGS(func, bpf_kfunc_kasan_uaf_4) +BTF_ID_FLAGS(func, bpf_kfunc_kasan_uaf_8) +BTF_ID_FLAGS(func, bpf_kfunc_kasan_oob_1) +BTF_ID_FLAGS(func, bpf_kfunc_kasan_oob_2) +BTF_ID_FLAGS(func, bpf_kfunc_kasan_oob_4) +BTF_ID_FLAGS(func, bpf_kfunc_kasan_oob_8) BTF_KFUNCS_END(bpf_testmod_common_kfunc_ids) =20 BTF_ID_LIST(bpf_testmod_dtor_ids) --=20 2.53.0