selftests/bpf: Check that JMP32 pointer vs zero jumps are not predictedgrafted

Add jmp32_ptr_vs_zero_jne: the fall-through of the 32-bit compare, which
the verifier used to skip, contains an out of bounds map value access,
hence w/o the previous patch the program is accepted. See previous patch
for detailed description.

Reported-by: Nicholas Carlini <npc@anthropic.com>
Suggested-by: Nicholas Carlini <npc@anthropic.com>
Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://lore.kernel.org/bpf/20260904083325.2083493-6-eddyz87@gmail.com
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>

1 files changed, 42 insertions, 0 deletions

diff --git a/security/bpf/hooks.c b/security/bpf/hooks.c
new file mode 100644
index 000000000..7b98f5d1e
--- /dev/null
+++ b/security/bpf/hooks.c
@@ -0,0 +1,42 @@
+// SPDX-License-Identifier: GPL-2.0
+
+/*
+ * Copyright (C) 2020 Google LLC.
+ */
+#include <linux/lsm_hooks.h>
+#include <linux/bpf_lsm.h>
+#include <uapi/linux/lsm.h>
+
+bool bpf_lsm_initialized __ro_after_init;
+
+static struct security_hook_list bpf_lsm_hooks[] __ro_after_init = {
+	#define LSM_HOOK(RET, DEFAULT, NAME, ...) \
+	LSM_HOOK_INIT(NAME, bpf_lsm_##NAME),
+	#include <linux/lsm_hook_defs.h>
+	#undef LSM_HOOK
+	LSM_HOOK_INIT(inode_free_security, bpf_inode_storage_free),
+};
+
+static const struct lsm_id bpf_lsmid = {
+	.name = "bpf",
+	.id = LSM_ID_BPF,
+};
+
+static int __init bpf_lsm_init(void)
+{
+	security_add_hooks(bpf_lsm_hooks, ARRAY_SIZE(bpf_lsm_hooks),
+			   &bpf_lsmid);
+	bpf_lsm_initialized = true;
+	pr_info("LSM support for eBPF active\n");
+	return 0;
+}
+
+struct lsm_blob_sizes bpf_lsm_blob_sizes __ro_after_init = {
+	.lbs_inode = sizeof(struct bpf_storage_blob),
+};
+
+DEFINE_LSM(bpf) = {
+	.id = &bpf_lsmid,
+	.init = bpf_lsm_init,
+	.blobs = &bpf_lsm_blob_sizes
+};