Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

bpf, test, cgroup: Use sk_{alloc,free} for test cases

BPF test infra has some hacks in place which kzalloc() a socket and perform
minimum init via sock_net_set() and sock_init_data(). As a result, the sk's
skcd->cgroup is NULL since it didn't go through proper initialization as it
would have been the case from sk_alloc(). Rather than re-adding a NULL test
in sock_cgroup_ptr() just for this, use sk_{alloc,free}() pair for the test
socket. The latter also allows to get rid of the bpf_sk_storage_free() special
case.

Fixes: 8520e224f547 ("bpf, cgroups: Fix cgroup v2 fallback on v1/v2 mixed mode")
Fixes: b7a1848e8398 ("bpf: add BPF_PROG_TEST_RUN support for flow dissector")
Fixes: 2cb494a36c98 ("bpf: add tests for direct packet access from CGROUP_SKB")
Reported-by: syzbot+664b58e9a40fbb2cec71@syzkaller.appspotmail.com
Reported-by: syzbot+33f36d0754d4c5c0e102@syzkaller.appspotmail.com
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Tested-by: syzbot+664b58e9a40fbb2cec71@syzkaller.appspotmail.com
Tested-by: syzbot+33f36d0754d4c5c0e102@syzkaller.appspotmail.com
Link: https://lore.kernel.org/bpf/20210927123921.21535-2-daniel@iogearbox.net

+9 -5
+9 -5
net/bpf/test_run.c
··· 552 552 __skb->gso_segs = skb_shinfo(skb)->gso_segs; 553 553 } 554 554 555 + static struct proto bpf_dummy_proto = { 556 + .name = "bpf_dummy", 557 + .owner = THIS_MODULE, 558 + .obj_size = sizeof(struct sock), 559 + }; 560 + 555 561 int bpf_prog_test_run_skb(struct bpf_prog *prog, const union bpf_attr *kattr, 556 562 union bpf_attr __user *uattr) 557 563 { ··· 602 596 break; 603 597 } 604 598 605 - sk = kzalloc(sizeof(struct sock), GFP_USER); 599 + sk = sk_alloc(net, AF_UNSPEC, GFP_USER, &bpf_dummy_proto, 1); 606 600 if (!sk) { 607 601 kfree(data); 608 602 kfree(ctx); 609 603 return -ENOMEM; 610 604 } 611 - sock_net_set(sk, net); 612 605 sock_init_data(NULL, sk); 613 606 614 607 skb = build_skb(data, 0); 615 608 if (!skb) { 616 609 kfree(data); 617 610 kfree(ctx); 618 - kfree(sk); 611 + sk_free(sk); 619 612 return -ENOMEM; 620 613 } 621 614 skb->sk = sk; ··· 687 682 if (dev && dev != net->loopback_dev) 688 683 dev_put(dev); 689 684 kfree_skb(skb); 690 - bpf_sk_storage_free(sk); 691 - kfree(sk); 685 + sk_free(sk); 692 686 kfree(ctx); 693 687 return ret; 694 688 }