[RFC bpf-next 7/9] selftests/bpf: Add uprobe user page exec test

[Jiri Olsa <jolsa@kernel.org>]

Test executable permissions for whole and partial user-page
allocations and execution of code written into a user page.

Assisted-by: Codex:GPT-6
Signed-off-by: Jiri Olsa <jolsa@kernel.org>
---
 .../selftests/bpf/prog_tests/user_page.c      | 62 +++++++++++++++++++
 tools/testing/selftests/bpf/progs/user_page.c | 18 ++++++
 2 files changed, 80 insertions(+)

diff --git a/tools/testing/selftests/bpf/prog_tests/user_page.c b/tools/testing/selftests/bpf/prog_tests/user_page.c
index ff51e7c598a9..1b5dff2c8ff6 100644
--- a/tools/testing/selftests/bpf/prog_tests/user_page.c
+++ b/tools/testing/selftests/bpf/prog_tests/user_page.c
@@ -9,6 +9,8 @@
 
 enum {
 	USER_PAGE_ALLOC = 1,
+	USER_PAGE_EXEC = 2,
+	USER_PAGE_EXEC_ONLY = 3,
 };
 
 static noinline void user_page_trigger(void)
@@ -128,6 +130,62 @@ static void test_read_implies_exec(struct user_page *skel)
 		  "restore_personality");
 }
 
+static void test_execute_user_page(struct user_page *skel)
+{
+	long page_size = sysconf(_SC_PAGESIZE);
+	long addr = -1;
+
+#ifndef __x86_64__
+	test__skip();
+	return;
+#endif
+
+	if (!alloc_user_pages(skel, 1, &addr))
+		return;
+
+	skel->bss->exec_addr = addr;
+	skel->bss->action = USER_PAGE_EXEC;
+	user_page_trigger();
+	if (!ASSERT_EQ(skel->bss->write_ret, 0, "exec_write_ret") ||
+	    !ASSERT_EQ(skel->bss->exec_ret, 0, "exec_ret"))
+		goto out;
+
+	ASSERT_EQ(((int (*)(void))addr)(), 42, "execute_user_page");
+
+out:
+	if (addr >= 0)
+		munmap((void *)addr, page_size);
+}
+
+static void test_partial_exec(struct user_page *skel)
+{
+	long page_size = sysconf(_SC_PAGESIZE);
+	long addr = -1;
+
+	if (!alloc_user_pages(skel, 3, &addr))
+		return;
+
+	skel->bss->exec_addr = addr + page_size;
+	skel->bss->action = USER_PAGE_EXEC_ONLY;
+	user_page_trigger();
+	if (!ASSERT_OK(skel->bss->exec_ret, "middle_page_exec_ret") ||
+	    !check_user_page_vma((void *)(addr + 0 * page_size), page_size, "rw-p") ||
+	    !check_user_page_vma((void *)(addr + 1 * page_size), page_size, "r-xp") ||
+	    !check_user_page_vma((void *)(addr + 2 * page_size), page_size, "rw-p"))
+		goto out;
+
+	skel->bss->exec_addr = addr + 2 * page_size;
+	user_page_trigger();
+	if (!ASSERT_OK(skel->bss->exec_ret, "last_page_exec_ret"))
+		goto out;
+
+	check_user_page_vma((void *)(addr + 2 * page_size), page_size, "r-xp");
+
+out:
+	if (addr >= 0)
+		munmap((void *)addr, page_size * 3);
+}
+
 void test_user_page(void)
 {
 	struct user_page *skel;
@@ -146,6 +204,10 @@ void test_user_page(void)
 		test_reallocate_after_unmap(skel);
 	if (test__start_subtest("read_implies_exec"))
 		test_read_implies_exec(skel);
+	if (test__start_subtest("execute_user_page"))
+		test_execute_user_page(skel);
+	if (test__start_subtest("partial_exec"))
+		test_partial_exec(skel);
 
 out:
 	user_page__destroy(skel);
diff --git a/tools/testing/selftests/bpf/progs/user_page.c b/tools/testing/selftests/bpf/progs/user_page.c
index 6dd9417463df..38f6fcb89bc6 100644
--- a/tools/testing/selftests/bpf/progs/user_page.c
+++ b/tools/testing/selftests/bpf/progs/user_page.c
@@ -9,11 +9,20 @@
 char _license[] SEC("license") = "GPL";
 
 #define USER_PAGE_ALLOC 1
+#define USER_PAGE_EXEC 2
+#define USER_PAGE_EXEC_ONLY 3
 
 int monitored_pid;
 int action;
 long user_addr;
+long exec_addr;
 unsigned long nr_pages;
+int write_ret;
+int exec_ret;
+static const unsigned char insns[] = {
+	0xf3, 0x0f, 0x1e, 0xfa, /* endbr64 */
+	0xb8, 42, 0, 0, 0, 0xc3, /* mov $42, %eax; ret */
+};
 
 SEC("uprobe.s//proc/self/exe:user_page_trigger")
 int user_page_test(struct pt_regs *ctx)
@@ -25,6 +34,15 @@ int user_page_test(struct pt_regs *ctx)
 	case USER_PAGE_ALLOC:
 		user_addr = bpf_user_page_alloc(nr_pages);
 		break;
+	case USER_PAGE_EXEC:
+		write_ret = bpf_probe_write_user_faultable((void *)exec_addr,
+							   insns, sizeof(insns));
+		exec_ret = write_ret ? write_ret :
+			bpf_user_page_exec(exec_addr);
+		break;
+	case USER_PAGE_EXEC_ONLY:
+		exec_ret = bpf_user_page_exec(exec_addr);
+		break;
 	}
 
 	return 0;
-- 
2.54.0