Commit bf00d9ad authored by Hao Luo's avatar Hao Luo Committed by Zheng Zengkai
Browse files

bpf/selftests: Test PTR_TO_RDONLY_MEM 

mainline inclusion
from mainline-v5.17-rc1
commit 9497c458
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I4WRPV
CVE: CVE-2022-0500

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=9497c458c10b049438ef6e6ddda898edbc3ec6a8



--------------------------------

This test verifies that a ksym of non-struct can not be directly
updated.

Signed-off-by: default avatarHao Luo <haoluo@google.com>
Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
Acked-by: default avatarAndrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/bpf/20211217003152.48334-10-haoluo@google.com


Conflicts:
	tools/testing/selftests/bpf/prog_tests/ksyms_btf.c
Signed-off-by: default avatarPu Lehui <pulehui@huawei.com>
Reviewed-by: default avatarKuohai Xu <xukuohai@huawei.com>
Signed-off-by: default avatarZheng Zengkai <zhengzengkai@huawei.com>
parent c33ae9a0

tools/testing/selftests/bpf/prog_tests/ksyms_btf.c

+14 −0
Original line number Diff line number Diff line
@@ -6,6 +6,7 @@ 
#include <bpf/btf.h>

#include "test_ksyms_btf.skel.h"

#include "test_ksyms_btf_null_check.skel.h"

#include "test_ksyms_btf_write_check.skel.h"



static int duration;
@@ -81,6 +82,16 @@ static void test_null_check(void) 
	test_ksyms_btf_null_check__destroy(skel);

}



static void test_write_check(void)

{

	struct test_ksyms_btf_write_check *skel;



	skel = test_ksyms_btf_write_check__open_and_load();

	CHECK(skel, "skel_open", "unexpected load of a prog writing to ksym memory\n");



	test_ksyms_btf_write_check__destroy(skel);

}



void test_ksyms_btf(void)

{

	int percpu_datasec;
@@ -106,4 +117,7 @@ void test_ksyms_btf(void) 


	if (test__start_subtest("null_check"))

		test_null_check();



	if (test__start_subtest("write_check"))

		test_write_check();

}

tools/testing/selftests/bpf/progs/test_ksyms_btf_write_check.c

0 → 100644
+29 −0
Original line number Diff line number Diff line 
// SPDX-License-Identifier: GPL-2.0

/* Copyright (c) 2021 Google */



#include "vmlinux.h"



#include <bpf/bpf_helpers.h>



extern const int bpf_prog_active __ksym; /* int type global var. */



SEC("raw_tp/sys_enter")

int handler(const void *ctx)

{

	int *active;

	__u32 cpu;



	cpu = bpf_get_smp_processor_id();

	active = (int *)bpf_per_cpu_ptr(&bpf_prog_active, cpu);

	if (active) {

		/* Kernel memory obtained from bpf_{per,this}_cpu_ptr

		 * is read-only, should _not_ pass verification.

		 */

		/* WRITE_ONCE */

		*(volatile int *)active = -1;

	}



	return 0;

}



char _license[] SEC("license") = "GPL";