> selftests/bpf: Cover scalar arena frees below the base
>
> Add a verifier_arena case that fills a two-page arena, calls
> bpf_arena_free_pages() with a scalar address one page below the arena
> base, and then verifies that another allocation is still rejected.
>
> Before the runtime guard, the invalid free can repopulate the free
> tree with an out-of-domain offset and the final allocation succeeds.
>
> Reviewed-by: Emil Tsalapatis <[email protected]>
> Signed-off-by: Yiyang Chen <[email protected]>
This test covers a memory-safety issue where bpf_arena_free_pages()
accepts a scalar address below the arena base and repopulates the free
tree with an out-of-domain offset, so a later allocation can return an
address below the arena mapping.
The clipping logic in arena_free_pages() that only bounded the upper end
(uaddr_end = min(...)) without checking full_uaddr >= arena->user_vm_start
was introduced in commit 317460317a02a. The paired kernel fix
a6ceda1f4a47 also carries that tag.
Should this include:
Fixes: 317460317a02a ("bpf: Introduce bpf_arena.")
---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md
CI run summary: https://github.com/kernel-patches/bpf/actions/runs/29583169394
