Commit 5d13746d authored by Martin KaFai Lau's avatar Martin KaFai Lau Committed by Alexei Starovoitov
Browse files

bpf: selftest: Add ref_tracking verifier test for bpf_skc casting 



The patch tests for:
1. bpf_sk_release() can be called on a tcp_sock btf_id ptr.

2. Ensure the tcp_sock btf_id pointer cannot be used
   after bpf_sk_release().

Signed-off-by: default avatarMartin KaFai Lau <kafai@fb.com>
Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
Acked-by: default avatarLorenz Bauer <lmb@cloudflare.com>
Link: https://lore.kernel.org/bpf/20200925000421.3857616-1-kafai@fb.com
parent 27e5203b

tools/testing/selftests/bpf/verifier/ref_tracking.c

+47 −0
Original line number Diff line number Diff line
@@ -854,3 +854,50 @@ 
	.errstr = "Unreleased reference",

	.result = REJECT,

},

{

	"reference tracking: bpf_sk_release(btf_tcp_sock)",

	.insns = {

	BPF_SK_LOOKUP(sk_lookup_tcp),

	BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),

	BPF_EXIT_INSN(),

	BPF_MOV64_REG(BPF_REG_6, BPF_REG_0),

	BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),

	BPF_EMIT_CALL(BPF_FUNC_skc_to_tcp_sock),

	BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 3),

	BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),

	BPF_EMIT_CALL(BPF_FUNC_sk_release),

	BPF_EXIT_INSN(),

	BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),

	BPF_EMIT_CALL(BPF_FUNC_sk_release),

	BPF_EXIT_INSN(),

	},

	.prog_type = BPF_PROG_TYPE_SCHED_CLS,

	.result = ACCEPT,

	.result_unpriv = REJECT,

	.errstr_unpriv = "unknown func",

},

{

	"reference tracking: use ptr from bpf_skc_to_tcp_sock() after release",

	.insns = {

	BPF_SK_LOOKUP(sk_lookup_tcp),

	BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),

	BPF_EXIT_INSN(),

	BPF_MOV64_REG(BPF_REG_6, BPF_REG_0),

	BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),

	BPF_EMIT_CALL(BPF_FUNC_skc_to_tcp_sock),

	BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 3),

	BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),

	BPF_EMIT_CALL(BPF_FUNC_sk_release),

	BPF_EXIT_INSN(),

	BPF_MOV64_REG(BPF_REG_7, BPF_REG_0),

	BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),

	BPF_EMIT_CALL(BPF_FUNC_sk_release),

	BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_7, 0),

	BPF_EXIT_INSN(),

	},

	.prog_type = BPF_PROG_TYPE_SCHED_CLS,

	.result = REJECT,

	.errstr = "invalid mem access",

	.result_unpriv = REJECT,

	.errstr_unpriv = "unknown func",

},