diff mbox series

[RFC,bpf-next,v1,2/2] selftests/bpf: Add selftest for bpf_dynptr_slice_rdwr r0 handling

Message ID 20250219125117.1956939-3-memxor@gmail.com (mailing list archive)
State RFC
Delegated to: BPF
Headers show
Series Fix bpf_dynptr_slice_rdwr stack state | expand

Checks

Context Check Description
bpf/vmtest-bpf-next-VM_Test-2 success Logs for Unittests
bpf/vmtest-bpf-next-VM_Test-0 success Logs for Lint
bpf/vmtest-bpf-next-VM_Test-15 success Logs for s390x-gcc / build-release
bpf/vmtest-bpf-next-VM_Test-11 success Logs for aarch64-gcc / veristat-kernel
bpf/vmtest-bpf-next-VM_Test-10 success Logs for aarch64-gcc / test (test_verifier, false, 360) / test_verifier on aarch64 with gcc
bpf/vmtest-bpf-next-VM_Test-20 success Logs for s390x-gcc / veristat-meta
bpf/vmtest-bpf-next-VM_Test-14 success Logs for s390x-gcc / build / build for s390x with gcc
bpf/vmtest-bpf-next-VM_Test-6 success Logs for aarch64-gcc / build-release
bpf/vmtest-bpf-next-VM_Test-5 success Logs for aarch64-gcc / build / build for aarch64 with gcc
bpf/vmtest-bpf-next-VM_Test-3 success Logs for Validate matrix.py
bpf/vmtest-bpf-next-VM_Test-30 success Logs for x86_64-gcc / test (test_verifier, false, 360) / test_verifier on x86_64 with gcc
bpf/vmtest-bpf-next-VM_Test-13 success Logs for s390x-gcc / GCC BPF
bpf/vmtest-bpf-next-VM_Test-34 success Logs for x86_64-llvm-17 / build / build for x86_64 with llvm-17
bpf/vmtest-bpf-next-VM_Test-19 success Logs for s390x-gcc / veristat-kernel
bpf/vmtest-bpf-next-VM_Test-44 success Logs for x86_64-llvm-18 / build-release / build for x86_64 with llvm-18-O2
bpf/vmtest-bpf-next-VM_Test-24 success Logs for x86_64-gcc / build-release
bpf/vmtest-bpf-next-VM_Test-1 success Logs for ShellCheck
bpf/vmtest-bpf-next-VM_Test-21 success Logs for set-matrix
bpf/vmtest-bpf-next-VM_Test-23 success Logs for x86_64-gcc / build / build for x86_64 with gcc
bpf/vmtest-bpf-next-VM_Test-43 success Logs for x86_64-llvm-18 / build / build for x86_64 with llvm-18
bpf/vmtest-bpf-next-VM_Test-4 success Logs for aarch64-gcc / GCC BPF
bpf/vmtest-bpf-next-VM_Test-39 success Logs for x86_64-llvm-17 / test (test_verifier, false, 360) / test_verifier on x86_64 with llvm-17
bpf/vmtest-bpf-next-VM_Test-35 success Logs for x86_64-llvm-17 / build-release / build for x86_64 with llvm-17-O2
bpf/vmtest-bpf-next-VM_Test-41 success Logs for x86_64-llvm-17 / veristat-meta
bpf/vmtest-bpf-next-VM_Test-40 success Logs for x86_64-llvm-17 / veristat-kernel
bpf/vmtest-bpf-next-VM_Test-12 success Logs for aarch64-gcc / veristat-meta
bpf/vmtest-bpf-next-VM_Test-49 success Logs for x86_64-llvm-18 / test (test_verifier, false, 360) / test_verifier on x86_64 with llvm-18
bpf/vmtest-bpf-next-VM_Test-50 success Logs for x86_64-llvm-18 / veristat-kernel
bpf/vmtest-bpf-next-VM_Test-51 success Logs for x86_64-llvm-18 / veristat-meta
bpf/vmtest-bpf-next-VM_Test-27 fail Logs for x86_64-gcc / test (test_progs_no_alu32, false, 360) / test_progs_no_alu32 on x86_64 with gcc
bpf/vmtest-bpf-next-VM_Test-28 success Logs for x86_64-gcc / test (test_progs_no_alu32_parallel, true, 30) / test_progs_no_alu32_parallel on x86_64 with gcc
bpf/vmtest-bpf-next-VM_Test-25 success Logs for x86_64-gcc / test (test_maps, false, 360) / test_maps on x86_64 with gcc
bpf/vmtest-bpf-next-VM_Test-31 fail Logs for x86_64-gcc / veristat-kernel / x86_64-gcc veristat_kernel
bpf/vmtest-bpf-next-VM_Test-29 success Logs for x86_64-gcc / test (test_progs_parallel, true, 30) / test_progs_parallel on x86_64 with gcc
bpf/vmtest-bpf-next-VM_Test-22 success Logs for x86_64-gcc / GCC BPF / GCC BPF
bpf/vmtest-bpf-next-VM_Test-26 fail Logs for x86_64-gcc / test (test_progs, false, 360) / test_progs on x86_64 with gcc
bpf/vmtest-bpf-next-VM_Test-36 success Logs for x86_64-llvm-17 / test (test_maps, false, 360) / test_maps on x86_64 with llvm-17
bpf/vmtest-bpf-next-VM_Test-32 success Logs for x86_64-gcc / veristat-meta / x86_64-gcc veristat_meta
bpf/vmtest-bpf-next-VM_Test-37 fail Logs for x86_64-llvm-17 / test (test_progs, false, 360) / test_progs on x86_64 with llvm-17
bpf/vmtest-bpf-next-VM_Test-33 success Logs for x86_64-llvm-17 / GCC BPF / GCC BPF
bpf/vmtest-bpf-next-VM_Test-18 success Logs for s390x-gcc / test (test_verifier, false, 360) / test_verifier on s390x with gcc
bpf/vmtest-bpf-next-VM_Test-7 success Logs for aarch64-gcc / test (test_maps, false, 360) / test_maps on aarch64 with gcc
bpf/vmtest-bpf-next-VM_Test-47 fail Logs for x86_64-llvm-18 / test (test_progs_cpuv4, false, 360) / test_progs_cpuv4 on x86_64 with llvm-18
bpf/vmtest-bpf-next-VM_Test-38 fail Logs for x86_64-llvm-17 / test (test_progs_no_alu32, false, 360) / test_progs_no_alu32 on x86_64 with llvm-17
bpf/vmtest-bpf-next-VM_Test-48 fail Logs for x86_64-llvm-18 / test (test_progs_no_alu32, false, 360) / test_progs_no_alu32 on x86_64 with llvm-18
bpf/vmtest-bpf-next-VM_Test-42 success Logs for x86_64-llvm-18 / GCC BPF / GCC BPF
bpf/vmtest-bpf-next-VM_Test-46 fail Logs for x86_64-llvm-18 / test (test_progs, false, 360) / test_progs on x86_64 with llvm-18
bpf/vmtest-bpf-next-VM_Test-45 success Logs for x86_64-llvm-18 / test (test_maps, false, 360) / test_maps on x86_64 with llvm-18
bpf/vmtest-bpf-next-PR fail PR summary
bpf/vmtest-bpf-next-VM_Test-8 fail Logs for aarch64-gcc / test (test_progs, false, 360) / test_progs on aarch64 with gcc
bpf/vmtest-bpf-next-VM_Test-9 fail Logs for aarch64-gcc / test (test_progs_no_alu32, false, 360) / test_progs_no_alu32 on aarch64 with gcc
bpf/vmtest-bpf-next-VM_Test-16 fail Logs for s390x-gcc / test (test_progs, false, 360) / test_progs on s390x with gcc
bpf/vmtest-bpf-next-VM_Test-17 fail Logs for s390x-gcc / test (test_progs_no_alu32, false, 360) / test_progs_no_alu32 on s390x with gcc
netdev/series_format success Posting correctly formatted
netdev/tree_selection success Clearly marked for bpf-next
netdev/ynl success Generated files up to date; no warnings/errors; no diff in generated;
netdev/fixes_present success Fixes tag not required for -next series
netdev/header_inline success No static functions without inline keyword in header files
netdev/build_32bit success Errors and warnings before: 0 this patch: 0
netdev/build_tools success Errors and warnings before: 26 (+1) this patch: 26 (+1)
netdev/cc_maintainers warning 11 maintainers not CCed: kpsingh@kernel.org sdf@fomichev.me jolsa@kernel.org yonghong.song@linux.dev song@kernel.org shuah@kernel.org john.fastabend@gmail.com linux-kselftest@vger.kernel.org haoluo@google.com mykolal@fb.com martin.lau@linux.dev
netdev/build_clang success Errors and warnings before: 0 this patch: 0
netdev/verify_signedoff success Signed-off-by tag matches author and committer
netdev/deprecated_api success None detected
netdev/check_selftest success No net selftest shell script
netdev/verify_fixes success No Fixes tag
netdev/build_allmodconfig_warn success Errors and warnings before: 0 this patch: 0
netdev/checkpatch warning CHECK: Lines should not end with a '(' WARNING: Avoid line continuations in quoted strings
netdev/build_clang_rust success No Rust files in patch. Skipping build
netdev/kdoc success Errors and warnings before: 0 this patch: 0
netdev/source_inline success Was 0 now: 0

