From: Ilya Leoshkevich <iii@linux.ibm.com>
To: Alexei Starovoitov <ast@kernel.org>,
Daniel Borkmann <daniel@iogearbox.net>,
Andrii Nakryiko <andrii@kernel.org>
Cc: bpf@vger.kernel.org, Heiko Carstens <hca@linux.ibm.com>,
Vasily Gorbik <gor@linux.ibm.com>,
Alexander Gordeev <agordeev@linux.ibm.com>,
Ilya Leoshkevich <iii@linux.ibm.com>
Subject: [PATCH bpf-next 09/10] selftests/bpf: Add UAF tests for arena atomics
Date: Thu, 27 Jun 2024 11:07:12 +0200 [thread overview]
Message-ID: <20240627090900.20017-10-iii@linux.ibm.com> (raw)
In-Reply-To: <20240627090900.20017-1-iii@linux.ibm.com>
Check that __sync_*() functions don't cause kernel panics when handling
freed arena pages.
Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
---
.../selftests/bpf/prog_tests/arena_atomics.c | 16 +++++++
.../selftests/bpf/progs/arena_atomics.c | 43 +++++++++++++++++++
2 files changed, 59 insertions(+)
diff --git a/tools/testing/selftests/bpf/prog_tests/arena_atomics.c b/tools/testing/selftests/bpf/prog_tests/arena_atomics.c
index 0807a48a58ee..38eef4cc5c80 100644
--- a/tools/testing/selftests/bpf/prog_tests/arena_atomics.c
+++ b/tools/testing/selftests/bpf/prog_tests/arena_atomics.c
@@ -146,6 +146,20 @@ static void test_xchg(struct arena_atomics *skel)
ASSERT_EQ(skel->arena->xchg32_result, 1, "xchg32_result");
}
+static void test_uaf(struct arena_atomics *skel)
+{
+ LIBBPF_OPTS(bpf_test_run_opts, topts);
+ int err, prog_fd;
+
+ /* No need to attach it, just run it directly */
+ prog_fd = bpf_program__fd(skel->progs.uaf);
+ err = bpf_prog_test_run_opts(prog_fd, &topts);
+ if (!ASSERT_OK(err, "test_run_opts err"))
+ return;
+ if (!ASSERT_OK(topts.retval, "test_run_opts retval"))
+ return;
+}
+
void test_arena_atomics(void)
{
struct arena_atomics *skel;
@@ -180,6 +194,8 @@ void test_arena_atomics(void)
test_cmpxchg(skel);
if (test__start_subtest("xchg"))
test_xchg(skel);
+ if (test__start_subtest("uaf"))
+ test_uaf(skel);
cleanup:
arena_atomics__destroy(skel);
diff --git a/tools/testing/selftests/bpf/progs/arena_atomics.c b/tools/testing/selftests/bpf/progs/arena_atomics.c
index 55f10563208d..a86c8cdf1a30 100644
--- a/tools/testing/selftests/bpf/progs/arena_atomics.c
+++ b/tools/testing/selftests/bpf/progs/arena_atomics.c
@@ -176,3 +176,46 @@ int xchg(const void *ctx)
return 0;
}
+
+SEC("syscall")
+int uaf(const void *ctx)
+{
+ if (pid != (bpf_get_current_pid_tgid() >> 32))
+ return 0;
+#ifdef ENABLE_ATOMICS_TESTS
+ void __arena *page;
+
+ page = bpf_arena_alloc_pages(&arena, NULL, 1, NUMA_NO_NODE, 0);
+ bpf_arena_free_pages(&arena, page, 1);
+
+ __sync_fetch_and_add((__u32 __arena *)page, 1);
+ __sync_add_and_fetch((__u32 __arena *)page, 1);
+ __sync_fetch_and_sub((__u32 __arena *)page, 1);
+ __sync_sub_and_fetch((__u32 __arena *)page, 1);
+ __sync_fetch_and_and((__u32 __arena *)page, 1);
+ __sync_and_and_fetch((__u32 __arena *)page, 1);
+ __sync_fetch_and_or((__u32 __arena *)page, 1);
+ __sync_or_and_fetch((__u32 __arena *)page, 1);
+ __sync_fetch_and_xor((__u32 __arena *)page, 1);
+ __sync_xor_and_fetch((__u32 __arena *)page, 1);
+ __sync_val_compare_and_swap((__u32 __arena *)page, 0, 1);
+ __sync_lock_test_and_set((__u32 __arena *)page, 1);
+
+ __sync_fetch_and_add((__u64 __arena *)page, 1);
+ __sync_add_and_fetch((__u64 __arena *)page, 1);
+ __sync_fetch_and_sub((__u64 __arena *)page, 1);
+ __sync_sub_and_fetch((__u64 __arena *)page, 1);
+ __sync_fetch_and_and((__u64 __arena *)page, 1);
+ __sync_and_and_fetch((__u64 __arena *)page, 1);
+ __sync_fetch_and_or((__u64 __arena *)page, 1);
+ __sync_or_and_fetch((__u64 __arena *)page, 1);
+ __sync_fetch_and_xor((__u64 __arena *)page, 1);
+ __sync_xor_and_fetch((__u64 __arena *)page, 1);
+ __sync_val_compare_and_swap((__u64 __arena *)page, 0, 1);
+ __sync_lock_test_and_set((__u64 __arena *)page, 1);
+#endif
+
+ return 0;
+}
+
+char _license[] SEC("license") = "GPL";
--
2.45.2
next prev parent reply other threads:[~2024-06-27 9:09 UTC|newest]
Thread overview: 16+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-06-27 9:07 [PATCH bpf-next 00/10] s390/bpf: Implement arena Ilya Leoshkevich
2024-06-27 9:07 ` [PATCH bpf-next 01/10] s390/bpf: Factor out emitting probe nops Ilya Leoshkevich
2024-06-27 9:07 ` [PATCH bpf-next 02/10] s390/bpf: Get rid of get_probe_mem_regno() Ilya Leoshkevich
2024-06-27 9:07 ` [PATCH bpf-next 03/10] s390/bpf: Introduce pre- and post- probe functions Ilya Leoshkevich
2024-06-27 9:07 ` [PATCH bpf-next 04/10] s390/bpf: Land on the next JITed instruction after exception Ilya Leoshkevich
2024-06-27 9:07 ` [PATCH bpf-next 05/10] s390/bpf: Support BPF_PROBE_MEM32 Ilya Leoshkevich
2024-06-27 9:07 ` [PATCH bpf-next 06/10] s390/bpf: Support address space cast instruction Ilya Leoshkevich
2024-06-27 9:07 ` [PATCH bpf-next 07/10] s390/bpf: Enable arena Ilya Leoshkevich
2024-06-27 9:07 ` [PATCH bpf-next 08/10] s390/bpf: Support arena atomics Ilya Leoshkevich
2024-06-28 0:43 ` Alexei Starovoitov
2024-06-28 9:09 ` Ilya Leoshkevich
2024-06-27 9:07 ` Ilya Leoshkevich [this message]
2024-06-28 0:45 ` [PATCH bpf-next 09/10] selftests/bpf: Add UAF tests for " Alexei Starovoitov
2024-06-28 9:13 ` Ilya Leoshkevich
2024-07-03 2:10 ` kernel test robot
2024-06-27 9:07 ` [PATCH bpf-next 10/10] selftests/bpf: Remove arena tests from DENYLIST.s390x Ilya Leoshkevich
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20240627090900.20017-10-iii@linux.ibm.com \
--to=iii@linux.ibm.com \
--cc=agordeev@linux.ibm.com \
--cc=andrii@kernel.org \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=gor@linux.ibm.com \
--cc=hca@linux.ibm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox