diff mbox series

[bpf-next,v3,4/4] selftest/bpf: add test for var-offset stack access

Message ID 20210207011027.676572-5-andreimatei1@gmail.com (mailing list archive)
State Accepted
Delegated to: BPF
Headers show
Series allow variable-offset stack acces | expand

Checks

Context Check Description
netdev/cover_letter success Link
netdev/fixes_present success Link
netdev/patch_count success Link
netdev/tree_selection success Clearly marked for bpf-next
netdev/subject_prefix success Link
netdev/cc_maintainers warning 9 maintainers not CCed: songliubraving@fb.com kafai@fb.com john.fastabend@gmail.com linux-kselftest@vger.kernel.org yhs@fb.com netdev@vger.kernel.org kpsingh@kernel.org daniel@iogearbox.net shuah@kernel.org
netdev/source_inline success Was 0 now: 0
netdev/verify_signedoff success Link
netdev/module_param success Was 0 now: 0
netdev/build_32bit success Errors and warnings before: 0 this patch: 0
netdev/kdoc success Errors and warnings before: 2 this patch: 0
netdev/verify_fixes success Link
netdev/checkpatch warning WARNING: added, moved or deleted file(s), does MAINTAINERS need updating?
netdev/build_allmodconfig_warn success Errors and warnings before: 0 this patch: 0
netdev/header_inline success Link
netdev/stable success Stable not CCed

Commit Message

Andrei Matei Feb. 7, 2021, 1:10 a.m. UTC
Add a higher-level test (C BPF program) for the new functionality -
variable access stack reads and writes.

Signed-off-by: Andrei Matei <andreimatei1@gmail.com>
---
 .../selftests/bpf/prog_tests/stack_var_off.c  | 36 ++++++++++++
 .../selftests/bpf/progs/test_stack_var_off.c  | 56 +++++++++++++++++++
 2 files changed, 92 insertions(+)
 create mode 100644 tools/testing/selftests/bpf/prog_tests/stack_var_off.c
 create mode 100644 tools/testing/selftests/bpf/progs/test_stack_var_off.c

Comments

Andrii Nakryiko Feb. 8, 2021, 10:03 p.m. UTC | #1
On Sat, Feb 6, 2021 at 5:11 PM Andrei Matei <andreimatei1@gmail.com> wrote:
>
> Add a higher-level test (C BPF program) for the new functionality -
> variable access stack reads and writes.
>
> Signed-off-by: Andrei Matei <andreimatei1@gmail.com>
> ---
>  .../selftests/bpf/prog_tests/stack_var_off.c  | 36 ++++++++++++
>  .../selftests/bpf/progs/test_stack_var_off.c  | 56 +++++++++++++++++++
>  2 files changed, 92 insertions(+)
>  create mode 100644 tools/testing/selftests/bpf/prog_tests/stack_var_off.c
>  create mode 100644 tools/testing/selftests/bpf/progs/test_stack_var_off.c
>
> diff --git a/tools/testing/selftests/bpf/prog_tests/stack_var_off.c b/tools/testing/selftests/bpf/prog_tests/stack_var_off.c
> new file mode 100644
> index 000000000000..52e00486b1aa
> --- /dev/null
> +++ b/tools/testing/selftests/bpf/prog_tests/stack_var_off.c
> @@ -0,0 +1,36 @@
> +// SPDX-License-Identifier: GPL-2.0
> +#include <test_progs.h>
> +#include "test_stack_var_off.skel.h"
> +
> +/* Test read and writes to the stack performed with offsets that are not
> + * statically known.
> + */
> +void test_stack_var_off(void)
> +{
> +       int duration = 0;
> +       struct test_stack_var_off *skel;
> +
> +       skel = test_stack_var_off__open_and_load();
> +       if (CHECK(!skel, "skel_open", "failed to open skeleton\n"))
> +               return;
> +       if (CHECK(!skel->bss, "check_bss", ".bss wasn't mmap()-ed\n"))
> +               goto cleanup;

can't happen, no need to check for !skel->bss


> +
> +       test_stack_var_off__attach(skel);

check errors (ASSERT_OK is good for this)

> +
> +       /* Give pid to bpf prog so it doesn't trigger for anyone else. */
> +       skel->bss->test_pid = getpid();
> +       /* Initialize the probe's input. */
> +       skel->bss->input[0] = 2;
> +       skel->bss->input[1] = 42;  /* This will be returned in probe_res. */
> +
> +       /* Trigger probe. */
> +       usleep(1);
> +
> +       if (CHECK(skel->bss->probe_res != 42, "check_probe_res",
> +                 "wrong probe res: %d\n", skel->bss->probe_res))
> +               goto cleanup;
> +
> +cleanup:
> +       test_stack_var_off__destroy(skel);
> +}
> diff --git a/tools/testing/selftests/bpf/progs/test_stack_var_off.c b/tools/testing/selftests/bpf/progs/test_stack_var_off.c
> new file mode 100644
> index 000000000000..bd9c8d86cd91
> --- /dev/null
> +++ b/tools/testing/selftests/bpf/progs/test_stack_var_off.c
> @@ -0,0 +1,56 @@
> +// SPDX-License-Identifier: GPL-2.0
> +// Copyright (c) 2017 Facebook

2021 already :) Facebook isn't right here as well, probably?

