From: Kumar Kartikeya Dwivedi <memxor@gmail.com>
To: bpf@vger.kernel.org
Cc: "Alexei Starovoitov" <ast@kernel.org>,
"Andrii Nakryiko" <andrii@kernel.org>,
"Daniel Borkmann" <daniel@iogearbox.net>,
"Martin KaFai Lau" <kafai@fb.com>,
"Toke Høiland-Jørgensen" <toke@redhat.com>,
"Jesper Dangaard Brouer" <hawk@kernel.org>,
"Lorenzo Bianconi" <lorenzo@kernel.org>,
"John Fastabend" <john.fastabend@gmail.com>,
"Jakub Kicinski" <kuba@kernel.org>, "Lorenz Bauer" <linux@lmb.io>,
netdev@vger.kernel.org
Subject: [PATCH bpf-next v1 4/5] selftests/bpf: Add verifier tests for pkt pointer with pkt_uid
Date: Mon, 7 Mar 2022 05:13:10 +0530 [thread overview]
Message-ID: <20220306234311.452206-5-memxor@gmail.com> (raw)
In-Reply-To: <20220306234311.452206-1-memxor@gmail.com>
Use bpf_packet_pointer to obtain such pkt pointers, and verify various
behaviors, like find_good_pkt_pointers skipping pkt pointers with
unequal pkt_uid, ensuring that offset, len to bpf_packet_pointer are
within limits imposed statically by verifier, rejecting comparion of pkt
pointer with pkt_uid against unequal pkt_uid, ensuring
clear_all_pkt_pointers doens't skip pkt_uid pkts.
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
---
tools/testing/selftests/bpf/verifier/xdp.c | 146 +++++++++++++++++++++
1 file changed, 146 insertions(+)
diff --git a/tools/testing/selftests/bpf/verifier/xdp.c b/tools/testing/selftests/bpf/verifier/xdp.c
index 5ac390508139..580b294cde11 100644
--- a/tools/testing/selftests/bpf/verifier/xdp.c
+++ b/tools/testing/selftests/bpf/verifier/xdp.c
@@ -12,3 +12,149 @@
.prog_type = BPF_PROG_TYPE_XDP,
.retval = 1,
},
+{
+ "XDP bpf_packet_pointer offset cannot be > 0xffff",
+ .insns = {
+ BPF_MOV64_IMM(BPF_REG_2, 0x10000),
+ BPF_MOV64_IMM(BPF_REG_3, 42),
+ BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_packet_pointer),
+ BPF_MOV64_IMM(BPF_REG_0, 1),
+ BPF_EXIT_INSN(),
+ },
+ .prog_type = BPF_PROG_TYPE_XDP,
+ .result_unpriv = REJECT,
+ .result = REJECT,
+ .errstr = "R2 must be in range [0, 0xffff]",
+},
+{
+ "XDP bpf_packet_pointer len must be constant",
+ .insns = {
+ BPF_MOV64_IMM(BPF_REG_0, 1),
+ BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, ingress_ifindex)),
+ BPF_JMP32_IMM(BPF_JSGE, BPF_REG_2, 0, 1),
+ BPF_EXIT_INSN(),
+ BPF_JMP32_IMM(BPF_JSLE, BPF_REG_2, 0xffff, 1),
+ BPF_EXIT_INSN(),
+ BPF_MOV64_REG(BPF_REG_3, BPF_REG_2),
+ BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_packet_pointer),
+ BPF_EXIT_INSN(),
+ },
+ .prog_type = BPF_PROG_TYPE_XDP,
+ .result_unpriv = REJECT,
+ .result = REJECT,
+ .errstr = "R3 is not a known constant",
+},
+{
+ "XDP bpf_packet_pointer len cannot be 0",
+ .insns = {
+ BPF_MOV64_IMM(BPF_REG_0, 1),
+ BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, ingress_ifindex)),
+ BPF_JMP32_IMM(BPF_JSGE, BPF_REG_2, 0, 1),
+ BPF_EXIT_INSN(),
+ BPF_JMP32_IMM(BPF_JSLE, BPF_REG_2, 0xffff, 1),
+ BPF_EXIT_INSN(),
+ BPF_MOV64_IMM(BPF_REG_3, 0),
+ BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_packet_pointer),
+ BPF_EXIT_INSN(),
+ },
+ .prog_type = BPF_PROG_TYPE_XDP,
+ .result_unpriv = REJECT,
+ .result = REJECT,
+ .errstr = "R3 must be in range [1, 0xffff]",
+},
+{
+ "XDP bpf_packet_pointer R0 cannot be compared with xdp_md pkt ptr",
+ .insns = {
+ BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
+ BPF_MOV64_IMM(BPF_REG_2, 0),
+ BPF_MOV64_IMM(BPF_REG_3, 42),
+ BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_packet_pointer),
+ BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
+ BPF_EXIT_INSN(),
+ BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_6, offsetof(struct xdp_md, data_end)),
+ BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 16),
+ BPF_JMP_REG(BPF_JGE, BPF_REG_0, BPF_REG_1, 1),
+ BPF_EXIT_INSN(),
+ BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 0),
+ BPF_MOV64_IMM(BPF_REG_0, 1),
+ BPF_EXIT_INSN(),
+ },
+ .prog_type = BPF_PROG_TYPE_XDP,
+ .result_unpriv = REJECT,
+ .result = REJECT,
+ .errstr = "R0, R1 pkt pointer comparison prohibited",
+},
+{
+ "XDP bpf_packet_pointer R0 range propagation skips unequal pkt_uid",
+ .insns = {
+ BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
+ BPF_MOV64_IMM(BPF_REG_2, 0),
+ BPF_MOV64_IMM(BPF_REG_3, 1),
+ BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_packet_pointer),
+ BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
+ BPF_EXIT_INSN(),
+ BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_6, offsetof(struct xdp_md, data)),
+ BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_6, offsetof(struct xdp_md, data)),
+ BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_6, offsetof(struct xdp_md, data)),
+ BPF_LDX_MEM(BPF_W, BPF_REG_4, BPF_REG_6, offsetof(struct xdp_md, data_end)),
+ BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 16),
+ BPF_JMP_REG(BPF_JLT, BPF_REG_1, BPF_REG_4, 1),
+ BPF_EXIT_INSN(),
+ BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_1, -16),
+ BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_2, 4),
+ BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_3, 8),
+ BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 0),
+ BPF_MOV64_IMM(BPF_REG_0, 1),
+ BPF_EXIT_INSN(),
+ },
+ .prog_type = BPF_PROG_TYPE_XDP,
+ .result_unpriv = REJECT,
+ .result = REJECT,
+ .errstr = "invalid access to packet, off=0 size=8, R0(id=0,off=0,r=1)",
+},
+{
+ "XDP clear_all_pkt_pointers doesn't skip pkt_uid != 0",
+ .insns = {
+ BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
+ BPF_MOV64_IMM(BPF_REG_2, 0),
+ BPF_MOV64_IMM(BPF_REG_3, 16),
+ BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_packet_pointer),
+ BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
+ BPF_EXIT_INSN(),
+ BPF_MOV64_REG(BPF_REG_7, BPF_REG_0),
+ BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
+ BPF_MOV64_IMM(BPF_REG_2, 1),
+ BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_xdp_adjust_tail),
+ BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_7, 0),
+ BPF_EXIT_INSN(),
+ },
+ .prog_type = BPF_PROG_TYPE_XDP,
+ .result_unpriv = REJECT,
+ .result = REJECT,
+ .errstr = "R7 invalid mem access 'scalar'",
+},
+{
+ "XDP pkt_uid preserved when resetting range on rX += var",
+ .insns = {
+ BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
+ BPF_MOV64_IMM(BPF_REG_2, 0),
+ BPF_MOV64_IMM(BPF_REG_3, 16),
+ BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_packet_pointer),
+ BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
+ BPF_EXIT_INSN(),
+ BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_6, offsetof(struct xdp_md, ingress_ifindex)),
+ BPF_JMP32_IMM(BPF_JGE, BPF_REG_1, 0, 1),
+ BPF_EXIT_INSN(),
+ BPF_JMP32_IMM(BPF_JLE, BPF_REG_1, 4, 1),
+ BPF_EXIT_INSN(),
+ BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_0),
+ BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_6, offsetof(struct xdp_md, data_end)),
+ BPF_JMP_REG(BPF_JLT, BPF_REG_1, BPF_REG_0, 1),
+ BPF_EXIT_INSN(),
+ BPF_EXIT_INSN(),
+ },
+ .prog_type = BPF_PROG_TYPE_XDP,
+ .result_unpriv = REJECT,
+ .result = REJECT,
+ .errstr = "R1, R0 pkt pointer comparison prohibited",
+},
--
2.35.1
next prev parent reply other threads:[~2022-03-06 23:43 UTC|newest]
Thread overview: 24+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-03-06 23:43 [PATCH bpf-next v1 0/5] Introduce bpf_packet_pointer helper Kumar Kartikeya Dwivedi
2022-03-06 23:43 ` [PATCH bpf-next v1 1/5] bpf: Add ARG_SCALAR and ARG_CONSTANT Kumar Kartikeya Dwivedi
2022-03-07 19:28 ` Joanne Koong
2022-03-07 21:22 ` Kumar Kartikeya Dwivedi
2022-03-08 5:42 ` Andrii Nakryiko
2022-03-08 6:26 ` Kumar Kartikeya Dwivedi
2022-03-10 23:05 ` Andrii Nakryiko
2022-03-10 23:09 ` Andrii Nakryiko
2022-03-11 7:31 ` Kumar Kartikeya Dwivedi
2022-03-06 23:43 ` [PATCH bpf-next v1 2/5] bpf: Introduce pkt_uid concept for PTR_TO_PACKET Kumar Kartikeya Dwivedi
2022-03-06 23:43 ` [PATCH bpf-next v1 3/5] bpf: Introduce bpf_packet_pointer helper to do DPA Kumar Kartikeya Dwivedi
2022-03-06 23:43 ` Kumar Kartikeya Dwivedi [this message]
2022-03-06 23:43 ` [PATCH bpf-next v1 5/5] selftests/bpf: Update xdp_adjust_frags to use bpf_packet_pointer Kumar Kartikeya Dwivedi
2022-03-08 5:48 ` [PATCH bpf-next v1 0/5] Introduce bpf_packet_pointer helper Andrii Nakryiko
2022-03-08 7:08 ` Kumar Kartikeya Dwivedi
2022-03-08 13:40 ` Toke Høiland-Jørgensen
2022-03-10 23:12 ` Andrii Nakryiko
2022-03-10 23:30 ` Toke Høiland-Jørgensen
2022-03-10 23:35 ` Alexei Starovoitov
2022-03-11 7:25 ` Kumar Kartikeya Dwivedi
2022-03-11 7:32 ` Kumar Kartikeya Dwivedi
2022-03-11 17:27 ` Alexei Starovoitov
2022-03-11 7:19 ` Kumar Kartikeya Dwivedi
2022-03-11 10:34 ` Toke Høiland-Jørgensen
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20220306234311.452206-5-memxor@gmail.com \
--to=memxor@gmail.com \
--cc=andrii@kernel.org \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=hawk@kernel.org \
--cc=john.fastabend@gmail.com \
--cc=kafai@fb.com \
--cc=kuba@kernel.org \
--cc=linux@lmb.io \
--cc=lorenzo@kernel.org \
--cc=netdev@vger.kernel.org \
--cc=toke@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).