From: Kumar Kartikeya Dwivedi <memxor@gmail.com>
To: bpf@vger.kernel.org
Cc: Eduard Zingerman <eddyz87@gmail.com>,
Alexei Starovoitov <ast@kernel.org>,
Andrii Nakryiko <andrii@kernel.org>,
Daniel Borkmann <daniel@iogearbox.net>,
Emil Tsalapatis <emil@etsalapatis.com>, Tejun Heo <tj@kernel.org>,
Amery Hung <ameryhung@gmail.com>,
kkd@meta.com, kernel-team@meta.com
Subject: [PATCH bpf-next v5 11/11] selftests/bpf: Cover helper memory access permissions
Date: Mon, 21 Sep 2026 04:38:35 +0200 [thread overview]
Message-ID: <20260921023843.411943-12-memxor@gmail.com> (raw)
In-Reply-To: <20260921023843.411943-1-memxor@gmail.com>
From: Eduard Zingerman <eddyz87@gmail.com>
Check that fixed-size and sized helper input/output buffers require both
read and write permission. Cover the MTU and FIB helpers, including read-only
and write-only rejection and read/write positive controls. Exercise the XDP
prototypes and the sock_ops header-option input/output argument as well.
Keep write-only maps usable as destinations for partial-output helpers
bpf_snprintf() and bpf_sysctl_get_name(), while rejecting a read-only
snprintf destination. Also retain a write-only-map destination for
bpf_get_current_comm(), whose output is annotated MEM_UNINIT and fully
initialized by the helper.
Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
---
.../progs/verifier_helper_access_var_len.c | 143 ++++++++++++++++++
.../selftests/bpf/progs/verifier_mtu.c | 88 +++++++++++
2 files changed, 231 insertions(+)
diff --git a/tools/testing/selftests/bpf/progs/verifier_helper_access_var_len.c b/tools/testing/selftests/bpf/progs/verifier_helper_access_var_len.c
index e87eb6f221e4..2782faf0a528 100644
--- a/tools/testing/selftests/bpf/progs/verifier_helper_access_var_len.c
+++ b/tools/testing/selftests/bpf/progs/verifier_helper_access_var_len.c
@@ -1,4 +1,5 @@
// SPDX-License-Identifier: GPL-2.0
+/* Copyright (c) 2026 Meta Platforms, Inc. and affiliates. */
/* Converted from tools/testing/selftests/bpf/verifier/helper_access_var_len.c */
#include <linux/bpf.h>
@@ -822,6 +823,148 @@ __naked void bytes_no_leak_init_memory(void)
: __clobber_all);
}
+struct {
+ __uint(type, BPF_MAP_TYPE_ARRAY);
+ __uint(max_entries, 1);
+ __uint(map_flags, BPF_F_WRONLY_PROG);
+ __type(key, __u32);
+ __type(value, struct bpf_fib_lookup);
+} map_fib_wo SEC(".maps");
+
+struct {
+ __uint(type, BPF_MAP_TYPE_ARRAY);
+ __uint(max_entries, 1);
+ __type(key, __u32);
+ __type(value, struct bpf_fib_lookup);
+} map_fib_rw SEC(".maps");
+
+struct {
+ __uint(type, BPF_MAP_TYPE_ARRAY);
+ __uint(max_entries, 1);
+ __uint(map_flags, BPF_F_RDONLY_PROG);
+ __type(key, __u32);
+ __type(value, struct bpf_fib_lookup);
+} map_fib_ro SEC(".maps");
+
+SEC("tc")
+__failure __msg("read from map forbidden")
+int writeonly_sized_input(struct __sk_buff *ctx)
+{
+ struct bpf_fib_lookup *params;
+ __u32 key = 0;
+
+ params = bpf_map_lookup_elem(&map_fib_wo, &key);
+ if (params)
+ bpf_fib_lookup(ctx, params, sizeof(*params), 0);
+ return 0;
+}
+
+SEC("tc")
+__success
+int readwrite_sized_input(struct __sk_buff *ctx)
+{
+ struct bpf_fib_lookup *params;
+ __u32 key = 0;
+
+ params = bpf_map_lookup_elem(&map_fib_rw, &key);
+ if (params)
+ bpf_fib_lookup(ctx, params, sizeof(*params), 0);
+ return 0;
+}
+
+SEC("tc")
+__failure __msg("write into map forbidden")
+int readonly_sized_output(struct __sk_buff *ctx)
+{
+ struct bpf_fib_lookup *params;
+ __u32 key = 0;
+
+ params = bpf_map_lookup_elem(&map_fib_ro, &key);
+ if (params)
+ bpf_fib_lookup(ctx, params, sizeof(*params), 0);
+ return 0;
+}
+
+SEC("xdp")
+__failure __msg("read from map forbidden")
+int xdp_writeonly_sized_input(struct xdp_md *ctx)
+{
+ struct bpf_fib_lookup *params;
+ __u32 key = 0;
+
+ params = bpf_map_lookup_elem(&map_fib_wo, &key);
+ if (params)
+ bpf_fib_lookup(ctx, params, sizeof(*params), 0);
+ return XDP_PASS;
+}
+
+SEC("sockops")
+__failure __msg("read from map forbidden")
+int writeonly_header_option(struct bpf_sock_ops *ctx)
+{
+ struct bpf_fib_lookup *buf;
+ __u32 key = 0;
+
+ buf = bpf_map_lookup_elem(&map_fib_wo, &key);
+ if (buf)
+ bpf_load_hdr_opt(ctx, buf, sizeof(*buf), 0);
+ return 0;
+}
+
+SEC("sockops")
+__success
+int readwrite_header_option(struct bpf_sock_ops *ctx)
+{
+ struct bpf_fib_lookup *buf;
+ __u32 key = 0;
+
+ buf = bpf_map_lookup_elem(&map_fib_rw, &key);
+ if (buf)
+ bpf_load_hdr_opt(ctx, buf, sizeof(*buf), 0);
+ return 0;
+}
+
+SEC("tc")
+__success
+int snprintf_writeonly_output(struct __sk_buff *ctx)
+{
+ void *buf;
+ __u32 key = 0;
+
+ buf = bpf_map_lookup_elem(&map_fib_wo, &key);
+ if (buf)
+ bpf_snprintf(buf, 16, "ok", NULL, 0);
+ return 0;
+}
+
+SEC("tc")
+__failure __msg("write into map forbidden")
+int snprintf_readonly_output(struct __sk_buff *ctx)
+{
+ void *buf;
+ __u32 key = 0;
+
+ buf = bpf_map_lookup_elem(&map_fib_ro, &key);
+ if (buf)
+ bpf_snprintf(buf, 16, "ok", NULL, 0);
+ return 0;
+}
+
+SEC("cgroup/sysctl")
+__success
+__caps_unpriv(CAP_BPF | CAP_NET_ADMIN)
+__success_unpriv
+int sysctl_writeonly_output(struct bpf_sysctl *ctx)
+{
+ void *buf;
+ __u32 key = 0;
+
+ buf = bpf_map_lookup_elem(&map_fib_wo, &key);
+ if (buf)
+ bpf_sysctl_get_name(ctx, buf, 16, 0);
+ return 0;
+}
+
SEC("cgroup/sysctl")
__success
__caps_unpriv(CAP_BPF | CAP_NET_ADMIN)
diff --git a/tools/testing/selftests/bpf/progs/verifier_mtu.c b/tools/testing/selftests/bpf/progs/verifier_mtu.c
index 256956ea1ac5..2f71f70302e4 100644
--- a/tools/testing/selftests/bpf/progs/verifier_mtu.c
+++ b/tools/testing/selftests/bpf/progs/verifier_mtu.c
@@ -17,4 +17,92 @@ int tc_uninit_mtu(struct __sk_buff *ctx)
return TCX_PASS;
}
+struct {
+ __uint(type, BPF_MAP_TYPE_ARRAY);
+ __uint(max_entries, 1);
+ __uint(map_flags, BPF_F_WRONLY_PROG);
+ __type(key, __u32);
+ __type(value, __u32);
+} map_mtu_wo SEC(".maps");
+
+struct {
+ __uint(type, BPF_MAP_TYPE_ARRAY);
+ __uint(max_entries, 1);
+ __type(key, __u32);
+ __type(value, __u32);
+} map_mtu_rw SEC(".maps");
+
+struct {
+ __uint(type, BPF_MAP_TYPE_ARRAY);
+ __uint(max_entries, 1);
+ __uint(map_flags, BPF_F_RDONLY_PROG);
+ __type(key, __u32);
+ __type(value, __u32);
+} map_mtu_ro SEC(".maps");
+
+SEC("tc/ingress")
+__failure __msg("read from map forbidden")
+int tc_writeonly_mtu(struct __sk_buff *ctx)
+{
+ __u32 key = 0;
+ __u32 *mtu;
+
+ mtu = bpf_map_lookup_elem(&map_mtu_wo, &key);
+ if (mtu)
+ bpf_check_mtu(ctx, 0, mtu, 0, 0);
+ return TCX_PASS;
+}
+
+SEC("tc/ingress")
+__success
+int tc_readwrite_mtu(struct __sk_buff *ctx)
+{
+ __u32 key = 0;
+ __u32 *mtu;
+
+ mtu = bpf_map_lookup_elem(&map_mtu_rw, &key);
+ if (mtu)
+ bpf_check_mtu(ctx, 0, mtu, 0, 0);
+ return TCX_PASS;
+}
+
+SEC("xdp")
+__failure __msg("read from map forbidden")
+int xdp_writeonly_mtu(struct xdp_md *ctx)
+{
+ __u32 key = 0;
+ __u32 *mtu;
+
+ mtu = bpf_map_lookup_elem(&map_mtu_wo, &key);
+ if (mtu)
+ bpf_check_mtu(ctx, 0, mtu, 0, 0);
+ return XDP_PASS;
+}
+
+SEC("tc/ingress")
+__failure __msg("write into map forbidden")
+int tc_readonly_mtu(struct __sk_buff *ctx)
+{
+ __u32 key = 0;
+ __u32 *mtu;
+
+ mtu = bpf_map_lookup_elem(&map_mtu_ro, &key);
+ if (mtu)
+ bpf_check_mtu(ctx, 0, mtu, 0, 0);
+ return TCX_PASS;
+}
+
+SEC("tc/ingress")
+__success
+int tc_writeonly_output(struct __sk_buff *ctx)
+{
+ __u32 key = 0;
+ __u32 *out;
+
+ out = bpf_map_lookup_elem(&map_mtu_wo, &key);
+ if (out)
+ bpf_get_current_comm(out, sizeof(*out));
+ return TCX_PASS;
+}
+
char LICENSE[] SEC("license") = "GPL";
--
2.53.0
next prev parent reply other threads:[~2026-09-21 2:39 UTC|newest]
Thread overview: 17+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-09-21 2:38 [PATCH bpf-next v5 00/11] Fix generic __uninit kfunc output buffers Kumar Kartikeya Dwivedi
2026-09-21 2:38 ` [PATCH bpf-next v5 01/11] selftests/bpf: Allow privileged preparation for capability tests Kumar Kartikeya Dwivedi
2026-09-21 2:38 ` [PATCH bpf-next v5 02/11] bpf: Record raw memory arguments during argument checking Kumar Kartikeya Dwivedi
2026-09-21 2:38 ` [PATCH bpf-next v5 03/11] bpf: Check __uninit kfunc output buffers as write-only Kumar Kartikeya Dwivedi
2026-09-21 3:54 ` bot+bpf-ci
2026-09-21 2:38 ` [PATCH bpf-next v5 04/11] bpf: Fix generic __uninit kfunc output buffers Kumar Kartikeya Dwivedi
2026-09-21 2:38 ` [PATCH bpf-next v5 05/11] selftests/bpf: Cover generic __uninit output initialization Kumar Kartikeya Dwivedi
2026-09-21 2:38 ` [PATCH bpf-next v5 06/11] bpf: Support multiple __uninit kfunc output arguments Kumar Kartikeya Dwivedi
2026-09-21 2:38 ` [PATCH bpf-next v5 07/11] selftests/bpf: Cover __uninit kfunc output argument slots Kumar Kartikeya Dwivedi
2026-09-21 2:38 ` [PATCH bpf-next v5 08/11] bpf: Preserve stack initialization for generic output buffers Kumar Kartikeya Dwivedi
2026-09-21 3:54 ` bot+bpf-ci
2026-09-21 2:38 ` [PATCH bpf-next v5 09/11] selftests/bpf: Cover generic output stack initialization Kumar Kartikeya Dwivedi
2026-09-21 3:54 ` bot+bpf-ci
2026-09-21 2:38 ` [PATCH bpf-next v5 10/11] bpf: Check read access for helper input/output buffers Kumar Kartikeya Dwivedi
2026-09-21 2:38 ` Kumar Kartikeya Dwivedi [this message]
2026-09-21 3:54 ` [PATCH bpf-next v5 11/11] selftests/bpf: Cover helper memory access permissions bot+bpf-ci
2026-09-21 17:20 ` [PATCH bpf-next v5 00/11] Fix generic __uninit kfunc output buffers patchwork-bot+netdevbpf
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260921023843.411943-12-memxor@gmail.com \
--to=memxor@gmail.com \
--cc=ameryhung@gmail.com \
--cc=andrii@kernel.org \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=eddyz87@gmail.com \
--cc=emil@etsalapatis.com \
--cc=kernel-team@meta.com \
--cc=kkd@meta.com \
--cc=tj@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox