Commit 9efcc4ad authored by Yonghong Song's avatar Yonghong Song Committed by Alexei Starovoitov
Browse files

selftests/bpf: Add a test for out of bound rdonly buf access 



If the bpf program contains out of bound access w.r.t. a
particular map key/value size, the verification will be
still okay, e.g., it will be accepted by verifier. But
it will be rejected during link_create time. A test
is added here to ensure link_create failure did happen
if out of bound access happened.
  $ ./test_progs -n 4
  ...
  #4/23 rdonly-buf-out-of-bound:OK
  ...

Signed-off-by: default avatarYonghong Song <yhs@fb.com>
Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
Link: https://lore.kernel.org/bpf/20200723184124.591700-1-yhs@fb.com
parent 3b1c420b

tools/testing/selftests/bpf/prog_tests/bpf_iter.c

+22 −0
Original line number Diff line number Diff line
@@ -20,6 +20,7 @@ 
#include "bpf_iter_bpf_array_map.skel.h"

#include "bpf_iter_bpf_percpu_array_map.skel.h"

#include "bpf_iter_bpf_sk_storage_map.skel.h"

#include "bpf_iter_test_kern5.skel.h"



static int duration;
@@ -865,6 +866,25 @@ static void test_bpf_sk_storage_map(void) 
	bpf_iter_bpf_sk_storage_map__destroy(skel);

}



static void test_rdonly_buf_out_of_bound(void)

{

	DECLARE_LIBBPF_OPTS(bpf_iter_attach_opts, opts);

	struct bpf_iter_test_kern5 *skel;

	struct bpf_link *link;



	skel = bpf_iter_test_kern5__open_and_load();

	if (CHECK(!skel, "bpf_iter_test_kern5__open_and_load",

		  "skeleton open_and_load failed\n"))

		return;



	opts.map_fd = bpf_map__fd(skel->maps.hashmap1);

	link = bpf_program__attach_iter(skel->progs.dump_bpf_hash_map, &opts);

	if (CHECK(!IS_ERR(link), "attach_iter", "unexpected success\n"))

		bpf_link__destroy(link);



	bpf_iter_test_kern5__destroy(skel);

}



void test_bpf_iter(void)

{

	if (test__start_subtest("btf_id_or_null"))
@@ -911,4 +931,6 @@ void test_bpf_iter(void) 
		test_bpf_percpu_array_map();

	if (test__start_subtest("bpf_sk_storage_map"))

		test_bpf_sk_storage_map();

	if (test__start_subtest("rdonly-buf-out-of-bound"))

		test_rdonly_buf_out_of_bound();

}

tools/testing/selftests/bpf/progs/bpf_iter_test_kern5.c

0 → 100644
+35 −0
Original line number Diff line number Diff line 
// SPDX-License-Identifier: GPL-2.0

/* Copyright (c) 2020 Facebook */

#include "bpf_iter.h"

#include <bpf/bpf_helpers.h>

#include <bpf/bpf_tracing.h>



char _license[] SEC("license") = "GPL";



struct key_t {

	int a;

	int b;

	int c;

};



struct {

	__uint(type, BPF_MAP_TYPE_HASH);

	__uint(max_entries, 3);

	__type(key, struct key_t);

	__type(value, __u64);

} hashmap1 SEC(".maps");



__u32 key_sum = 0;



SEC("iter/bpf_map_elem")

int dump_bpf_hash_map(struct bpf_iter__bpf_map_elem *ctx)

{

	void *key = ctx->key;



	if (key == (void *)0)

		return 0;



	/* out of bound access w.r.t. hashmap1 */

	key_sum += *(__u32 *)(key + sizeof(struct key_t));

	return 0;

}