[bpf-next,2/2] selftests/bpf: Add test for resizing data map with struct_ops

Commit Message

David Vernet July 24, 2024, 5:14 p.m. UTC

Tests that if you resize a map after opening a skel, that it doesn't
cause a UAF which causes a struct_ops map to fail to be able to load.

Signed-off-by: David Vernet <[e-mail]>
---
 .../bpf/prog_tests/struct_ops_resize.c        | 30 +++++++++++++++++++
 .../selftests/bpf/progs/struct_ops_resize.c   | 24 +++++++++++++++
 2 files changed, 54 insertions(+)
 create mode 100644 tools/testing/selftests/bpf/prog_tests/struct_ops_resize.c
 create mode 100644 tools/testing/selftests/bpf/progs/struct_ops_resize.c

Comments

Andrii Nakryiko July 25, 2024, 12:12 a.m. UTC | #1

On Wed, Jul 24, 2024 at 10:15 AM David Vernet <[e-mail]> wrote:
>
> Tests that if you resize a map after opening a skel, that it doesn't
> cause a UAF which causes a struct_ops map to fail to be able to load.
>
> Signed-off-by: David Vernet <[e-mail]>
> ---
>  .../bpf/prog_tests/struct_ops_resize.c        | 30 +++++++++++++++++++
>  .../selftests/bpf/progs/struct_ops_resize.c   | 24 +++++++++++++++
>  2 files changed, 54 insertions(+)
>  create mode 100644 tools/testing/selftests/bpf/prog_tests/struct_ops_resize.c
>  create mode 100644 tools/testing/selftests/bpf/progs/struct_ops_resize.c
>
> diff --git a/tools/testing/selftests/bpf/prog_tests/struct_ops_resize.c b/tools/testing/selftests/bpf/prog_tests/struct_ops_resize.c
> new file mode 100644
> index 000000000000..7584f91c2bd1
> --- /dev/null
> +++ b/tools/testing/selftests/bpf/prog_tests/struct_ops_resize.c
> @@ -0,0 +1,30 @@
> +// SPDX-License-Identifier: GPL-2.0
> +
> +#include <test_progs.h>
> +#include "struct_ops_resize.skel.h"
> +
> +static void resize_datasec(void)
> +{
> +       struct struct_ops_resize *skel;
> +       int err;
> +
> +       skel = struct_ops_resize__open();
> +       if (!ASSERT_OK_PTR(skel, "struct_ops_resize__open"))
> +               return;
> +
> +       err  = bpf_map__set_value_size(skel->maps.data_resizable, 1 << 15);
> +       if (!ASSERT_OK(err, "bpf_map__set_value_size"))
> +               goto cleanup;
> +
> +       err = struct_ops_resize__load(skel);
> +       ASSERT_OK(err, "struct_ops_resize__load");
> +
> +cleanup:
> +       struct_ops_resize__destroy(skel);
> +}
> +
> +void test_struct_ops_resize(void)
> +{
> +       if (test__start_subtest("resize_datasec"))
> +               resize_datasec();

It seems a bit unnecessary to add an entire new test with a subtest
just for this. Would you mind adding this testing logic into the
already existing prog_tests/global_map_resize.c set of cases?

I've applied patch #1, as it's obviously correct, so I didn't want to
delay the fix. Thanks!

> +}
> diff --git a/tools/testing/selftests/bpf/progs/struct_ops_resize.c b/tools/testing/selftests/bpf/progs/struct_ops_resize.c
> new file mode 100644
> index 000000000000..d0b235f4bbaa
> --- /dev/null
> +++ b/tools/testing/selftests/bpf/progs/struct_ops_resize.c
> @@ -0,0 +1,24 @@
> +// SPDX-License-Identifier: GPL-2.0
> +
> +#include <linux/bpf.h>
> +#include <bpf/bpf_helpers.h>
> +#include <bpf/bpf_tracing.h>
> +
> +char _license[] SEC("license") = "GPL";
> +
> +char resizable[1] SEC(".data.resizable");
> +
> +SEC("struct_ops/test_1")
> +int BPF_PROG(test_1)
> +{
> +       return 0;
> +}
> +
> +struct bpf_testmod_ops {
> +       int (*test_1)(void);
> +};
> +
> +SEC(".struct_ops.link")
> +struct bpf_testmod_ops testmod = {
> +       .test_1 = (void *)test_1
> +};
> --
> 2.45.2
>

David Vernet July 25, 2024, 2:54 a.m. UTC | #2

On Wed, Jul 24, 2024 at 05:12:00PM -0700, Andrii Nakryiko wrote:
> On Wed, Jul 24, 2024 at 10:15 AM David Vernet <[e-mail]> wrote:
> >
> > Tests that if you resize a map after opening a skel, that it doesn't
> > cause a UAF which causes a struct_ops map to fail to be able to load.
> >
> > Signed-off-by: David Vernet <[e-mail]>
> > ---
> >  .../bpf/prog_tests/struct_ops_resize.c        | 30 +++++++++++++++++++
> >  .../selftests/bpf/progs/struct_ops_resize.c   | 24 +++++++++++++++
> >  2 files changed, 54 insertions(+)
> >  create mode 100644 tools/testing/selftests/bpf/prog_tests/struct_ops_resize.c
> >  create mode 100644 tools/testing/selftests/bpf/progs/struct_ops_resize.c
> >
> > diff --git a/tools/testing/selftests/bpf/prog_tests/struct_ops_resize.c b/tools/testing/selftests/bpf/prog_tests/struct_ops_resize.c
> > new file mode 100644
> > index 000000000000..7584f91c2bd1
> > --- /dev/null
> > +++ b/tools/testing/selftests/bpf/prog_tests/struct_ops_resize.c
> > @@ -0,0 +1,30 @@
> > +// SPDX-License-Identifier: GPL-2.0
> > +
> > +#include <test_progs.h>
> > +#include "struct_ops_resize.skel.h"
> > +
> > +static void resize_datasec(void)
> > +{
> > +       struct struct_ops_resize *skel;
> > +       int err;
> > +
> > +       skel = struct_ops_resize__open();
> > +       if (!ASSERT_OK_PTR(skel, "struct_ops_resize__open"))
> > +               return;
> > +
> > +       err  = bpf_map__set_value_size(skel->maps.data_resizable, 1 << 15);
> > +       if (!ASSERT_OK(err, "bpf_map__set_value_size"))
> > +               goto cleanup;
> > +
> > +       err = struct_ops_resize__load(skel);
> > +       ASSERT_OK(err, "struct_ops_resize__load");
> > +
> > +cleanup:
> > +       struct_ops_resize__destroy(skel);
> > +}
> > +
> > +void test_struct_ops_resize(void)
> > +{
> > +       if (test__start_subtest("resize_datasec"))
> > +               resize_datasec();
> 
> It seems a bit unnecessary to add an entire new test with a subtest
> just for this. Would you mind adding this testing logic into the
> already existing prog_tests/global_map_resize.c set of cases?

Sure thing, I'll send a subsequent patch that adds the testcase to
prog_tests/global_map_resize.c.

> I've applied patch #1, as it's obviously correct, so I didn't want to
> delay the fix. Thanks!

Thanks!

Patch

diff --git a/tools/testing/selftests/bpf/prog_tests/struct_ops_resize.c b/tools/testing/selftests/bpf/prog_tests/struct_ops_resize.c
new file mode 100644
index 000000000000..7584f91c2bd1
--- /dev/null
+++ b/tools/testing/selftests/bpf/prog_tests/struct_ops_resize.c
@@ -0,0 +1,30 @@ 
+// SPDX-License-Identifier: GPL-2.0
+
+#include <test_progs.h>
+#include "struct_ops_resize.skel.h"
+
+static void resize_datasec(void)
+{
+	struct struct_ops_resize *skel;
+	int err;
+
+	skel = struct_ops_resize__open();
+	if (!ASSERT_OK_PTR(skel, "struct_ops_resize__open"))
+		return;
+
+	err  = bpf_map__set_value_size(skel->maps.data_resizable, 1 << 15);
+	if (!ASSERT_OK(err, "bpf_map__set_value_size"))
+		goto cleanup;
+
+	err = struct_ops_resize__load(skel);
+	ASSERT_OK(err, "struct_ops_resize__load");
+
+cleanup:
+	struct_ops_resize__destroy(skel);
+}
+
+void test_struct_ops_resize(void)
+{
+	if (test__start_subtest("resize_datasec"))
+		resize_datasec();
+}
diff --git a/tools/testing/selftests/bpf/progs/struct_ops_resize.c b/tools/testing/selftests/bpf/progs/struct_ops_resize.c
new file mode 100644
index 000000000000..d0b235f4bbaa
--- /dev/null
+++ b/tools/testing/selftests/bpf/progs/struct_ops_resize.c
@@ -0,0 +1,24 @@ 
+// SPDX-License-Identifier: GPL-2.0
+
+#include <linux/bpf.h>
+#include <bpf/bpf_helpers.h>
+#include <bpf/bpf_tracing.h>
+
+char _license[] SEC("license") = "GPL";
+
+char resizable[1] SEC(".data.resizable");
+
+SEC("struct_ops/test_1")
+int BPF_PROG(test_1)
+{
+	return 0;
+}
+
+struct bpf_testmod_ops {
+	int (*test_1)(void);
+};
+
+SEC(".struct_ops.link")
+struct bpf_testmod_ops testmod = {
+	.test_1 = (void *)test_1
+};