Commit Message

Kumar Kartikeya Dwivedi Feb. 19, 2025, 12:51 p.m. UTC 
Ensure that once we get the return value and write to a stack slot it
may potentially alias, we don't get confused about the state of the
stack. Without the fix in the previous patch, we will assume the load
from r8 into r0 before will always be from a map value, but in the case
where the returned value is the passed in buffer, we're writing to fp-8
and will overwrite the map value stored there.

Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
---
 .../testing/selftests/bpf/progs/dynptr_fail.c | 45 +++++++++++++++++++
 1 file changed, 45 insertions(+)

Comments

Eduard Zingerman Feb. 19, 2025, 8:34 p.m. UTC | #1 
On Wed, 2025-02-19 at 04:51 -0800, Kumar Kartikeya Dwivedi wrote:
> Ensure that once we get the return value and write to a stack slot it
> may potentially alias, we don't get confused about the state of the
> stack. Without the fix in the previous patch, we will assume the load
> from r8 into r0 before will always be from a map value, but in the case
> where the returned value is the passed in buffer, we're writing to fp-8
> and will overwrite the map value stored there.
> 
> Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
> ---
>  .../testing/selftests/bpf/progs/dynptr_fail.c | 45 +++++++++++++++++++
>  1 file changed, 45 insertions(+)
> 
> diff --git a/tools/testing/selftests/bpf/progs/dynptr_fail.c b/tools/testing/selftests/bpf/progs/dynptr_fail.c
> index bd8f15229f5c..4584bf53c5f8 100644
> --- a/tools/testing/selftests/bpf/progs/dynptr_fail.c
> +++ b/tools/testing/selftests/bpf/progs/dynptr_fail.c
> @@ -1735,3 +1735,48 @@ int test_dynptr_reg_type(void *ctx)
>  	global_call_bpf_dynptr((const struct bpf_dynptr *)current);
>  	return 0;
>  }
> +
> +SEC("?tc")
> +__failure __msg("R8 invalid mem access 'scalar'") __log_level(2)
> +int dynptr_slice_rdwr_overwrite(struct __sk_buff *ctx)
> +{
> +	asm volatile (

Nit: having a few comments with equivalent C code would help
     understand this test case.

> +		"r6 = %[array_map4] ll;			\
> +		 r9 = r1;				\
> +		 r1 = r6;				\
> +		 r2 = r10;				\
> +		 r2 += -8;				\
> +		 call %[bpf_map_lookup_elem];		\
> +		 if r0 == 0 goto rjmp1;			\
> +		 *(u64 *)(r10 - 8) = r0;		\
> +		 r8 = r0;				\
> +		 r1 = r9;				\
> +		 r2 = 0;				\
> +		 r3 = r10;				\
> +		 r3 += -24;				\
> +		 call %[bpf_dynptr_from_skb];		\
> +		 r1 = r10;				\
> +		 r1 += -24;				\
> +		 r2 = 0;				\
> +		 r3 = r10;				\
> +		 r3 += -8;				\
> +		 r4 = 8;				\
> +		 call %[bpf_dynptr_slice_rdwr];		\
> +		 if r0 == 0 goto rjmp1;			\
> +		 r1 = 0;				\
> +		 *(u64 *)(r10 - 8) = r8;		\
> +		 *(u64 *)(r0 + 0) = r1;			\
> +		 r8 = *(u64 *)(r10 - 8);		\
> +		 r0 = *(u64 *)(r8 + 0);			\
> +	rjmp1:						\

Note: 'rjmp1' would be a global label.
      An alternative would be to either use 'goto 1f' and label '1:',
      or use the '%=' counter: 'goto rjmp1_%=', 'rjmp_%=:'.
      These would make label names unique for this inline assembly block.
      See https://gcc.gnu.org/onlinedocs/gcc/Extended-Asm.html#Special-format-strings ,
      And https://sourceware.org/binutils/docs/as/Symbol-Names.html .

> +		 r0 = 0;				\
> +		 "
> +		:
> +		: __imm(bpf_map_lookup_elem),
> +		  __imm(bpf_dynptr_from_skb),
> +		  __imm(bpf_dynptr_slice_rdwr),
> +		  __imm_addr(array_map4)
> +		: __clobber_all
> +	);
> +	return 0;
> +}
Kumar Kartikeya Dwivedi Feb. 20, 2025, 3:41 p.m. UTC | #2 
On Wed, 19 Feb 2025 at 21:34, Eduard Zingerman <eddyz87@gmail.com> wrote:
>
> On Wed, 2025-02-19 at 04:51 -0800, Kumar Kartikeya Dwivedi wrote:
> > Ensure that once we get the return value and write to a stack slot it
> > may potentially alias, we don't get confused about the state of the
> > stack. Without the fix in the previous patch, we will assume the load
> > from r8 into r0 before will always be from a map value, but in the case
> > where the returned value is the passed in buffer, we're writing to fp-8
> > and will overwrite the map value stored there.
> >
> > Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
> > ---
> >  .../testing/selftests/bpf/progs/dynptr_fail.c | 45 +++++++++++++++++++
> >  1 file changed, 45 insertions(+)
> >
> > diff --git a/tools/testing/selftests/bpf/progs/dynptr_fail.c b/tools/testing/selftests/bpf/progs/dynptr_fail.c
> > index bd8f15229f5c..4584bf53c5f8 100644
> > --- a/tools/testing/selftests/bpf/progs/dynptr_fail.c
> > +++ b/tools/testing/selftests/bpf/progs/dynptr_fail.c
> > @@ -1735,3 +1735,48 @@ int test_dynptr_reg_type(void *ctx)
> >       global_call_bpf_dynptr((const struct bpf_dynptr *)current);
> >       return 0;
> >  }
> > +
> > +SEC("?tc")
> > +__failure __msg("R8 invalid mem access 'scalar'") __log_level(2)
> > +int dynptr_slice_rdwr_overwrite(struct __sk_buff *ctx)
> > +{
> > +     asm volatile (
>
> Nit: having a few comments with equivalent C code would help
>      understand this test case.

Ack.

>
> > +             "r6 = %[array_map4] ll;                 \
> > +              r9 = r1;                               \
> > +              r1 = r6;                               \
> > +              r2 = r10;                              \
> > +              r2 += -8;                              \
> > +              call %[bpf_map_lookup_elem];           \
> > +              if r0 == 0 goto rjmp1;                 \
> > +              *(u64 *)(r10 - 8) = r0;                \
> > +              r8 = r0;                               \
> > +              r1 = r9;                               \
> > +              r2 = 0;                                \
> > +              r3 = r10;                              \
> > +              r3 += -24;                             \
> > +              call %[bpf_dynptr_from_skb];           \
> > +              r1 = r10;                              \
> > +              r1 += -24;                             \
> > +              r2 = 0;                                \
> > +              r3 = r10;                              \
> > +              r3 += -8;                              \
> > +              r4 = 8;                                \
> > +              call %[bpf_dynptr_slice_rdwr];         \
> > +              if r0 == 0 goto rjmp1;                 \
> > +              r1 = 0;                                \
> > +              *(u64 *)(r10 - 8) = r8;                \
> > +              *(u64 *)(r0 + 0) = r1;                 \
> > +              r8 = *(u64 *)(r10 - 8);                \
> > +              r0 = *(u64 *)(r8 + 0);                 \
> > +     rjmp1:                                          \
>
> Note: 'rjmp1' would be a global label.
>       An alternative would be to either use 'goto 1f' and label '1:',
>       or use the '%=' counter: 'goto rjmp1_%=', 'rjmp_%=:'.
>       These would make label names unique for this inline assembly block.
>       See https://gcc.gnu.org/onlinedocs/gcc/Extended-Asm.html#Special-format-strings ,
>       And https://sourceware.org/binutils/docs/as/Symbol-Names.html .
>

Thanks for the tip, will fix.

> > +              r0 = 0;                                \
> > +              "
> > +             :
> > +             : __imm(bpf_map_lookup_elem),
> > +               __imm(bpf_dynptr_from_skb),
> > +               __imm(bpf_dynptr_slice_rdwr),
> > +               __imm_addr(array_map4)
> > +             : __clobber_all
> > +     );
> > +     return 0;
> > +}
>
>
diff mbox series

Patch

diff --git a/tools/testing/selftests/bpf/progs/dynptr_fail.c b/tools/testing/selftests/bpf/progs/dynptr_fail.c
index bd8f15229f5c..4584bf53c5f8 100644
--- a/tools/testing/selftests/bpf/progs/dynptr_fail.c
+++ b/tools/testing/selftests/bpf/progs/dynptr_fail.c
@@ -1735,3 +1735,48 @@  int test_dynptr_reg_type(void *ctx)
 	global_call_bpf_dynptr((const struct bpf_dynptr *)current);
 	return 0;
 }
+
+SEC("?tc")
+__failure __msg("R8 invalid mem access 'scalar'") __log_level(2)
+int dynptr_slice_rdwr_overwrite(struct __sk_buff *ctx)
+{
+	asm volatile (
+		"r6 = %[array_map4] ll;			\
+		 r9 = r1;				\
+		 r1 = r6;				\
+		 r2 = r10;				\
+		 r2 += -8;				\
+		 call %[bpf_map_lookup_elem];		\
+		 if r0 == 0 goto rjmp1;			\
+		 *(u64 *)(r10 - 8) = r0;		\
+		 r8 = r0;				\
+		 r1 = r9;				\
+		 r2 = 0;				\
+		 r3 = r10;				\
+		 r3 += -24;				\
+		 call %[bpf_dynptr_from_skb];		\
+		 r1 = r10;				\
+		 r1 += -24;				\
+		 r2 = 0;				\
+		 r3 = r10;				\
+		 r3 += -8;				\
+		 r4 = 8;				\
+		 call %[bpf_dynptr_slice_rdwr];		\
+		 if r0 == 0 goto rjmp1;			\
+		 r1 = 0;				\
+		 *(u64 *)(r10 - 8) = r8;		\
+		 *(u64 *)(r0 + 0) = r1;			\
+		 r8 = *(u64 *)(r10 - 8);		\
+		 r0 = *(u64 *)(r8 + 0);			\
+	rjmp1:						\
+		 r0 = 0;				\
+		 "
+		:
+		: __imm(bpf_map_lookup_elem),
+		  __imm(bpf_dynptr_from_skb),
+		  __imm(bpf_dynptr_slice_rdwr),
+		  __imm_addr(array_map4)
+		: __clobber_all
+	);
+	return 0;
+}