tjh.dev
Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
selftests/bpf: Test returning referenced kptr from struct_ops programs
Test struct_ops programs returning referenced kptr. When the return type
of a struct_ops operator is pointer to struct, the verifier should
only allow programs that return a scalar NULL or a non-local kptr with the
correct type in its unmodified form.
Signed-off-by: Amery Hung <amery.hung@bytedance.com>
Acked-by: Eduard Zingerman <eddyz87@gmail.com>
Acked-by: Martin KaFai Lau <martin.lau@kernel.org>
Link: https://lore.kernel.org/r/20250217190640.1748177-6-ameryhung@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
authored by
Amery Hung
and committed by
Alexei Starovoitov
af17bad9
8d9f547f
+173
+16
tools/testing/selftests/bpf/prog_tests/test_struct_ops_kptr_return.c
+16
tools/testing/selftests/bpf/prog_tests/test_struct_ops_kptr_return.c
···
1
+
#include <test_progs.h>
2
+
3
+
#include "struct_ops_kptr_return.skel.h"
4
+
#include "struct_ops_kptr_return_fail__wrong_type.skel.h"
5
+
#include "struct_ops_kptr_return_fail__invalid_scalar.skel.h"
6
+
#include "struct_ops_kptr_return_fail__nonzero_offset.skel.h"
7
+
#include "struct_ops_kptr_return_fail__local_kptr.skel.h"
8
+
9
+
void test_struct_ops_kptr_return(void)
10
+
{
11
+
RUN_TESTS(struct_ops_kptr_return);
12
+
RUN_TESTS(struct_ops_kptr_return_fail__wrong_type);
13
+
RUN_TESTS(struct_ops_kptr_return_fail__invalid_scalar);
14
+
RUN_TESTS(struct_ops_kptr_return_fail__nonzero_offset);
15
+
RUN_TESTS(struct_ops_kptr_return_fail__local_kptr);
16
+
}
+30
tools/testing/selftests/bpf/progs/struct_ops_kptr_return.c
+30
tools/testing/selftests/bpf/progs/struct_ops_kptr_return.c
···
1
+
#include <vmlinux.h>
2
+
#include <bpf/bpf_tracing.h>
3
+
#include "../test_kmods/bpf_testmod.h"
4
+
#include "bpf_misc.h"
5
+
6
+
char _license[] SEC("license") = "GPL";
7
+
8
+
void bpf_task_release(struct task_struct *p) __ksym;
9
+
10
+
/* This test struct_ops BPF programs returning referenced kptr. The verifier should
11
+
* allow a referenced kptr or a NULL pointer to be returned. A referenced kptr to task
12
+
* here is acquried automatically as the task argument is tagged with "__ref".
13
+
*/
14
+
SEC("struct_ops/test_return_ref_kptr")
15
+
struct task_struct *BPF_PROG(kptr_return, int dummy,
16
+
struct task_struct *task, struct cgroup *cgrp)
17
+
{
18
+
if (dummy % 2) {
19
+
bpf_task_release(task);
20
+
return NULL;
21
+
}
22
+
return task;
23
+
}
24
+
25
+
SEC(".struct_ops.link")
26
+
struct bpf_testmod_ops testmod_kptr_return = {
27
+
.test_return_ref_kptr = (void *)kptr_return,
28
+
};
29
+
30
+
+26
tools/testing/selftests/bpf/progs/struct_ops_kptr_return_fail__invalid_scalar.c
+26
tools/testing/selftests/bpf/progs/struct_ops_kptr_return_fail__invalid_scalar.c
···
1
+
#include <vmlinux.h>
2
+
#include <bpf/bpf_tracing.h>
3
+
#include "../test_kmods/bpf_testmod.h"
4
+
#include "bpf_misc.h"
5
+
6
+
char _license[] SEC("license") = "GPL";
7
+
8
+
struct cgroup *bpf_cgroup_acquire(struct cgroup *p) __ksym;
9
+
void bpf_task_release(struct task_struct *p) __ksym;
10
+
11
+
/* This test struct_ops BPF programs returning referenced kptr. The verifier should
12
+
* reject programs returning a non-zero scalar value.
13
+
*/
14
+
SEC("struct_ops/test_return_ref_kptr")
15
+
__failure __msg("At program exit the register R0 has smin=1 smax=1 should have been in [0, 0]")
16
+
struct task_struct *BPF_PROG(kptr_return_fail__invalid_scalar, int dummy,
17
+
struct task_struct *task, struct cgroup *cgrp)
18
+
{
19
+
bpf_task_release(task);
20
+
return (struct task_struct *)1;
21
+
}
22
+
23
+
SEC(".struct_ops.link")
24
+
struct bpf_testmod_ops testmod_kptr_return = {
25
+
.test_return_ref_kptr = (void *)kptr_return_fail__invalid_scalar,
26
+
};
+34
tools/testing/selftests/bpf/progs/struct_ops_kptr_return_fail__local_kptr.c
+34
tools/testing/selftests/bpf/progs/struct_ops_kptr_return_fail__local_kptr.c
···
1
+
#include <vmlinux.h>
2
+
#include <bpf/bpf_tracing.h>
3
+
#include "../test_kmods/bpf_testmod.h"
4
+
#include "bpf_experimental.h"
5
+
#include "bpf_misc.h"
6
+
7
+
char _license[] SEC("license") = "GPL";
8
+
9
+
struct cgroup *bpf_cgroup_acquire(struct cgroup *p) __ksym;
10
+
void bpf_task_release(struct task_struct *p) __ksym;
11
+
12
+
/* This test struct_ops BPF programs returning referenced kptr. The verifier should
13
+
* reject programs returning a local kptr.
14
+
*/
15
+
SEC("struct_ops/test_return_ref_kptr")
16
+
__failure __msg("At program exit the register R0 is not a known value (ptr_or_null_)")
17
+
struct task_struct *BPF_PROG(kptr_return_fail__local_kptr, int dummy,
18
+
struct task_struct *task, struct cgroup *cgrp)
19
+
{
20
+
struct task_struct *t;
21
+
22
+
bpf_task_release(task);
23
+
24
+
t = bpf_obj_new(typeof(*task));
25
+
if (!t)
26
+
return NULL;
27
+
28
+
return t;
29
+
}
30
+
31
+
SEC(".struct_ops.link")
32
+
struct bpf_testmod_ops testmod_kptr_return = {
33
+
.test_return_ref_kptr = (void *)kptr_return_fail__local_kptr,
34
+
};
+25
tools/testing/selftests/bpf/progs/struct_ops_kptr_return_fail__nonzero_offset.c
+25
tools/testing/selftests/bpf/progs/struct_ops_kptr_return_fail__nonzero_offset.c
···
1
+
#include <vmlinux.h>
2
+
#include <bpf/bpf_tracing.h>
3
+
#include "../test_kmods/bpf_testmod.h"
4
+
#include "bpf_misc.h"
5
+
6
+
char _license[] SEC("license") = "GPL";
7
+
8
+
struct cgroup *bpf_cgroup_acquire(struct cgroup *p) __ksym;
9
+
void bpf_task_release(struct task_struct *p) __ksym;
10
+
11
+
/* This test struct_ops BPF programs returning referenced kptr. The verifier should
12
+
* reject programs returning a modified referenced kptr.
13
+
*/
14
+
SEC("struct_ops/test_return_ref_kptr")
15
+
__failure __msg("dereference of modified trusted_ptr_ ptr R0 off={{[0-9]+}} disallowed")
16
+
struct task_struct *BPF_PROG(kptr_return_fail__nonzero_offset, int dummy,
17
+
struct task_struct *task, struct cgroup *cgrp)
18
+
{
19
+
return (struct task_struct *)&task->jobctl;
20
+
}
21
+
22
+
SEC(".struct_ops.link")
23
+
struct bpf_testmod_ops testmod_kptr_return = {
24
+
.test_return_ref_kptr = (void *)kptr_return_fail__nonzero_offset,
25
+
};
+30
tools/testing/selftests/bpf/progs/struct_ops_kptr_return_fail__wrong_type.c
+30
tools/testing/selftests/bpf/progs/struct_ops_kptr_return_fail__wrong_type.c
···
1
+
#include <vmlinux.h>
2
+
#include <bpf/bpf_tracing.h>
3
+
#include "../test_kmods/bpf_testmod.h"
4
+
#include "bpf_misc.h"
5
+
6
+
char _license[] SEC("license") = "GPL";
7
+
8
+
struct cgroup *bpf_cgroup_acquire(struct cgroup *p) __ksym;
9
+
void bpf_task_release(struct task_struct *p) __ksym;
10
+
11
+
/* This test struct_ops BPF programs returning referenced kptr. The verifier should
12
+
* reject programs returning a referenced kptr of the wrong type.
13
+
*/
14
+
SEC("struct_ops/test_return_ref_kptr")
15
+
__failure __msg("At program exit the register R0 is not a known value (ptr_or_null_)")
16
+
struct task_struct *BPF_PROG(kptr_return_fail__wrong_type, int dummy,
17
+
struct task_struct *task, struct cgroup *cgrp)
18
+
{
19
+
struct task_struct *ret;
20
+
21
+
ret = (struct task_struct *)bpf_cgroup_acquire(cgrp);
22
+
bpf_task_release(task);
23
+
24
+
return ret;
25
+
}
26
+
27
+
SEC(".struct_ops.link")
28
+
struct bpf_testmod_ops testmod_kptr_return = {
29
+
.test_return_ref_kptr = (void *)kptr_return_fail__wrong_type,
30
+
};
+8
tools/testing/selftests/bpf/test_kmods/bpf_testmod.c
+8
tools/testing/selftests/bpf/test_kmods/bpf_testmod.c
···
1182
1182
return 0;
1183
1183
}
1184
1184
1185
+
static struct task_struct *
1186
+
bpf_testmod_ops__test_return_ref_kptr(int dummy, struct task_struct *task__ref,
1187
+
struct cgroup *cgrp)
1188
+
{
1189
+
return NULL;
1190
+
}
1191
+
1185
1192
static struct bpf_testmod_ops __bpf_testmod_ops = {
1186
1193
.test_1 = bpf_testmod_test_1,
1187
1194
.test_2 = bpf_testmod_test_2,
1188
1195
.test_maybe_null = bpf_testmod_ops__test_maybe_null,
1189
1196
.test_refcounted = bpf_testmod_ops__test_refcounted,
1197
+
.test_return_ref_kptr = bpf_testmod_ops__test_return_ref_kptr,
1190
1198
};
1191
1199
1192
1200
struct bpf_struct_ops bpf_bpf_testmod_ops = {
+4
tools/testing/selftests/bpf/test_kmods/bpf_testmod.h
+4
tools/testing/selftests/bpf/test_kmods/bpf_testmod.h
···
6
6
#include <linux/types.h>
7
7
8
8
struct task_struct;
9
+
struct cgroup;
9
10
10
11
struct bpf_testmod_test_read_ctx {
11
12
char *buf;
···
39
38
int (*unsupported_ops)(void);
40
39
/* Used to test ref_acquired arguments. */
41
40
int (*test_refcounted)(int dummy, struct task_struct *task);
41
+
/* Used to test returning referenced kptr. */
42
+
struct task_struct *(*test_return_ref_kptr)(int dummy, struct task_struct *task,
43
+
struct cgroup *cgrp);
42
44
43
45
/* The following fields are used to test shadow copies. */
44
46
char onebyte;