From: Jiri Olsa <jolsa@kernel.org>
To: Alexei Starovoitov <ast@kernel.org>,
Daniel Borkmann <daniel@iogearbox.net>
Cc: bpf@vger.kernel.org, Andrii Nakryiko <andrii@kernel.org>,
Eduard Zingerman <eddyz87@gmail.com>,
Kumar Kartikeya Dwivedi <memxor@gmail.com>,
linux-mm@kvack.org, Andrew Morton <akpm@linux-foundation.org>,
"Liam R. Howlett" <liam@infradead.org>,
Lorenzo Stoakes <ljs@kernel.org>,
linux-kselftest@vger.kernel.org, Shuah Khan <shuah@kernel.org>,
John Fastabend <john.fastabend@gmail.com>
Subject: [RFC bpf-next 7/9] selftests/bpf: Add uprobe user page exec test
Date: Wed, 21 Oct 2026 21:57:56 +0200 [thread overview]
Message-ID: <20261021195759.119421-8-jolsa@kernel.org> (raw)
In-Reply-To: <20261021195759.119421-1-jolsa@kernel.org>
Test executable permissions for whole and partial user-page
allocations and execution of code written into a user page.
Assisted-by: Codex:GPT-6
Signed-off-by: Jiri Olsa <jolsa@kernel.org>
---
.../selftests/bpf/prog_tests/user_page.c | 62 +++++++++++++++++++
tools/testing/selftests/bpf/progs/user_page.c | 18 ++++++
2 files changed, 80 insertions(+)
diff --git a/tools/testing/selftests/bpf/prog_tests/user_page.c b/tools/testing/selftests/bpf/prog_tests/user_page.c
index ff51e7c598a9..1b5dff2c8ff6 100644
--- a/tools/testing/selftests/bpf/prog_tests/user_page.c
+++ b/tools/testing/selftests/bpf/prog_tests/user_page.c
@@ -9,6 +9,8 @@
enum {
USER_PAGE_ALLOC = 1,
+ USER_PAGE_EXEC = 2,
+ USER_PAGE_EXEC_ONLY = 3,
};
static noinline void user_page_trigger(void)
@@ -128,6 +130,62 @@ static void test_read_implies_exec(struct user_page *skel)
"restore_personality");
}
+static void test_execute_user_page(struct user_page *skel)
+{
+ long page_size = sysconf(_SC_PAGESIZE);
+ long addr = -1;
+
+#ifndef __x86_64__
+ test__skip();
+ return;
+#endif
+
+ if (!alloc_user_pages(skel, 1, &addr))
+ return;
+
+ skel->bss->exec_addr = addr;
+ skel->bss->action = USER_PAGE_EXEC;
+ user_page_trigger();
+ if (!ASSERT_EQ(skel->bss->write_ret, 0, "exec_write_ret") ||
+ !ASSERT_EQ(skel->bss->exec_ret, 0, "exec_ret"))
+ goto out;
+
+ ASSERT_EQ(((int (*)(void))addr)(), 42, "execute_user_page");
+
+out:
+ if (addr >= 0)
+ munmap((void *)addr, page_size);
+}
+
+static void test_partial_exec(struct user_page *skel)
+{
+ long page_size = sysconf(_SC_PAGESIZE);
+ long addr = -1;
+
+ if (!alloc_user_pages(skel, 3, &addr))
+ return;
+
+ skel->bss->exec_addr = addr + page_size;
+ skel->bss->action = USER_PAGE_EXEC_ONLY;
+ user_page_trigger();
+ if (!ASSERT_OK(skel->bss->exec_ret, "middle_page_exec_ret") ||
+ !check_user_page_vma((void *)(addr + 0 * page_size), page_size, "rw-p") ||
+ !check_user_page_vma((void *)(addr + 1 * page_size), page_size, "r-xp") ||
+ !check_user_page_vma((void *)(addr + 2 * page_size), page_size, "rw-p"))
+ goto out;
+
+ skel->bss->exec_addr = addr + 2 * page_size;
+ user_page_trigger();
+ if (!ASSERT_OK(skel->bss->exec_ret, "last_page_exec_ret"))
+ goto out;
+
+ check_user_page_vma((void *)(addr + 2 * page_size), page_size, "r-xp");
+
+out:
+ if (addr >= 0)
+ munmap((void *)addr, page_size * 3);
+}
+
void test_user_page(void)
{
struct user_page *skel;
@@ -146,6 +204,10 @@ void test_user_page(void)
test_reallocate_after_unmap(skel);
if (test__start_subtest("read_implies_exec"))
