[PATCH bpf-next 1/2] bpf: fix cgroup_skb prog test run direct packet access

[PATCH bpf-next 1/2] bpf: fix cgroup_skb prog test run direct packet access

[Mahe Tardy]

This is needed in the context of Tetragon to test cgroup_skb programs
using BPF_PROG_TEST_RUN with direct packet access.

Commit b39b5f411dcf ("bpf: add cg_skb_is_valid_access for
BPF_PROG_TYPE_CGROUP_SKB") added direct packet access for cgroup_skb
programs and following commit 2cb494a36c98 ("bpf: add tests for direct
packet access from CGROUP_SKB") added tests to the verifier to ensure
that access to skb fields was possible and also fixed
bpf_prog_test_run_skb. However, is_direct_pkt_access was never set to
true for this program type, so data pointers were not computed when
using prog_test_run, making data_end always equal to zero (data_meta is
not accessible for cgroup_skb).

Signed-off-by: Mahe Tardy <mahe.tardy@gmail.com>
---
 net/bpf/test_run.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/net/bpf/test_run.c b/net/bpf/test_run.c
index 501ec4249fed..5586c1392607 100644
--- a/net/bpf/test_run.c
+++ b/net/bpf/test_run.c
@@ -1018,6 +1018,7 @@ int bpf_prog_test_run_skb(struct bpf_prog *prog, const union bpf_attr *kattr,
 	case BPF_PROG_TYPE_LWT_IN:
 	case BPF_PROG_TYPE_LWT_OUT:
 	case BPF_PROG_TYPE_LWT_XMIT:
+	case BPF_PROG_TYPE_CGROUP_SKB:
 		is_direct_pkt_access = true;
 		break;
 	default:
--
2.34.1

[PATCH bpf-next 2/2] selftests/bpf: add cgroup skb direct packet access test

[Mahe Tardy]

This verifies that programs of BPF_PROG_TYPE_CGROUP_SKB can access
skb->data_end with direct packet access when being run with
BPF_PROG_TEST_RUN.

Signed-off-by: Mahe Tardy <mahe.tardy@gmail.com>
---
 .../cgroup_skb_direct_packet_access.c         | 28 +++++++++++++++++++
 .../progs/cgroup_skb_direct_packet_access.c   | 15 ++++++++++
 2 files changed, 43 insertions(+)
 create mode 100644 tools/testing/selftests/bpf/prog_tests/cgroup_skb_direct_packet_access.c
 create mode 100644 tools/testing/selftests/bpf/progs/cgroup_skb_direct_packet_access.c

diff --git a/tools/testing/selftests/bpf/prog_tests/cgroup_skb_direct_packet_access.c b/tools/testing/selftests/bpf/prog_tests/cgroup_skb_direct_packet_access.c
new file mode 100644
index 000000000000..e1a90c10db8c
--- /dev/null
+++ b/tools/testing/selftests/bpf/prog_tests/cgroup_skb_direct_packet_access.c
@@ -0,0 +1,28 @@
+// SPDX-License-Identifier: GPL-2.0
+
+#include <test_progs.h>
+#include "cgroup_skb_direct_packet_access.skel.h"
+
+void test_cgroup_skb_prog_run_direct_packet_access(void)
+{
+	int err;
+	struct cgroup_skb_direct_packet_access *skel;
+	char test_skb[64] = {};
+
+	LIBBPF_OPTS(bpf_test_run_opts, topts,
+		.data_in = test_skb,
+		.data_size_in = sizeof(test_skb),
+	);
+
+	skel = cgroup_skb_direct_packet_access__open_and_load();
+	if (!ASSERT_OK_PTR(skel, "cgroup_skb_direct_packet_access__open_and_load"))
+		return;
+
+	err = bpf_prog_test_run_opts(bpf_program__fd(skel->progs.direct_packet_access), &topts);
+	ASSERT_OK(err, "bpf_prog_test_run_opts err");
+	ASSERT_EQ(topts.retval, 1, "retval");
+
+	ASSERT_NEQ(skel->bss->data_end, 0, "data_end");
+
+	cgroup_skb_direct_packet_access__destroy(skel);
+}
diff --git a/tools/testing/selftests/bpf/progs/cgroup_skb_direct_packet_access.c b/tools/testing/selftests/bpf/progs/cgroup_skb_direct_packet_access.c
new file mode 100644
index 000000000000..e32b07d802bb
--- /dev/null
+++ b/tools/testing/selftests/bpf/progs/cgroup_skb_direct_packet_access.c
@@ -0,0 +1,15 @@
+// SPDX-License-Identifier: GPL-2.0
+
+#include "vmlinux.h"
+#include <bpf/bpf_helpers.h>
+
+__u32 data_end;
+
+SEC("cgroup_skb/ingress")
+int direct_packet_access(struct __sk_buff *skb)
+{
+	data_end = skb->data_end;
+	return 1;
+}
+
+char _license[] SEC("license") = "GPL";
--
2.34.1

Re: [PATCH bpf-next 1/2] bpf: fix cgroup_skb prog test run direct packet access

[patchwork-bot+netdevbpf]

Hello:

This series was applied to bpf/bpf-next.git (master)
by Alexei Starovoitov <ast@kernel.org>:

On Mon, 25 Nov 2024 15:26:02 +0000 you wrote:
> This is needed in the context of Tetragon to test cgroup_skb programs
> using BPF_PROG_TEST_RUN with direct packet access.
> 
> Commit b39b5f411dcf ("bpf: add cg_skb_is_valid_access for
> BPF_PROG_TYPE_CGROUP_SKB") added direct packet access for cgroup_skb
> programs and following commit 2cb494a36c98 ("bpf: add tests for direct
> packet access from CGROUP_SKB") added tests to the verifier to ensure
> that access to skb fields was possible and also fixed
> bpf_prog_test_run_skb. However, is_direct_pkt_access was never set to
> true for this program type, so data pointers were not computed when
> using prog_test_run, making data_end always equal to zero (data_meta is
> not accessible for cgroup_skb).
> 
> [...]

Here is the summary with links:
  - [bpf-next,1/2] bpf: fix cgroup_skb prog test run direct packet access
    https://git.kernel.org/bpf/bpf-next/c/a4bc2d977a67
  - [bpf-next,2/2] selftests/bpf: add cgroup skb direct packet access test
    https://git.kernel.org/bpf/bpf-next/c/6398ef949aba

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html