From patchwork Wed Jan 3 18:53:58 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Barret Rhoden X-Patchwork-Id: 13510423 X-Patchwork-Delegate: bpf@iogearbox.net Received: from mail-yb1-f201.google.com (mail-yb1-f201.google.com [209.85.219.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C99EB1CA90 for ; Wed, 3 Jan 2024 18:54:07 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--brho.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="tT7fRR6m" Received: by mail-yb1-f201.google.com with SMTP id 3f1490d57ef6-dbddee32a66so8781431276.1 for ; Wed, 03 Jan 2024 10:54:07 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20230601; t=1704308046; x=1704912846; darn=vger.kernel.org; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:from:to:cc:subject:date:message-id:reply-to; bh=ZUt8YVNSoa+7YDD+I3FZ435kHRVdX3CBnM/UnKKoCug=; b=tT7fRR6mXoL4uKMhMIRebk7jHR/8ufeUpvq/dNbu4EEarqzPixDtxJIDIyn6uL0561 VRrS5VxG3AiG9ntj4mr+wwDLdKiyk/eerGGgF0HpWfmWqX82rToVNxvqNUZvC8U5BwKN YDcbQEiAC+q/QXoNRFbg+slA47QAlRgaAJI+rsqwjxkx0dRQsjAtc/9hsa44w0/VAoBx 2ske0ZOLY2S/Q6yTNL56Ve7TKZh6NZPOKZKTyNdWh+DnNCPb7jmf6Fi/xL9KqE4CWt9L FsFe+dd+RJVK/HGwzeAn1vtBM7oEGinaOeoalC33PtY8W0jhpQoDmzbQEs5i8G9WvLXg KVug== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1704308046; x=1704912846; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=ZUt8YVNSoa+7YDD+I3FZ435kHRVdX3CBnM/UnKKoCug=; b=Jf4v8IABb6J2hIdM79LnA7TVFN9/obJZxRs/WopFA/2ejASTaX/qPclMK4AUhoTVdL 17oYYsLlrJ4rE/3/UGm8uDfhPsebOk/V113lsseiACddv2AMI0R7FJ7+ZJMaH7BvM4Iv WbEtPb+QjEZp8CElC5kX5nn4+EDr8pdVDrjKuEqdBO0hCD/fHXVxVAU6ukg0FeiW09Tj Uj6twaw6Y58JFmUxZ7cx7xnCO8mo7a20BaVe6dP7Q2BN+WpSmUzzbk676NxJypyLeU2t JsGPfOTn0xNuFQEASKx9CNQ7Hy/D0Y/rYhTx8Y6dTzx3GUqF1VbKpleiuptONA5eZd5T SASQ== X-Gm-Message-State: AOJu0YxWMMDYAsAOjGItfbYUSGPmQBLLU/7AzjocCg9y7OuGYPtPmPyA uNVxVOmoUrcSd3qht+yx4JHvT0REzCb/KE4= X-Google-Smtp-Source: AGHT+IH7zw5ccoHaAuRraWQZVEPyoR1+1HYH38kijZYviOoia1xzB1IQcNR+fIkZhTYccCv7VvR4V71p X-Received: from gnomeregan.cam.corp.google.com ([2620:15c:93:4:7e71:cfbd:2031:cc52]) (user=brho job=sendgmr) by 2002:a25:b30d:0:b0:dbe:a677:5de5 with SMTP id l13-20020a25b30d000000b00dbea6775de5mr28285ybj.4.1704308046693; Wed, 03 Jan 2024 10:54:06 -0800 (PST) Date: Wed, 3 Jan 2024 13:53:58 -0500 In-Reply-To: <20240103185403.610641-1-brho@google.com> Precedence: bulk X-Mailing-List: bpf@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20240103185403.610641-1-brho@google.com> X-Mailer: git-send-email 2.43.0.472.g3155946c3a-goog Message-ID: <20240103185403.610641-2-brho@google.com> Subject: [PATCH v2 bpf-next 1/2] libbpf: add helpers for mmapping maps From: Barret Rhoden To: Andrii Nakryiko , Alexei Starovoitov , Daniel Borkmann , Song Liu , Yonghong Song Cc: mattbobrowski@google.com, bpf@vger.kernel.org, linux-kernel@vger.kernel.org X-Patchwork-Delegate: bpf@iogearbox.net bpf_map__mmap_size() was internal to bpftool. Use that to make wrappers for mmap and munmap. Signed-off-by: Barret Rhoden --- tools/bpf/bpftool/gen.c | 16 +++------------- tools/lib/bpf/libbpf.c | 18 ++++++++++++++++++ tools/lib/bpf/libbpf.h | 6 ++++++ tools/lib/bpf/libbpf.map | 4 ++++ 4 files changed, 31 insertions(+), 13 deletions(-) diff --git a/tools/bpf/bpftool/gen.c b/tools/bpf/bpftool/gen.c index ee3ce2b8000d..a328e960c141 100644 --- a/tools/bpf/bpftool/gen.c +++ b/tools/bpf/bpftool/gen.c @@ -453,16 +453,6 @@ static void print_hex(const