test_read_implies_exec(skel);
+ if (test__start_subtest("execute_user_page"))
+ test_execute_user_page(skel);
+ if (test__start_subtest("partial_exec"))
+ test_partial_exec(skel);
out:
user_page__destroy(skel);
diff --git a/tools/testing/selftests/bpf/progs/user_page.c b/tools/testing/selftests/bpf/progs/user_page.c
index 6dd9417463df..38f6fcb89bc6 100644
--- a/tools/testing/selftests/bpf/progs/user_page.c
+++ b/tools/testing/selftests/bpf/progs/user_page.c
@@ -9,11 +9,20 @@
char _license[] SEC("license") = "GPL";
#define USER_PAGE_ALLOC 1
+#define USER_PAGE_EXEC 2
+#define USER_PAGE_EXEC_ONLY 3
int monitored_pid;
int action;
long user_addr;
+long exec_addr;
unsigned long nr_pages;
+int write_ret;
+int exec_ret;
+static const unsigned char insns[] = {
+ 0xf3, 0x0f, 0x1e, 0xfa, /* endbr64 */
+ 0xb8, 42, 0, 0, 0, 0xc3, /* mov $42, %eax; ret */
+};
SEC("uprobe.s//proc/self/exe:user_page_trigger")
int user_page_test(struct pt_regs *ctx)
@@ -25,6 +34,15 @@ int user_page_test(struct pt_regs *ctx)
case USER_PAGE_ALLOC:
user_addr = bpf_user_page_alloc(nr_pages);
break;
+ case USER_PAGE_EXEC:
+ write_ret = bpf_probe_write_user_faultable((void *)exec_addr,
+ insns, sizeof(insns));
+ exec_ret = write_ret ? write_ret :
+ bpf_user_page_exec(exec_addr);
+ break;
+ case USER_PAGE_EXEC_ONLY:
+ exec_ret = bpf_user_page_exec(exec_addr);
+ break;
}
return 0;
--
2.54.0
next prev parent reply other threads:[~2026-10-21 19:59 UTC|newest]
Thread overview: 19+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-21 19:57 [RFC bpf-next 0/9] bpf: Add support to allocate user page Jiri Olsa
2026-10-21 19:57 ` [RFC bpf-next 1/9] bpf: Add __srcptr kfunc argument suffix Jiri Olsa
2026-10-21 19:57 ` [RFC bpf-next 2/9] bpf: Add uprobe faultable user copy kfunc Jiri Olsa
2026-10-21 20:30 ` bot+bpf-ci
2026-10-21 19:57 ` [RFC bpf-next 3/9] mm: Expose locked mprotect operation Jiri Olsa
2026-10-21 20:30 ` bot+bpf-ci
2026-10-22 10:25 ` Lorenzo Stoakes (ARM)
2026-10-22 19:39 ` Jiri Olsa
2026-10-21 19:57 ` [RFC bpf-next 4/9] bpf: Add kfuncs to allocate and seal user pages Jiri Olsa
2026-10-21 20:41 ` bot+bpf-ci
2026-10-21 19:57 ` [RFC bpf-next 5/9] selftests/bpf: Add __srcptr kfunc arguments test Jiri Olsa
2026-10-21 19:57 ` [RFC bpf-next 6/9] selftests/bpf: Add user page allocation test Jiri Olsa
2026-10-21 19:57 ` Jiri Olsa [this message]
2026-10-21 19:57 ` [RFC bpf-next 8/9] selftests/bpf: Add faultable user page writes test Jiri Olsa
2026-10-21 19:57 ` [RFC bpf-next 9/9] selftests/bpf: Add user page failures test Jiri Olsa
2026-10-21 20:30 ` bot+bpf-ci
2026-10-21 21:53 ` [RFC bpf-next 0/9] bpf: Add support to allocate user page Alexei Starovoitov
2026-10-22 10:01 ` Jiri Olsa
2026-10-22 10:27 ` Lorenzo Stoakes (ARM)
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20261021195759.119421-8-jolsa@kernel.org \
--to=jolsa@kernel.org \
--cc=akpm@linux-foundation.org \
--cc=andrii@kernel.org \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=eddyz87@gmail.com \
--cc=john.fastabend@gmail.com \
--cc=liam@infradead.org \
--cc=linux-kselftest@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=ljs@kernel.org \
--cc=memxor@gmail.com \
--cc=shuah@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox