diff mbox series

[bpf-next,2/2] selftests/bpf: Add tests for ldsx of pkt data/data_end/data_meta accesses

Message ID 20240715201833.3236556-1-yonghong.song@linux.dev (mailing list archive)
State Superseded
Delegated to: BPF
Headers show
Series [bpf-next,1/2] bpf: Fail verification for sign-extension of packet data/data_end/data_meta | expand

Checks

Context Check Description
bpf/vmtest-bpf-next-PR success PR summary
netdev/series_format success Single patches do not need cover letters
netdev/tree_selection success Clearly marked for bpf-next, async
netdev/ynl success Generated files up to date; no warnings/errors; no diff in generated;
netdev/fixes_present success Fixes tag not required for -next series
netdev/header_inline success No static functions without inline keyword in header files
netdev/build_32bit success Errors and warnings before: 8 this patch: 8
netdev/build_tools success Errors and warnings before: 0 this patch: 0
netdev/cc_maintainers warning 15 maintainers not CCed: kpsingh@kernel.org shuah@kernel.org haoluo@google.com hawk@kernel.org kuba@kernel.org john.fastabend@gmail.com jolsa@kernel.org linux-kselftest@vger.kernel.org martin.lau@linux.dev mykolal@fb.com song@kernel.org sdf@fomichev.me eddyz87@gmail.com iii@linux.ibm.com netdev@vger.kernel.org
netdev/build_clang success Errors and warnings before: 8 this patch: 8
netdev/verify_signedoff success Signed-off-by tag matches author and committer
netdev/deprecated_api success None detected
netdev/check_selftest success No net selftest shell script
netdev/verify_fixes success No Fixes tag
netdev/build_allmodconfig_warn success Errors and warnings before: 8 this patch: 8
netdev/checkpatch fail CHECK: Lines should not end with a '(' ERROR: code indent should use tabs where possible WARNING: please, no spaces at the start of a line WARNING: quoted string split across lines
netdev/build_clang_rust success No Rust files in patch. Skipping build
netdev/kdoc success Errors and warnings before: 0 this patch: 0
netdev/source_inline success Was 0 now: 0
bpf/vmtest-bpf-next-VM_Test-1 success Logs for ShellCheck
bpf/vmtest-bpf-next-VM_Test-2 success Logs for Unittests
bpf/vmtest-bpf-next-VM_Test-3 success Logs for Validate matrix.py
bpf/vmtest-bpf-next-VM_Test-0 success Logs for Lint
bpf/vmtest-bpf-next-VM_Test-5 success Logs for aarch64-gcc / build-release
bpf/vmtest-bpf-next-VM_Test-4 success Logs for aarch64-gcc / build / build for aarch64 with gcc
bpf/vmtest-bpf-next-VM_Test-10 success Logs for aarch64-gcc / veristat
bpf/vmtest-bpf-next-VM_Test-12 success Logs for s390x-gcc / build-release
bpf/vmtest-bpf-next-VM_Test-8 success Logs for aarch64-gcc / test (test_progs_no_alu32, false, 360) / test_progs_no_alu32 on aarch64 with gcc
bpf/vmtest-bpf-next-VM_Test-13 success Logs for s390x-gcc / test (test_maps, false, 360) / test_maps on s390x with gcc
bpf/vmtest-bpf-next-VM_Test-20 success Logs for x86_64-gcc / build-release
bpf/vmtest-bpf-next-VM_Test-6 success Logs for aarch64-gcc / test (test_maps, false, 360) / test_maps on aarch64 with gcc
bpf/vmtest-bpf-next-VM_Test-16 success Logs for s390x-gcc / test (test_verifier, false, 360) / test_verifier on s390x with gcc
bpf/vmtest-bpf-next-VM_Test-11 success Logs for s390x-gcc / build / build for s390x with gcc
bpf/vmtest-bpf-next-VM_Test-9 success Logs for aarch64-gcc / test (test_verifier, false, 360) / test_verifier on aarch64 with gcc
bpf/vmtest-bpf-next-VM_Test-7 success Logs for aarch64-gcc / test (test_progs, false, 360) / test_progs on aarch64 with gcc
bpf/vmtest-bpf-next-VM_Test-17 success Logs for s390x-gcc / veristat
bpf/vmtest-bpf-next-VM_Test-18 success Logs for set-matrix
bpf/vmtest-bpf-next-VM_Test-35 success Logs for x86_64-llvm-18 / build / build for x86_64 with llvm-18
bpf/vmtest-bpf-next-VM_Test-29 success Logs for x86_64-llvm-17 / build-release / build for x86_64 with llvm-17-O2
bpf/vmtest-bpf-next-VM_Test-28 success Logs for x86_64-llvm-17 / build / build for x86_64 with llvm-17
bpf/vmtest-bpf-next-VM_Test-42 success Logs for x86_64-llvm-18 / veristat
bpf/vmtest-bpf-next-VM_Test-19 success Logs for x86_64-gcc / build / build for x86_64 with gcc
bpf/vmtest-bpf-next-VM_Test-36 success Logs for x86_64-llvm-18 / build-release / build for x86_64 with llvm-18-O2
bpf/vmtest-bpf-next-VM_Test-34 success Logs for x86_64-llvm-17 / veristat
bpf/vmtest-bpf-next-VM_Test-26 success Logs for x86_64-gcc / test (test_verifier, false, 360) / test_verifier on x86_64 with gcc
bpf/vmtest-bpf-next-VM_Test-27 success Logs for x86_64-gcc / veristat / veristat on x86_64 with gcc
bpf/vmtest-bpf-next-VM_Test-15 success Logs for s390x-gcc / test (test_progs_no_alu32, false, 360) / test_progs_no_alu32 on s390x with gcc
bpf/vmtest-bpf-next-VM_Test-24 success Logs for x86_64-gcc / test (test_progs_no_alu32_parallel, true, 30) / test_progs_no_alu32_parallel on x86_64 with gcc
bpf/vmtest-bpf-next-VM_Test-38 success Logs for x86_64-llvm-18 / test (test_progs, false, 360) / test_progs on x86_64 with llvm-18
bpf/vmtest-bpf-next-VM_Test-31 success Logs for x86_64-llvm-17 / test (test_progs, false, 360) / test_progs on x86_64 with llvm-17
bpf/vmtest-bpf-next-VM_Test-37 success Logs for x86_64-llvm-18 / test (test_maps, false, 360) / test_maps on x86_64 with llvm-18
bpf/vmtest-bpf-next-VM_Test-33 success Logs for x86_64-llvm-17 / test (test_verifier, false, 360) / test_verifier on x86_64 with llvm-17
bpf/vmtest-bpf-next-VM_Test-25 success Logs for x86_64-gcc / test (test_progs_parallel, true, 30) / test_progs_parallel on x86_64 with gcc
bpf/vmtest-bpf-next-VM_Test-32 success Logs for x86_64-llvm-17 / test (test_progs_no_alu32, false, 360) / test_progs_no_alu32 on x86_64 with llvm-17
bpf/vmtest-bpf-next-VM_Test-21 success Logs for x86_64-gcc / test (test_maps, false, 360) / test_maps on x86_64 with gcc
bpf/vmtest-bpf-next-VM_Test-41 success Logs for x86_64-llvm-18 / test (test_verifier, false, 360) / test_verifier on x86_64 with llvm-18
bpf/vmtest-bpf-next-VM_Test-23 success Logs for x86_64-gcc / test (test_progs_no_alu32, false, 360) / test_progs_no_alu32 on x86_64 with gcc
bpf/vmtest-bpf-next-VM_Test-30 success Logs for x86_64-llvm-17 / test (test_maps, false, 360) / test_maps on x86_64 with llvm-17
bpf/vmtest-bpf-next-VM_Test-14 success Logs for s390x-gcc / test (test_progs, false, 360) / test_progs on s390x with gcc
bpf/vmtest-bpf-next-VM_Test-39 success Logs for x86_64-llvm-18 / test (test_progs_cpuv4, false, 360) / test_progs_cpuv4 on x86_64 with llvm-18
bpf/vmtest-bpf-next-VM_Test-22 success Logs for x86_64-gcc / test (test_progs, false, 360) / test_progs on x86_64 with gcc
bpf/vmtest-bpf-next-VM_Test-40 success Logs for x86_64-llvm-18 / test (test_progs_no_alu32, false, 360) / test_progs_no_alu32 on x86_64 with llvm-18

Commit Message

Yonghong Song July 15, 2024, 8:18 p.m. UTC 
The following tests are added to verifier_ldsx.c:
  - sign extension of data/data_end/data_meta for tcx programs.
    The actual checking is in bpf_skb_is_valid_access() which
    is called by sk_filter, cg_skb, lwt, tc(tcx) and sk_skb.
  - sign extension of data/data_end/data_meta for xdp programs.
  - sign extension of data/data_end for flow_dissector programs.

All newly-added tests have verification failure with message
"invalid bpf_context access". Without previous patch, all these
tests succeeded verification.

Signed-off-by: Yonghong Song <yonghong.song@linux.dev>
---
 .../selftests/bpf/progs/verifier_ldsx.c       | 168 ++++++++++++++++++
 1 file changed, 168 insertions(+)

Comments

Eduard Zingerman July 16, 2024, 7:54 p.m. UTC | #1 
On Mon, 2024-07-15 at 13:18 -0700, Yonghong Song wrote:

[...]

> +SEC("xdp")
> +__description("LDSX, xdp s32 xdp_md->data")
> +__failure __msg("invalid bpf_context access")
> +__naked void ldsx_ctx_1(void)
> +{
> +        asm volatile (
> +        "r2 = *(s32 *)(r1 + %[xdp_md_data]);"

Nit: this test fails at the first instruction,
     hence there is no need to include it's tail.
     I think it would be good to keep these tests minimal.

> +        "r3 = *(u32 *)(r1 + %[xdp_md_data_end]);"
> +        "r1 = r2;"
> +        "r1 += 8;"
> +        "if r1 > r3 goto l0_%=;"
> +        "r0 = *(u64 *)(r1 - 8);"
> +"l0_%=:"
> +	"r0 = 0;"
> +        "exit;"
> +	:
> +        : __imm_const(xdp_md_data, offsetof(struct xdp_md, data)),
> +	  __imm_const(xdp_md_data_end, offsetof(struct xdp_md, data_end))
> +        : __clobber_all);
> +}

[...]
Yonghong Song July 16, 2024, 10:32 p.m. UTC | #2 
On 7/16/24 12:54 PM, Eduard Zingerman wrote:
> On Mon, 2024-07-15 at 13:18 -0700, Yonghong Song wrote:
>
> [...]
>
>> +SEC("xdp")
>> +__description("LDSX, xdp s32 xdp_md->data")
>> +__failure __msg("invalid bpf_context access")
>> +__naked void ldsx_ctx_1(void)
>> +{
>> +        asm volatile (
>> +        "r2 = *(s32 *)(r1 + %[xdp_md_data]);"
> Nit: this test fails at the first instruction,
>       hence there is no need to include it's tail.
>       I think it would be good to keep these tests minimal.

Okay, I will shorten the test to have minimum instructions
to reproduce the issue.

>
>> +        "r3 = *(u32 *)(r1 + %[xdp_md_data_end]);"
>> +        "r1 = r2;"
>> +        "r1 += 8;"
>> +        "if r1 > r3 goto l0_%=;"
>> +        "r0 = *(u64 *)(r1 - 8);"
>> +"l0_%=:"
>> +	"r0 = 0;"
>> +        "exit;"
>> +	:
>> +        : __imm_const(xdp_md_data, offsetof(struct xdp_md, data)),
>> +	  __imm_const(xdp_md_data_end, offsetof(struct xdp_md, data_end))
>> +        : __clobber_all);
>> +}
> [...]
diff mbox series

Patch

diff --git a/tools/testing/selftests/bpf/progs/verifier_ldsx.c b/tools/testing/selftests/bpf/progs/verifier_ldsx.c
index d4427d8e1217..982b6c9c0b6d 100644
--- a/tools/testing/selftests/bpf/progs/verifier_ldsx.c
+++ b/tools/testing/selftests/bpf/progs/verifier_ldsx.c
@@ -144,6 +144,174 @@  __naked void ldsx_s32_range(void)
 	: __clobber_all);
 }
 
+SEC("xdp")
+__description("LDSX, xdp s32 xdp_md->data")
+__failure __msg("invalid bpf_context access")
+__naked void ldsx_ctx_1(void)
+{
+        asm volatile (
+        "r2 = *(s32 *)(r1 + %[xdp_md_data]);"
+        "r3 = *(u32 *)(r1 + %[xdp_md_data_end]);"
+        "r1 = r2;"
+        "r1 += 8;"
+        "if r1 > r3 goto l0_%=;"
+        "r0 = *(u64 *)(r1 - 8);"
+"l0_%=:"
+	"r0 = 0;"
+        "exit;"
+	:
+        : __imm_const(xdp_md_data, offsetof(struct xdp_md, data)),
+	  __imm_const(xdp_md_data_end, offsetof(struct xdp_md, data_end))
+        : __clobber_all);
+}
+
+SEC("xdp")
+__description("LDSX, xdp s32 xdp_md->data_end")
+__failure __msg("invalid bpf_context access")
+__naked void ldsx_ctx_2(void)
+{
+        asm volatile (
+        "r2 = *(u32 *)(r1 + %[xdp_md_data]);"
+        "r3 = *(s32 *)(r1 + %[xdp_md_data_end]);"
+        "r1 = r2;"
+        "r1 += 8;"
+        "if r1 > r3 goto l0_%=;"
+        "r0 = *(u64 *)(r1 - 8);"
+"l0_%=:"
+	"r0 = 0;"
+        "exit;"
+	:
+        : __imm_const(xdp_md_data, offsetof(struct xdp_md, data)),
+	  __imm_const(xdp_md_data_end, offsetof(struct xdp_md, data_end))
+        : __clobber_all);
+}
+
+SEC("xdp")
+__description("LDSX, xdp s32 xdp_md->data_meta")
+__failure __msg("invalid bpf_context access")
+__naked void ldsx_ctx_3(void)
+{
+        asm volatile (
+        "r2 = *(s32 *)(r1 + %[xdp_md_data_meta]);"
+        "r3 = *(u32 *)(r1 + %[xdp_md_data]);"
+        "r1 = r2;"
+        "r1 += 8;"
+        "if r1 > r3 goto l0_%=;"
+        "r0 = *(u64 *)(r1 - 8);"
+"l0_%=:"
+	"r0 = 0;"
+        "exit;"
+	:
+        : __imm_const(xdp_md_data_meta, offsetof(struct xdp_md, data_meta)),
+	  __imm_const(xdp_md_data, offsetof(struct xdp_md, data))
+        : __clobber_all);
+}
+
+SEC("tcx/ingress")
+__description("LDSX, tcx s32 __sk_buff->data")
+__failure __msg("invalid bpf_context access")
+__naked void ldsx_ctx_4(void)
+{
+        asm volatile (
+        "r2 = *(s32 *)(r1 + %[sk_buff_data]);"
+        "r3 = *(u32 *)(r1 + %[sk_buff_data_end]);"
+        "r1 = r2;"
+        "r1 += 8;"
+        "if r1 > r3 goto l0_%=;"
+        "r0 = *(u64 *)(r1 - 8);"
+"l0_%=:"
+	"r0 = 0;"
+        "exit;"
+	:
+        : __imm_const(sk_buff_data, offsetof(struct __sk_buff, data)),
+	  __imm_const(sk_buff_data_end, offsetof(struct __sk_buff, data_end))
+        : __clobber_all);
+}
+
+SEC("tcx/ingress")
+__description("LDSX, tcx s32 __sk_buff->data_end")
+__failure __msg("invalid bpf_context access")
+__naked void ldsx_ctx_5(void)
+{
+        asm volatile (
+        "r2 = *(u32 *)(r1 + %[sk_buff_data]);"
+        "r3 = *(s32 *)(r1 + %[sk_buff_data_end]);"
+        "r1 = r2;"
+        "r1 += 8;"
+        "if r1 > r3 goto l0_%=;"
+        "r0 = *(u64 *)(r1 - 8);"
+"l0_%=:"
+	"r0 = 0;"
+        "exit;"
+	:
+        : __imm_const(sk_buff_data, offsetof(struct __sk_buff, data)),
+	  __imm_const(sk_buff_data_end, offsetof(struct __sk_buff, data_end))
+        : __clobber_all);
+}
+
+SEC("tcx/ingress")
+__description("LDSX, tcx s32 __sk_buff->data_meta")
+__failure __msg("invalid bpf_context access")
+__naked void ldsx_ctx_6(void)
+{
+        asm volatile (
+        "r2 = *(s32 *)(r1 + %[sk_buff_data_meta]);"
+        "r3 = *(u32 *)(r1 + %[sk_buff_data]);"
+        "r1 = r2;"
+        "r1 += 8;"
+        "if r1 > r3 goto l0_%=;"
+        "r0 = *(u64 *)(r1 - 8);"
+"l0_%=:"
+	"r0 = 0;"
+        "exit;"
+	:
+        : __imm_const(sk_buff_data_meta, offsetof(struct __sk_buff, data_meta)),
+	  __imm_const(sk_buff_data, offsetof(struct __sk_buff, data))
+        : __clobber_all);
+}
+
+SEC("flow_dissector")
+__description("LDSX, flow_dissector s32 __sk_buff->data")
+__failure __msg("invalid bpf_context access")
+__naked void ldsx_ctx_7(void)
+{
+        asm volatile (
+        "r2 = *(s32 *)(r1 + %[sk_buff_data]);"
+        "r3 = *(u32 *)(r1 + %[sk_buff_data_end]);"
+        "r1 = r2;"
+        "r1 += 8;"
+        "if r1 > r3 goto l0_%=;"
+        "r0 = *(u64 *)(r1 - 8);"
+"l0_%=:"
+	"r0 = 0;"
+        "exit;"
+	:
+        : __imm_const(sk_buff_data, offsetof(struct __sk_buff, data)),
+	  __imm_const(sk_buff_data_end, offsetof(struct __sk_buff, data_end))
+        : __clobber_all);
+}
+
+SEC("flow_dissector")
+__description("LDSX, flow_dissector s32 __sk_buff->data_end")
+__failure __msg("invalid bpf_context access")
+__naked void ldsx_ctx_8(void)
+{
+        asm volatile (
+        "r2 = *(u32 *)(r1 + %[sk_buff_data]);"
+        "r3 = *(s32 *)(r1 + %[sk_buff_data_end]);"
+        "r1 = r2;"
+        "r1 += 8;"
+        "if r1 > r3 goto l0_%=;"
+        "r0 = *(u64 *)(r1 - 8);"
+"l0_%=:"
+	"r0 = 0;"
+        "exit;"
+	:
+        : __imm_const(sk_buff_data, offsetof(struct __sk_buff, data)),
+	  __imm_const(sk_buff_data_end, offsetof(struct __sk_buff, data_end))
+        : __clobber_all);
+}
+
 #else
 
 SEC("socket")