> +
> +#include <linux/ptrace.h>

don't need this

> +#include <linux/bpf.h>
> +#include <bpf/bpf_helpers.h>
> +#include <bpf/bpf_tracing.h>

and don't need this as well

> +
> +int probe_res;
> +
> +char input[4] = {};
> +int test_pid;
> +
> +SEC("tracepoint/syscalls/sys_enter_nanosleep")
> +int probe(void *ctx)
> +{
> +       /* This BPF program performs variable-offset reads and writes on a
> +        * stack-allocated buffer.
> +        */
> +       char stack_buf[16];
> +       unsigned long len;
> +       unsigned long last;
> +
> +       if (test_pid == 0)
> +               return 0;

can't happen, please remove

> +       if ((bpf_get_current_pid_tgid() >> 32) != test_pid)
> +               return 0;
> +
> +       /* Copy the input to the stack. */
> +       __builtin_memcpy(stack_buf, input, 4);
> +
> +       /* The first byte in the buffer indicates the length. */
> +       len = stack_buf[0] & 0xf;
> +       last = (len - 1) & 0xf;
> +
> +       /* Append something to the buffer. The offset where we write is not
> +        * statically known; this is a variable-offset stack write.
> +        */
> +       stack_buf[len] = 42;
> +
> +       /* Index into the buffer at an unknown offset. This is a
> +        * variable-offset stack read.
> +        *
> +        * Note that if it wasn't for the preceding variable-offset write, this
> +        * read would be rejected because the stack slot cannot be verified as
> +        * being initialized. With the preceding variable-offset write, the
> +        * stack slot still cannot be verified, but the write inhibits the
> +        * respective check on the reasoning that, if there was a
> +        * variable-offset to a higher-or-equal spot, we're probably reading
> +        * what we just wrote.
> +        */
> +       probe_res = stack_buf[last];
> +       return 0;
> +}
> +
> +char _license[] SEC("license") = "GPL";
> --
> 2.27.0
>
diff mbox series

Patch

diff --git a/tools/testing/selftests/bpf/prog_tests/stack_var_off.c b/tools/testing/selftests/bpf/prog_tests/stack_var_off.c
new file mode 100644
index 000000000000..52e00486b1aa
--- /dev/null
+++ b/tools/testing/selftests/bpf/prog_tests/stack_var_off.c
@@ -0,0 +1,36 @@ 
+// SPDX-License-Identifier: GPL-2.0
+#include <test_progs.h>
+#include "test_stack_var_off.skel.h"
+
+/* Test read and writes to the stack performed with offsets that are not
+ * statically known.
+ */
+void test_stack_var_off(void)
+{
+	int duration = 0;
+	struct test_stack_var_off *skel;
+
+	skel = test_stack_var_off__open_and_load();
+	if (CHECK(!skel, "skel_open", "failed to open skeleton\n"))
+		return;
+	if (CHECK(!skel->bss, "check_bss", ".bss wasn't mmap()-ed\n"))
+		goto cleanup;
+
+	test_stack_var_off__attach(skel);
+
+	/* Give pid to bpf prog so it doesn't trigger for anyone else. */
+	skel->bss->test_pid = getpid();
+	/* Initialize the probe's input. */
+	skel->bss->input[0] = 2;
+	skel->bss->input[1] = 42;  /* This will be returned in probe_res. */
+
+	/* Trigger probe. */
+	usleep(1);
+
+	if (CHECK(skel->bss->probe_res != 42, "check_probe_res",
+		  "wrong probe res: %d\n", skel->bss->probe_res))
+		goto cleanup;
+
+cleanup:
+	test_stack_var_off__destroy(skel);
+}
diff --git a/tools/testing/selftests/bpf/progs/test_stack_var_off.c b/tools/testing/selftests/bpf/progs/test_stack_var_off.c
new file mode 100644
index 000000000000..bd9c8d86cd91
--- /dev/null
+++ b/tools/testing/selftests/bpf/progs/test_stack_var_off.c
@@ -0,0 +1,56 @@ 
+// SPDX-License-Identifier: GPL-2.0
+// Copyright (c) 2017 Facebook
+
+#include <linux/ptrace.h>
+#include <linux/bpf.h>
+#include <bpf/bpf_helpers.h>
+#include <bpf/bpf_tracing.h>
+
+int probe_res;
+
+char input[4] = {};
+int test_pid;
+
+SEC("tracepoint/syscalls/sys_enter_nanosleep")
+int probe(void *ctx)
+{
+	/* This BPF program performs variable-offset reads and writes on a
+	 * stack-allocated buffer.
+	 */
+	char stack_buf[16];
+	unsigned long len;
+	unsigned long last;
+
+	if (test_pid == 0)
+		return 0;
+	if ((bpf_get_current_pid_tgid() >> 32) != test_pid)
+		return 0;
+
+	/* Copy the input to the stack. */
+	__builtin_memcpy(stack_buf, input, 4);
+
+	/* The first byte in the buffer indicates the length. */
+	len = stack_buf[0] & 0xf;
+	last = (len - 1) & 0xf;
+
+	/* Append something to the buffer. The offset where we write is not
+	 * statically known; this is a variable-offset stack write.
+	 */
+	stack_buf[len] = 42;
+
+	/* Index into the buffer at an unknown offset. This is a
+	 * variable-offset stack read.
+	 *
+	 * Note that if it wasn't for the preceding variable-offset write, this
+	 * read would be rejected because the stack slot cannot be verified as
+	 * being initialized. With the preceding variable-offset write, the
+	 * stack slot still cannot be verified, but the write inhibits the
+	 * respective check on the reasoning that, if there was a
+	 * variable-offset to a higher-or-equal spot, we're probably reading
+	 * what we just wrote.
+	 */
+	probe_res = stack_buf[last];
+	return 0;
+}
+
+char _license[] SEC("license") = "GPL";