Commit 696c3901 authored by Yonghong Song's avatar Yonghong Song Committed by Alexei Starovoitov
Browse files

selftests/bpf: add a selftest with __user tag 



Added a selftest with three__user usages: a __user pointer-type argument
in bpf_testmod, a __user pointer-type struct member in bpf_testmod,
and a __user pointer-type struct member in vmlinux. In all cases,
directly accessing the user memory will result verification failure.

  $ ./test_progs -v -n 22/3
  ...
  libbpf: prog 'test_user1': BPF program load failed: Permission denied
  libbpf: prog 'test_user1': -- BEGIN PROG LOAD LOG --
  R1 type=ctx expected=fp
  0: R1=ctx(id=0,off=0,imm=0) R10=fp0
  ; int BPF_PROG(test_user1, struct bpf_testmod_btf_type_tag_1 *arg)
  0: (79) r1 = *(u64 *)(r1 +0)
  func 'bpf_testmod_test_btf_type_tag_user_1' arg0 has btf_id 136561 type STRUCT 'bpf_testmod_btf_type_tag_1'
  1: R1_w=user_ptr_bpf_testmod_btf_type_tag_1(id=0,off=0,imm=0)
  ; g = arg->a;
  1: (61) r1 = *(u32 *)(r1 +0)
  R1 invalid mem access 'user_ptr_'
  ...
  #22/3 btf_tag/btf_type_tag_user_mod1:OK

  $ ./test_progs -v -n 22/4
  ...
  libbpf: prog 'test_user2': BPF program load failed: Permission denied
  libbpf: prog 'test_user2': -- BEGIN PROG LOAD LOG --
  R1 type=ctx expected=fp
  0: R1=ctx(id=0,off=0,imm=0) R10=fp0
  ; int BPF_PROG(test_user2, struct bpf_testmod_btf_type_tag_2 *arg)
  0: (79) r1 = *(u64 *)(r1 +0)
  func 'bpf_testmod_test_btf_type_tag_user_2' arg0 has btf_id 136563 type STRUCT 'bpf_testmod_btf_type_tag_2'
  1: R1_w=ptr_bpf_testmod_btf_type_tag_2(id=0,off=0,imm=0)
  ; g = arg->p->a;
  1: (79) r1 = *(u64 *)(r1 +0)          ; R1_w=user_ptr_bpf_testmod_btf_type_tag_1(id=0,off=0,imm=0)
  ; g = arg->p->a;
  2: (61) r1 = *(u32 *)(r1 +0)
  R1 invalid mem access 'user_ptr_'
  ...
  #22/4 btf_tag/btf_type_tag_user_mod2:OK

  $ ./test_progs -v -n 22/5
  ...
  libbpf: prog 'test_sys_getsockname': BPF program load failed: Permission denied
  libbpf: prog 'test_sys_getsockname': -- BEGIN PROG LOAD LOG --
  R1 type=ctx expected=fp
  0: R1=ctx(id=0,off=0,imm=0) R10=fp0
  ; int BPF_PROG(test_sys_getsockname, int fd, struct sockaddr *usockaddr,
  0: (79) r1 = *(u64 *)(r1 +8)
  func '__sys_getsockname' arg1 has btf_id 2319 type STRUCT 'sockaddr'
  1: R1_w=user_ptr_sockaddr(id=0,off=0,imm=0)
  ; g = usockaddr->sa_family;
  1: (69) r1 = *(u16 *)(r1 +0)
  R1 invalid mem access 'user_ptr_'
  ...
  #22/5 btf_tag/btf_type_tag_user_vmlinux:OK

Signed-off-by: default avatarYonghong Song <yhs@fb.com>
Link: https://lore.kernel.org/r/20220127154616.659314-1-yhs@fb.com


Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
parent 571d01a9

tools/testing/selftests/bpf/bpf_testmod/bpf_testmod.c

+18 −0
Original line number Diff line number Diff line
@@ -21,6 +21,24 @@ bpf_testmod_test_mod_kfunc(int i) 
	*(int *)this_cpu_ptr(&bpf_testmod_ksym_percpu) = i;

}



struct bpf_testmod_btf_type_tag_1 {

	int a;

};



struct bpf_testmod_btf_type_tag_2 {

	struct bpf_testmod_btf_type_tag_1 __user *p;

};



noinline int

bpf_testmod_test_btf_type_tag_user_1(struct bpf_testmod_btf_type_tag_1 __user *arg) {

	return arg->a;

}



noinline int

bpf_testmod_test_btf_type_tag_user_2(struct bpf_testmod_btf_type_tag_2 *arg) {

	return arg->p->a;

}



noinline int bpf_testmod_loop_test(int n)

{

	int i, sum = 0;

tools/testing/selftests/bpf/prog_tests/btf_tag.c

+93 −0
Original line number Diff line number Diff line 
// SPDX-License-Identifier: GPL-2.0

/* Copyright (c) 2021 Facebook */

#include <test_progs.h>

#include <bpf/btf.h>

#include "test_btf_decl_tag.skel.h"



/* struct btf_type_tag_test is referenced in btf_type_tag.skel.h */
@@ -8,6 +9,7 @@ struct btf_type_tag_test { 
        int **p;

