selftests/bpf: test cases for pkt/null checks in subprogs [Linux 5.1]

selftests/bpf: test cases for pkt/null checks in subprogs [Linux 5.1]

This Linux kernel change "selftests/bpf: test cases for pkt/null checks in subprogs" is included in the Linux 5.1 release. This change is authored by Paul Chaignon <paul.chaignon [at] orange.com> on Wed Apr 24 21:51:26 2019 +0200. The commit for this change in Linux stable tree is 6dd7f14 (patch).

selftests/bpf: test cases for pkt/null checks in subprogs

The first test case, for pointer null checks, is equivalent to the
following pseudo-code.  It checks that the verifier does not complain on
line 6 and recognizes that ptr isn't null.

1: ptr = bpf_map_lookup_elem(map, &key);
2: ret = subprog(ptr) {
3:   return ptr != NULL;
4: }
5: if (ret)
6:   value = *ptr;

The second test case, for packet bound checks, is equivalent to the
following pseudo-code.  It checks that the verifier does not complain on
line 7 and recognizes that the packet is at least 1 byte long.

1: pkt_end = ctx.pkt_end;
2: ptr = ctx.pkt + 8;
3: ret = subprog(ptr, pkt_end) {
4:   return ptr <= pkt_end;
5: }
6: if (ret)
7:   value = *(u8 *)ctx.pkt;

Signed-off-by: Paul Chaignon <paul.chaignon@orange.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>

There are 47 lines of Linux source code added/deleted in this change. Code changes to Linux kernel are as follows.

 tools/testing/selftests/bpf/verifier/calls.c       | 25 ++++++++++++++++++++++
 .../selftests/bpf/verifier/direct_packet_access.c  | 22 +++++++++++++++++++
 2 files changed, 47 insertions(+)

diff --git a/tools/testing/selftests/bpf/verifier/calls.c b/tools/testing/selftests/bpf/verifier/calls.c
index fb11240..9093a8f 100644
--- a/tools/testing/selftests/bpf/verifier/calls.c
+++ b/tools/testing/selftests/bpf/verifier/calls.c
@@ -375,6 +375,31 @@
    .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
 },
 {
+   "calls: ptr null check in subprog",
+   .insns = {
+   BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+   BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+   BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+   BPF_LD_MAP_FD(BPF_REG_1, 0),
+   BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
+   BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
+   BPF_MOV64_REG(BPF_REG_6, BPF_REG_0),
+   BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
+   BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
+   BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_6, 0),
+   BPF_EXIT_INSN(),
+   BPF_MOV64_IMM(BPF_REG_0, 0),
+   BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 1),
+   BPF_MOV64_IMM(BPF_REG_0, 1),
+   BPF_EXIT_INSN(),
+   },
+   .errstr_unpriv = "function calls to other bpf functions are allowed for root only",
+   .fixup_map_hash_48b = { 3 },
+   .result_unpriv = REJECT,
+   .result = ACCEPT,
+   .retval = 0,
+},
+{
    "calls: two calls with args",
    .insns = {
    BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
diff --git a/tools/testing/selftests/bpf/verifier/direct_packet_access.c b/tools/testing/selftests/bpf/verifier/direct_packet_access.c
index e3fc22e..d5c596f 100644
--- a/tools/testing/selftests/bpf/verifier/direct_packet_access.c
+++ b/tools/testing/selftests/bpf/verifier/direct_packet_access.c
@@ -631,3 +631,25 @@
    .errstr = "invalid access to packet",
    .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 },
+{
+   "direct packet access: test29 (reg > pkt_end in subprog)",
+   .insns = {
+   BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
+           offsetof(struct __sk_buff, data)),
+   BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
+           offsetof(struct __sk_buff, data_end)),
+   BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
+   BPF_ALU64_IMM(BPF_ADD, BPF_REG_3, 8),
+   BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 4),
+   BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
+   BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_6, 0),
+   BPF_MOV64_IMM(BPF_REG_0, 0),
+   BPF_EXIT_INSN(),
+   BPF_MOV64_IMM(BPF_REG_0, 0),
+   BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_2, 1),
+   BPF_MOV64_IMM(BPF_REG_0, 1),
+   BPF_EXIT_INSN(),
+   },
+   .result = ACCEPT,
+   .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+},

Leave a Reply

Your email address will not be published. Required fields are marked *