Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

selftests/bpf: verifier/prevent_map_lookup converted to inline assembly

Test verifier/prevent_map_lookup automatically converted to use inline assembly.

This was a part of a series [1] but could not be applied becuase
another patch from a series had to be witheld.

[1] https://lore.kernel.org/bpf/20230421174234.2391278-1-eddyz87@gmail.com/

Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://lore.kernel.org/r/20230421204514.2450907-1-eddyz87@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>

authored by

Eduard Zingerman and committed by
Alexei Starovoitov
35150203 6d26d985

+63 -29
+2
tools/testing/selftests/bpf/prog_tests/verifier.c
··· 42 42 #include "verifier_meta_access.skel.h" 43 43 #include "verifier_netfilter_ctx.skel.h" 44 44 #include "verifier_netfilter_retcode.skel.h" 45 + #include "verifier_prevent_map_lookup.skel.h" 45 46 #include "verifier_raw_stack.skel.h" 46 47 #include "verifier_raw_tp_writable.skel.h" 47 48 #include "verifier_reg_equal.skel.h" ··· 141 140 void test_verifier_meta_access(void) { RUN(verifier_meta_access); } 142 141 void test_verifier_netfilter_ctx(void) { RUN(verifier_netfilter_ctx); } 143 142 void test_verifier_netfilter_retcode(void) { RUN(verifier_netfilter_retcode); } 143 + void test_verifier_prevent_map_lookup(void) { RUN(verifier_prevent_map_lookup); } 144 144 void test_verifier_raw_stack(void) { RUN(verifier_raw_stack); } 145 145 void test_verifier_raw_tp_writable(void) { RUN(verifier_raw_tp_writable); } 146 146 void test_verifier_reg_equal(void) { RUN(verifier_reg_equal); }
+61
tools/testing/selftests/bpf/progs/verifier_prevent_map_lookup.c
··· 1 + // SPDX-License-Identifier: GPL-2.0 2 + /* Converted from tools/testing/selftests/bpf/verifier/prevent_map_lookup.c */ 3 + 4 + #include <linux/bpf.h> 5 + #include <bpf/bpf_helpers.h> 6 + #include "bpf_misc.h" 7 + 8 + struct { 9 + __uint(type, BPF_MAP_TYPE_STACK_TRACE); 10 + __uint(max_entries, 1); 11 + __type(key, __u32); 12 + __type(value, __u64); 13 + } map_stacktrace SEC(".maps"); 14 + 15 + struct { 16 + __uint(type, BPF_MAP_TYPE_PROG_ARRAY); 17 + __uint(max_entries, 8); 18 + __uint(key_size, sizeof(int)); 19 + __array(values, void (void)); 20 + } map_prog2_socket SEC(".maps"); 21 + 22 + SEC("perf_event") 23 + __description("prevent map lookup in stack trace") 24 + __failure __msg("cannot pass map_type 7 into func bpf_map_lookup_elem") 25 + __naked void map_lookup_in_stack_trace(void) 26 + { 27 + asm volatile (" \ 28 + r1 = 0; \ 29 + *(u64*)(r10 - 8) = r1; \ 30 + r2 = r10; \ 31 + r2 += -8; \ 32 + r1 = %[map_stacktrace] ll; \ 33 + call %[bpf_map_lookup_elem]; \ 34 + exit; \ 35 + " : 36 + : __imm(bpf_map_lookup_elem), 37 + __imm_addr(map_stacktrace) 38 + : __clobber_all); 39 + } 40 + 41 + SEC("socket") 42 + __description("prevent map lookup in prog array") 43 + __failure __msg("cannot pass map_type 3 into func bpf_map_lookup_elem") 44 + __failure_unpriv 45 + __naked void map_lookup_in_prog_array(void) 46 + { 47 + asm volatile (" \ 48 + r1 = 0; \ 49 + *(u64*)(r10 - 8) = r1; \ 50 + r2 = r10; \ 51 + r2 += -8; \ 52 + r1 = %[map_prog2_socket] ll; \ 53 + call %[bpf_map_lookup_elem]; \ 54 + exit; \ 55 + " : 56 + : __imm(bpf_map_lookup_elem), 57 + __imm_addr(map_prog2_socket) 58 + : __clobber_all); 59 + } 60 + 61 + char _license[] SEC("license") = "GPL";
-29
tools/testing/selftests/bpf/verifier/prevent_map_lookup.c
··· 1 - { 2 - "prevent map lookup in stack trace", 3 - .insns = { 4 - BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0), 5 - BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), 6 - BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8), 7 - BPF_LD_MAP_FD(BPF_REG_1, 0), 8 - BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem), 9 - BPF_EXIT_INSN(), 10 - }, 11 - .fixup_map_stacktrace = { 3 }, 12 - .result = REJECT, 13 - .errstr = "cannot pass map_type 7 into func bpf_map_lookup_elem", 14 - .prog_type = BPF_PROG_TYPE_PERF_EVENT, 15 - }, 16 - { 17 - "prevent map lookup in prog array", 18 - .insns = { 19 - BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0), 20 - BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), 21 - BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8), 22 - BPF_LD_MAP_FD(BPF_REG_1, 0), 23 - BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem), 24 - BPF_EXIT_INSN(), 25 - }, 26 - .fixup_prog2 = { 3 }, 27 - .result = REJECT, 28 - .errstr = "cannot pass map_type 3 into func bpf_map_lookup_elem", 29 - },