};

#include "btf_type_tag.skel.h"

#include "btf_type_tag_user.skel.h"



static void test_btf_decl_tag(void)

{
@@ -41,10 +43,101 @@ static void test_btf_type_tag(void) 
	btf_type_tag__destroy(skel);

}



static void test_btf_type_tag_mod_user(bool load_test_user1)

{

	const char *module_name = "bpf_testmod";

	struct btf *vmlinux_btf, *module_btf;

	struct btf_type_tag_user *skel;

	__s32 type_id;

	int err;



	if (!env.has_testmod) {

		test__skip();

		return;

	}



	/* skip the test if the module does not have __user tags */

	vmlinux_btf = btf__load_vmlinux_btf();

	if (!ASSERT_OK_PTR(vmlinux_btf, "could not load vmlinux BTF"))

		return;



	module_btf = btf__load_module_btf(module_name, vmlinux_btf);

	if (!ASSERT_OK_PTR(module_btf, "could not load module BTF"))

		goto free_vmlinux_btf;



	type_id = btf__find_by_name_kind(module_btf, "user", BTF_KIND_TYPE_TAG);

	if (type_id <= 0) {

		printf("%s:SKIP: btf_type_tag attribute not in %s", __func__, module_name);

		test__skip();

		goto free_module_btf;

	}



	skel = btf_type_tag_user__open();

	if (!ASSERT_OK_PTR(skel, "btf_type_tag_user"))

		goto free_module_btf;



	bpf_program__set_autoload(skel->progs.test_sys_getsockname, false);

	if (load_test_user1)

		bpf_program__set_autoload(skel->progs.test_user2, false);

	else

		bpf_program__set_autoload(skel->progs.test_user1, false);



	err = btf_type_tag_user__load(skel);

	ASSERT_ERR(err, "btf_type_tag_user");



	btf_type_tag_user__destroy(skel);



free_module_btf:

	btf__free(module_btf);

free_vmlinux_btf:

	btf__free(vmlinux_btf);

}



static void test_btf_type_tag_vmlinux_user(void)

{

	struct btf_type_tag_user *skel;

	struct btf *vmlinux_btf;

	__s32 type_id;

	int err;



	/* skip the test if the vmlinux does not have __user tags */

	vmlinux_btf = btf__load_vmlinux_btf();

	if (!ASSERT_OK_PTR(vmlinux_btf, "could not load vmlinux BTF"))

		return;



	type_id = btf__find_by_name_kind(vmlinux_btf, "user", BTF_KIND_TYPE_TAG);

	if (type_id <= 0) {

		printf("%s:SKIP: btf_type_tag attribute not in vmlinux btf", __func__);

		test__skip();

		goto free_vmlinux_btf;

	}



	skel = btf_type_tag_user__open();

	if (!ASSERT_OK_PTR(skel, "btf_type_tag_user"))

		goto free_vmlinux_btf;



	bpf_program__set_autoload(skel->progs.test_user2, false);

	bpf_program__set_autoload(skel->progs.test_user1, false);



	err = btf_type_tag_user__load(skel);

	ASSERT_ERR(err, "btf_type_tag_user");



	btf_type_tag_user__destroy(skel);



free_vmlinux_btf:

	btf__free(vmlinux_btf);

}



void test_btf_tag(void)

{

	if (test__start_subtest("btf_decl_tag"))

		test_btf_decl_tag();

	if (test__start_subtest("btf_type_tag"))

		test_btf_type_tag();

	if (test__start_subtest("btf_type_tag_user_mod1"))

		test_btf_type_tag_mod_user(true);

	if (test__start_subtest("btf_type_tag_user_mod2"))

		test_btf_type_tag_mod_user(false);

	if (test__start_subtest("btf_type_tag_sys_user_vmlinux"))

		test_btf_type_tag_vmlinux_user();

}

tools/testing/selftests/bpf/progs/btf_type_tag_user.c

0 → 100644
+40 −0
Original line number Diff line number Diff line 
// SPDX-License-Identifier: GPL-2.0

/* Copyright (c) 2022 Facebook */

#include "vmlinux.h"

#include <bpf/bpf_helpers.h>

#include <bpf/bpf_tracing.h>



struct bpf_testmod_btf_type_tag_1 {

	int a;

};



struct bpf_testmod_btf_type_tag_2 {

	struct bpf_testmod_btf_type_tag_1 *p;

};



int g;



SEC("fentry/bpf_testmod_test_btf_type_tag_user_1")

int BPF_PROG(test_user1, struct bpf_testmod_btf_type_tag_1 *arg)

{

	g = arg->a;

	return 0;

}



SEC("fentry/bpf_testmod_test_btf_type_tag_user_2")

int BPF_PROG(test_user2, struct bpf_testmod_btf_type_tag_2 *arg)

{

	g = arg->p->a;

	return 0;

}



/* int __sys_getsockname(int fd, struct sockaddr __user *usockaddr,

 *                       int __user *usockaddr_len);

 */

SEC("fentry/__sys_getsockname")

int BPF_PROG(test_sys_getsockname, int fd, struct sockaddr *usockaddr,

	     int *usockaddr_len)

{

	g = usockaddr->sa_family;

	return 0;

}