char *data, int data_sz) } } -static size_t bpf_map_mmap_sz(const struct bpf_map *map) -{ - long page_sz = sysconf(_SC_PAGE_SIZE); - size_t map_sz; - - map_sz = (size_t)roundup(bpf_map__value_size(map), 8) * bpf_map__max_entries(map); - map_sz = roundup(map_sz, page_sz); - return map_sz; -} - /* Emit type size asserts for all top-level fields in memory-mapped internal maps. */ static void codegen_asserts(struct bpf_object *obj, const char *obj_name) { @@ -641,7 +631,7 @@ static void codegen_destroy(struct bpf_object *obj, const char *obj_name) if (bpf_map__is_internal(map) && (bpf_map__map_flags(map) & BPF_F_MMAPABLE)) printf("\tskel_free_map_data(skel->%1$s, skel->maps.%1$s.initial_value, %2$zd);\n", - ident, bpf_map_mmap_sz(map)); + ident, bpf_map__mmap_size(map)); codegen("\ \n\ skel_closenz(skel->maps.%1$s.map_fd); \n\ @@ -723,7 +713,7 @@ static int gen_trace(struct bpf_object *obj, const char *obj_name, const char *h goto cleanup; \n\ skel->maps.%1$s.initial_value = (__u64) (long) skel->%1$s;\n\ } \n\ - ", ident, bpf_map_mmap_sz(map)); + ", ident, bpf_map__mmap_size(map)); } codegen("\ \n\ @@ -780,7 +770,7 @@ static int gen_trace(struct bpf_object *obj, const char *obj_name, const char *h if (!skel->%1$s) \n\ return -ENOMEM; \n\ ", - ident, bpf_map_mmap_sz(map), mmap_flags); + ident, bpf_map__mmap_size(map), mmap_flags); } codegen("\ \n\ diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c index ebcfb2147fbd..2dae6fabc0d1 100644 --- a/tools/lib/bpf/libbpf.c +++ b/tools/lib/bpf/libbpf.c @@ -9830,6 +9830,24 @@ void *bpf_map__initial_value(struct bpf_map *map, size_t *psize) return map->mmaped; } +size_t bpf_map__mmap_size(const struct bpf_map *map) +{ + return bpf_map_mmap_sz(bpf_map__value_size(map), + bpf_map__max_entries(map)); +} + +void *bpf_map__mmap(const struct bpf_map *map) +{ + return mmap(NULL, bpf_map__mmap_size(map), + PROT_READ | PROT_WRITE, MAP_SHARED, + bpf_map__fd(map), 0); +} + +int bpf_map__munmap(const struct bpf_map *map, void *addr) +{ + return munmap(addr, bpf_map__mmap_size(map)); +} + bool bpf_map__is_internal(const struct bpf_map *map) { return map->libbpf_type != LIBBPF_MAP_UNSPEC; diff --git a/tools/lib/bpf/libbpf.h b/tools/lib/bpf/libbpf.h index 6cd9c501624f..148f4c783ca7 100644 --- a/tools/lib/bpf/libbpf.h +++ b/tools/lib/bpf/libbpf.h @@ -996,6 +996,12 @@ LIBBPF_API int bpf_map__set_map_extra(struct bpf_map *map, __u64 map_extra); LIBBPF_API int bpf_map__set_initial_value(struct bpf_map *map, const void *data, size_t size); LIBBPF_API void *bpf_map__initial_value(struct bpf_map *map, size_t *psize); +/* get the mmappable size of the map */ +LIBBPF_API size_t bpf_map__mmap_size(const struct bpf_map *map); +/* mmap the map */ +LIBBPF_API void *bpf_map__mmap(const struct bpf_map *map); +/* munmap the map at addr */ +LIBBPF_API int bpf_map__munmap(const struct bpf_map *map, void *addr); /** * @brief **bpf_map__is_internal()** tells the caller whether or not the diff --git a/tools/lib/bpf/libbpf.map b/tools/lib/bpf/libbpf.map index 91c5aef7dae7..9e44de4fbf39 100644 --- a/tools/lib/bpf/libbpf.map +++ b/tools/lib/bpf/libbpf.map @@ -411,4 +411,8 @@ LIBBPF_1.3.0 { } LIBBPF_1.2.0; LIBBPF_1.4.0 { + global: + bpf_map__mmap_size; + bpf_map__mmap; + bpf_map__munmap; } LIBBPF_1.3.0; From patchwork Wed Jan 3 18:53:59 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Barret Rhoden X-Patchwork-Id: 13510424 X-Patchwork-Delegate: bpf@iogearbox.net Received: from mail-yw1-f202.google.com (mail-yw1-f202.google.com [209.85.128.202]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E3B371CA82 for ; Wed, 3 Jan 2024 18:54:08 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--brho.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="4pip9BVQ" Received: by mail-yw1-f202.google.com with SMTP id 00721157ae682-5e763e03f4dso111595587b3.2 for ; Wed, 03 Jan 2024 10:54:08 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20230601; t=1704308048; x=1704912848; darn=vger.kernel.org; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:from:to:cc:subject:date:message-id:reply-to; bh=2bcLG4z5ud00ASvT+xYfTg01O0l5cqSjV16/RoDUU1c=; b=4pip9BVQCKXGbdmskl3RmVQSrG6XUU0JRey2wylYKJG9W0C/A4AcgEgc8HEtxesCsb MWS/bFQKkgfWuvxPgU48tBXv/n3P/27XIEYrVWhpd7EU4BtziUMROyCdnHH76jB0wP8h g/KwnTPcCCWzUxLt2hRnw3emBekvwQAn8qbS1i2GnBusTjSa5dXh6hkXg0r2fhy5D5lE dTnBfLMMd/kbEDweaC4BtXelo4d4DJhSxma1g8/ouHSAbcKOixnRlQ/c4CL67p6HdMAn JODN8uK6MIB7K/bTLDp4Y5l3GhIn6aK1AikbE8ObvM5gXvfvWg2AGxQanniZXOvvklyl Mbdw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1704308048; x=1704912848; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=2bcLG4z5ud00ASvT+xYfTg01O0l5cqSjV16/RoDUU1c=; b=ebYjgSNr7bsUgxSNE+aIYs9nWxRso6iBLjFJl2TEmyuu8KAgPbHOGTpLaD06H1Kbna yWvR1bzvcRBSv9jC7pRJZVvJYYT6Vp5CqAeHaNlwwJT+a7MCQhcV7IYNHtWfcKLHkTmL mrPpAETp9PnJMwAOIiaFumR917KKRb6MfWjM/vwSW+xARr/PAL6rhXRc3GSSWsuc/nuc AfsFpvLTozjVHmhW9oRid+DMNdHrvuDAK3vw37ky7zVQAsnIjDJ9o54E+XD7BMbrBlLY VH29f/xkqEoo2BiACr1FG+8pRUit9b5PWUC9TStqHmlJlm5Dz6vZylQ/X8zfIjrSo+iX bOPA== X-Gm-Message-State: AOJu0Yz5IjpFJZ6G3qr44bFttSh5YL+zDuP2IYUqWNBEPjrVL4cJLuUy Z6iqinA2T06sPjSZR/DcET3sygBIglRjACE= X-Google-Smtp-Source: AGHT+IG28PnnP7ATCARB255QRQFXcLeoT4HMWxENL9liok87DD4ZsFniPsEvotONJZ+gcKQMEfocdQPe X-Received: from gnomeregan.cam.corp.google.com ([2620:15c:93:4:7e71:cfbd:2031:cc52]) (user=brho job=sendgmr) by 2002:a05:6902:100e:b0:dbe:30cd:8fcb with SMTP id w14-20020a056902100e00b00dbe30cd8fcbmr331668ybt.0.1704308047925; Wed, 03 Jan 2024 10:54:07 -0800 (PST) Date: Wed, 3 Jan 2024 13:53:59 -0500 In-Reply-To: <20240103185403.610641-1-brho@google.com> Precedence: bulk X-Mailing-List: bpf@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20240103185403.610641-1-brho@google.com> X-Mailer: git-send-email 2.43.0.472.g3155946c3a-goog Message-ID: <20240103185403.610641-3-brho@google.com> Subject: [PATCH v2 bpf-next 2/2] selftests/bpf: add inline assembly helpers to access array elements From: Barret Rhoden To: Andrii Nakryiko , Alexei Starovoitov , Daniel Borkmann , Song Liu , Yonghong Song Cc: mattbobrowski@google.com, bpf@vger.kernel.org, linux-kernel@vger.kernel.org X-Patchwork-Delegate: bpf@iogearbox.net When accessing an array, even if you insert your own bounds check, sometimes the compiler will remove the check, or modify it such that the verifier no longer knows your access is within bounds. The compiler is even free to make a copy of a register, check the copy, and use the original to access the array. The verifier knows the *copy* is within bounds, but not the original register! Signed-off-by: Barret Rhoden --- .../bpf/prog_tests/test_array_elem.c | 112 ++++++++++ .../selftests/bpf/progs/array_elem_test.c | 195 ++++++++++++++++++ tools/testing/selftests/bpf/progs/bpf_misc.h | 43 ++++ 3 files changed, 350 insertions(+) create mode 100644 tools/testing/selftests/bpf/prog_tests/test_array_elem.c create mode 100644 tools/testing/selftests/bpf/progs/array_elem_test.c diff --git a/tools/testing/selftests/bpf/prog_tests/test_array_elem.c b/tools/testing/selftests/bpf/prog_tests/test_array_elem.c new file mode 100644 index 000000000000..c953636f07c9 --- /dev/null +++ b/tools/testing/selftests/bpf/prog_tests/test_array_elem.c @@ -0,0 +1,112 @@ +// SPDX-License-Identifier: GPL-2.0 +/* Copyright (c) 2024 Google LLC. */ +#include +#include "array_elem_test.skel.h" + +#define NR_MAP_ELEMS 100 + +/* + * Helper to load and run a program. + * Call must define skel, map_elems, and bss_elems. + * Destroy the skel when you're done. + */ +#define load_and_run(PROG) ({ \ + int err; \ + skel = array_elem_test__open(); \ + if (!ASSERT_OK_PTR(skel, "array_elem_test open")) \ + return; \ + bpf_program__set_autoload(skel->progs.x_ ## PROG, true); \ + err = array_elem_test__load(skel); \ + if (!ASSERT_EQ(err, 0, "array_elem_test load")) { \ + array_elem_test__destroy(skel); \ + return; \ + } \ + err = array_elem_test__attach(skel); \ + if (!ASSERT_EQ(err, 0, "array_elem_test attach")) { \ + array_elem_test__destroy(skel); \ + return; \ + } \ + for (int i = 0; i < NR_MAP_ELEMS; i++) \ + skel->bss->lookup_indexes[i] = i; \ + map_elems = bpf_map__mmap(skel->maps.arraymap); \ + ASSERT_OK_PTR(map_elems, "mmap"); \ + bss_elems = skel->bss->bss_elems; \ + skel->bss->target_pid = getpid(); \ + usleep(1); \ +}) + +static void test_access_all(void) +{ + struct array_elem_test *skel; + int *map_elems; + int *bss_elems; + + load_and_run(access_all); + + for (int i = 0; i < NR_MAP_ELEMS; i++) + ASSERT_EQ(map_elems[i], i, "array_elem map value not written"); + + for (int i = 0; i < NR_MAP_ELEMS; i++) + ASSERT_EQ(bss_elems[i], i, "array_elem bss value not written"); + + array_elem_test__destroy(skel); +} + +static void test_oob_access(void) +{ + struct array_elem_test *skel; + int *map_elems; + int *bss_elems; + + load_and_run(oob_access); + + for (int i = 0; i < NR_MAP_ELEMS; i++) + ASSERT_EQ(map_elems[i], 0, "array_elem map value was written"); + + for (int i = 0; i < NR_MAP_ELEMS; i++) + ASSERT_EQ(bss_elems[i], 0, "array_elem bss value was written"); + + array_elem_test__destroy(skel); +} + +static void test_access_array_map_infer_sz(void) +{ + struct array_elem_test *skel; + int *map_elems; + int *bss_elems __maybe_unused; + + load_and_run(access_array_map_infer_sz); + + for (int i = 0; i < NR_MAP_ELEMS; i++) + ASSERT_EQ(map_elems[i], i, "array_elem map value not written"); + + array_elem_test__destroy(skel); +} + + +/* Test that attempting to load a bad program fails. */ +#define test_bad(PROG) ({ \ + struct array_elem_test *skel; \ + int err; \ + skel = array_elem_test__open(); \ + if (!ASSERT_OK_PTR(skel, "array_elem_test open")) \ + return; \ + bpf_program__set_autoload(skel->progs.x_bad_ ## PROG, true); \ + err = array_elem_test__load(skel); \ + ASSERT_ERR(err, "array_elem_test load " # PROG); \ + array_elem_test__destroy(skel); \ +}) + +void test_test_array_elem(void) +{ + if (test__start_subtest("array_elem_access_all")) + test_access_all(); + if (test__start_subtest("array_elem_oob_access")) + test_oob_access(); + if (test__start_subtest("array_elem_access_array_map_infer_sz")) + test_access_array_map_infer_sz(); + if (test__start_subtest("array_elem_bad_map_array_access")) + test_bad(map_array_access); + if (test__start_subtest("array_elem_bad_bss_array_access")) + test_bad(bss_array_access); +} diff --git a/tools/testing/selftests/bpf/progs/array_elem_test.c b/tools/testing/selftests/bpf/progs/array_elem_test.c new file mode 100644 index 000000000000..9d48afc933f0 --- /dev/null +++ b/tools/testing/selftests/bpf/progs/array_elem_test.c @@ -0,0 +1,195 @@ +// SPDX-License-Identifier: GPL-2.0 +/* Copyright (c) 2024 Google LLC. */ +#include +#include +#include +#include +#include +#include "bpf_misc.h" + +char _license[] SEC("license") = "GPL"; + +int target_pid = 0; + +#define NR_MAP_ELEMS 100 + +/* + * We want to test valid accesses into an array, but we also need to fool the + * verifier. If we just do for (i = 0; i < 100; i++), the verifier knows the + * value of i and can tell we're inside the array. + * + * This "lookup" array is just the values 0, 1, 2..., such that + * lookup_indexes[i] == i. (set by userspace). But the verifier doesn't know + * that. + */ +unsigned int lookup_indexes[NR_MAP_ELEMS]; + +/* Arrays can be in the BSS or inside a map element. Make sure both work. */ +int bss_elems[NR_MAP_ELEMS]; + +struct map_array { + int elems[NR_MAP_ELEMS]; +}; + +/* + * This is an ARRAY_MAP of a single struct, and that struct is an array of + * elements. Userspace can mmap the map as if it was just a basic array of + * elements. Though if you make an ARRAY_MAP where the *values* are ints, don't + * forget that bpf map elements are rounded up to 8 bytes. + * + * Once you get the pointer to the base of the inner array, you can access all + * of the elements without another bpf_map_lookup_elem(), which is useful if you + * are operating on multiple elements while holding a spinlock. + */ +struct { + __uint(type, BPF_MAP_TYPE_ARRAY); + __uint(max_entries, 1); + __type(key, int); + __type(value, struct map_array); + __uint(map_flags, BPF_F_MMAPABLE); +} arraymap SEC(".maps"); + +static struct map_array *get_map_array(void) +{ + int zero = 0; + + return bpf_map_lookup_elem(&arraymap, &zero); +} + +static int *get_map_elems(void) +{ + struct map_array *arr = get_map_array(); + + if (!arr) + return NULL; + return arr->elems; +} + +/* + * Test that we can access all elements, and that we are accessing the element + * we think we are accessing. + */ +static void access_all(void) +{ + int *map_elems = get_map_elems(); + int *x; + + for (int i = 0; i < NR_MAP_ELEMS; i++) { + x = bpf_array_elem(map_elems, NR_MAP_ELEMS, lookup_indexes[i]); + if (x) + *x = i; + } + + for (int i = 0; i < NR_MAP_ELEMS; i++) { + x = bpf_array_sz_elem(bss_elems, lookup_indexes[i]); + if (x) + *x = i; + } +} + +SEC("?tp/syscalls/sys_enter_nanosleep") +int x_access_all(void *ctx) +{ + if ((bpf_get_current_pid_tgid() >> 32) != target_pid) + return 0; + access_all(); + return 0; +} + +/* + * Helper for various OOB tests. An out-of-bound access should be handled like + * a lookup failure. Specifically, the verifier should ensure we do not access + * outside the array. Userspace will check that we didn't access somewhere + * inside the array. + */ +static void set_elem_to_1(long idx) +{ + int *map_elems = get_map_elems(); + int *x; + + x = bpf_array_elem(map_elems, NR_MAP_ELEMS, idx); + if (x) + *x = 1; + x = bpf_array_sz_elem(bss_elems, idx); + if (x) + *x = 1; +} + +/* + * Test various out-of-bounds accesses. + */ +static void oob_access(void) +{ + set_elem_to_1(NR_MAP_ELEMS + 5); + set_elem_to_1(NR_MAP_ELEMS); + set_elem_to_1(-1); + set_elem_to_1(~0UL); +} + +SEC("?tp/syscalls/sys_enter_nanosleep") +int x_oob_access(void *ctx) +{ + if ((bpf_get_current_pid_tgid() >> 32) != target_pid) + return 0; + oob_access(); + return 0; +} + +/* + * Test that we can use the ARRAY_SIZE-style helper with an array in a map. + * + * Note that you cannot infer the size of the array from just a pointer; you + * have to use the actual elems[100]. i.e. this will fail and should fail to + * compile (-Wsizeof-pointer-div): + * + * int *map_elems = get_map_elems(); + * x = bpf_array_sz_elem(map_elems, lookup_indexes[i]); + */ +static void access_array_map_infer_sz(void) +{ + struct map_array *arr = get_map_array(); + int *x; + + for (int i = 0; i < NR_MAP_ELEMS; i++) { + x = bpf_array_sz_elem(arr->elems, lookup_indexes[i]); + if (x) + *x = i; + } +} + +SEC("?tp/syscalls/sys_enter_nanosleep") +int x_access_array_map_infer_sz(void *ctx) +{ + if ((bpf_get_current_pid_tgid() >> 32) != target_pid) + return 0; + access_array_map_infer_sz(); + return 0; +} + + + +SEC("?tp/syscalls/sys_enter_nanosleep") +int x_bad_map_array_access(void *ctx) +{ + int *map_elems = get_map_elems(); + + /* + * Need to check to promote map_elems from MAP_OR_NULL to MAP so that we + * fail to load below for the right reason. + */ + if (!map_elems) + return 0; + /* Fail to load: we don't prove our access is inside map_elems[] */ + for (int i = 0; i < NR_MAP_ELEMS; i++) + map_elems[lookup_indexes[i]] = i; + return 0; +} + +SEC("?tp/syscalls/sys_enter_nanosleep") +int x_bad_bss_array_access(void *ctx) +{ + /* Fail to load: we don't prove our access is inside bss_elems[] */ + for (int i = 0; i < NR_MAP_ELEMS; i++) + bss_elems[lookup_indexes[i]] = i; + return 0; +} diff --git a/tools/testing/selftests/bpf/progs/bpf_misc.h b/tools/testing/selftests/bpf/progs/bpf_misc.h index 2fd59970c43a..002bab44cde2 100644 --- a/tools/testing/selftests/bpf/progs/bpf_misc.h +++ b/tools/testing/selftests/bpf/progs/bpf_misc.h @@ -135,4 +135,47 @@ /* make it look to compiler like value is read and written */ #define __sink(expr) asm volatile("" : "+g"(expr)) +/* + * Access an array element within a bound, such that the verifier knows the + * access is safe. + * + * This macro asm is the equivalent of: + * + * if (!arr) + * return NULL; + * if (idx >= arr_sz) + * return NULL; + * return &arr[idx]; + * + * The index (___idx below) needs to be a u64, at least for certain versions of + * the BPF ISA, since there aren't u32 conditional jumps. + */ +#define bpf_array_elem(arr, arr_sz, idx) ({ \ + typeof(&(arr)[0]) ___arr = arr; \ + __u64 ___idx = idx; \ + if (___arr) { \ + asm volatile("if %[__idx] >= %[__bound] goto 1f; \ + %[__idx] *= %[__size]; \ + %[__arr] += %[__idx]; \ + goto 2f; \ + 1:; \ + %[__arr] = 0; \ + 2: \ + " \ + : [__arr]"+r"(___arr), [__idx]"+r"(___idx) \ + : [__bound]"r"((arr_sz)), \ + [__size]"i"(sizeof(typeof((arr)[0]))) \ + : "cc"); \ + } \ + ___arr; \ +}) + +/* + * Convenience wrapper for bpf_array_elem(), where we compute the size of the + * array. Be sure to use an actual array, and not a pointer, just like with the + * ARRAY_SIZE macro. + */ +#define bpf_array_sz_elem(arr, idx) \ + bpf_array_elem(arr, sizeof(arr) / sizeof((arr)[0]), idx) + #endif