Commit 67efbd57 authored by David Vernet's avatar David Vernet Committed by Andrii Nakryiko
Browse files

selftests/bpf: Add testcases for ptr_*_or_null_ in bpf_kptr_xchg 



The second argument of the bpf_kptr_xchg() helper function is
ARG_PTR_TO_BTF_ID_OR_NULL. A recent patch fixed a bug whereby the
verifier would fail with an internal error message if a program invoked
the helper with a PTR_TO_BTF_ID | PTR_MAYBE_NULL register. This testcase
adds some testcases to ensure that it fails gracefully moving forward.

Before the fix, these testcases would have failed an error resembling
the following:

; p = bpf_kfunc_call_test_acquire(&(unsigned long){0});
99: (7b) *(u64 *)(r10 -16) = r7       ; frame1: ...
100: (bf) r1 = r10                    ; frame1: ...
101: (07) r1 += -16                   ; frame1: ...
; p = bpf_kfunc_call_test_acquire(&(unsigned long){0});
102: (85) call bpf_kfunc_call_test_acquire#13908
; frame1: R0_w=ptr_or_null_prog_test_ref_kfunc...
; p = bpf_kptr_xchg(&v->ref_ptr, p);
103: (bf) r1 = r6                     ; frame1: ...
104: (bf) r2 = r0
; frame1: R0_w=ptr_or_null_prog_test_ref_kfunc...
105: (85) call bpf_kptr_xchg#194
verifier internal error: invalid PTR_TO_BTF_ID register for type match

Signed-off-by: default avatarDavid Vernet <void@manifault.com>
Signed-off-by: default avatarAndrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/bpf/20230330145203.80506-2-void@manifault.com
parent e4c2acab

tools/testing/selftests/bpf/progs/cpumask_failure.c

+25 −0
Original line number Diff line number Diff line
@@ -165,3 +165,28 @@ int BPF_PROG(test_global_mask_no_null_check, struct task_struct *task, u64 clone 


	return 0;

}



SEC("tp_btf/task_newtask")

__failure __msg("Possibly NULL pointer passed to helper arg2")

int BPF_PROG(test_global_mask_rcu_no_null_check, struct task_struct *task, u64 clone_flags)

{

	struct bpf_cpumask *prev, *curr;



	curr = bpf_cpumask_create();

	if (!curr)

		return 0;



	prev = bpf_kptr_xchg(&global_mask, curr);

	if (prev)

		bpf_cpumask_release(prev);



	bpf_rcu_read_lock();

	curr = global_mask;

	/* PTR_TO_BTF_ID | PTR_MAYBE_NULL | MEM_RCU passed to bpf_kptr_xchg() */

	prev = bpf_kptr_xchg(&global_mask, curr);

	bpf_rcu_read_unlock();

	if (prev)

		bpf_cpumask_release(prev);



	return 0;

}

tools/testing/selftests/bpf/progs/map_kptr_fail.c

+23 −0
Original line number Diff line number Diff line
@@ -20,6 +20,7 @@ struct array_map { 
} array_map SEC(".maps");



extern struct prog_test_ref_kfunc *bpf_kfunc_call_test_acquire(unsigned long *sp) __ksym;

extern void bpf_kfunc_call_test_release(struct prog_test_ref_kfunc *p) __ksym;

extern struct prog_test_ref_kfunc *

bpf_kfunc_call_test_kptr_get(struct prog_test_ref_kfunc **p, int a, int b) __ksym;
@@ -442,4 +443,26 @@ int kptr_get_ref_state(struct __sk_buff *ctx) 
	return 0;

}



SEC("?tc")

__failure __msg("Possibly NULL pointer passed to helper arg2")

int kptr_xchg_possibly_null(struct __sk_buff *ctx)

{

	struct prog_test_ref_kfunc *p;

	struct map_value *v;

	int key = 0;



	v = bpf_map_lookup_elem(&array_map, &key);

	if (!v)

		return 0;



	p = bpf_kfunc_call_test_acquire(&(unsigned long){0});



	/* PTR_TO_BTF_ID | PTR_MAYBE_NULL passed to bpf_kptr_xchg() */

	p = bpf_kptr_xchg(&v->ref_ptr, p);

	if (p)

		bpf_kfunc_call_test_release(p);



	return 0;

}



char _license[] SEC("license") = "GPL";