From: Amery Hung <ameryhung@gmail.com>
To: netdev@vger.kernel.org
Cc: bpf@vger.kernel.org, daniel@iogearbox.net, andrii@kernel.org,
alexei.starovoitov@gmail.com, martin.lau@kernel.org,
kuba@kernel.org, edumazet@google.com, xiyou.wangcong@gmail.com,
cong.wang@bytedance.com, jhs@mojatatu.com, sinquersw@gmail.com,
toke@redhat.com, jiri@resnulli.us, stfomichev@gmail.com,
ekarani.silvestre@ccc.ufcg.edu.br, yangpeihao@sjtu.edu.cn,
yepeilin.cs@gmail.com, ameryhung@gmail.com, ming.lei@redhat.com,
kernel-team@meta.com
Subject: [PATCH bpf-next v3 03/18] selftests/bpf: Test referenced kptr arguments of struct_ops programs
Date: Fri, 31 Jan 2025 11:28:42 -0800 [thread overview]
Message-ID: <20250131192912.133796-4-ameryhung@gmail.com> (raw)
In-Reply-To: <20250131192912.133796-1-ameryhung@gmail.com>
From: Amery Hung <amery.hung@bytedance.com>
Test referenced kptr acquired through struct_ops argument tagged with
"__ref". The success case checks whether 1) a reference to the correct
type is acquired, and 2) the referenced kptr argument can be accessed in
multiple paths as long as it hasn't been released. In the fail cases,
we first confirm that a referenced kptr acquried through a struct_ops
argument is not allowed to be leaked. Then, we make sure this new
referenced kptr acquiring mechanism does not accidentally allow referenced
kptrs to flow into global subprograms through their arguments.
Signed-off-by: Amery Hung <amery.hung@bytedance.com>
---
.../prog_tests/test_struct_ops_refcounted.c | 12 ++++++
.../bpf/progs/struct_ops_refcounted.c | 31 +++++++++++++++
...ruct_ops_refcounted_fail__global_subprog.c | 39 +++++++++++++++++++
.../struct_ops_refcounted_fail__ref_leak.c | 22 +++++++++++
.../selftests/bpf/test_kmods/bpf_testmod.c | 7 ++++
.../selftests/bpf/test_kmods/bpf_testmod.h | 2 +
6 files changed, 113 insertions(+)
create mode 100644 tools/testing/selftests/bpf/prog_tests/test_struct_ops_refcounted.c
create mode 100644 tools/testing/selftests/bpf/progs/struct_ops_refcounted.c
create mode 100644 tools/testing/selftests/bpf/progs/struct_ops_refcounted_fail__global_subprog.c
create mode 100644 tools/testing/selftests/bpf/progs/struct_ops_refcounted_fail__ref_leak.c
diff --git a/tools/testing/selftests/bpf/prog_tests/test_struct_ops_refcounted.c b/tools/testing/selftests/bpf/prog_tests/test_struct_ops_refcounted.c
new file mode 100644
index 000000000000..e290a2f6db95
--- /dev/null
+++ b/tools/testing/selftests/bpf/prog_tests/test_struct_ops_refcounted.c
@@ -0,0 +1,12 @@
+#include <test_progs.h>
+
+#include "struct_ops_refcounted.skel.h"
+#include "struct_ops_refcounted_fail__ref_leak.skel.h"
+#include "struct_ops_refcounted_fail__global_subprog.skel.h"
+
+void test_struct_ops_refcounted(void)
+{
+ RUN_TESTS(struct_ops_refcounted);
+ RUN_TESTS(struct_ops_refcounted_fail__ref_leak);
+ RUN_TESTS(struct_ops_refcounted_fail__global_subprog);
+}
diff --git a/tools/testing/selftests/bpf/progs/struct_ops_refcounted.c b/tools/testing/selftests/bpf/progs/struct_ops_refcounted.c
new file mode 100644
index 000000000000..76dcb6089d7f
--- /dev/null
+++ b/tools/testing/selftests/bpf/progs/struct_ops_refcounted.c
@@ -0,0 +1,31 @@
+#include <vmlinux.h>
+#include <bpf/bpf_tracing.h>
+#include "../test_kmods/bpf_testmod.h"
+#include "bpf_misc.h"
+
+char _license[] SEC("license") = "GPL";
+
+__attribute__((nomerge)) extern void bpf_task_release(struct task_struct *p) __ksym;
+
+/* This is a test BPF program that uses struct_ops to access a referenced
+ * kptr argument. This is a test for the verifier to ensure that it
+ * 1) recongnizes the task as a referenced object (i.e., ref_obj_id > 0), and
+ * 2) the same reference can be acquired from multiple paths as long as it
+ * has not been released.
+ */
+SEC("struct_ops/test_refcounted")
+int BPF_PROG(refcounted, int dummy, struct task_struct *task)
+{
+ if (dummy == 1)
+ bpf_task_release(task);
+ else
+ bpf_task_release(task);
+ return 0;
+}
+
+SEC(".struct_ops.link")
+struct bpf_testmod_ops testmod_refcounted = {
+ .test_refcounted = (void *)refcounted,
+};
+
+
diff --git a/tools/testing/selftests/bpf/progs/struct_ops_refcounted_fail__global_subprog.c b/tools/testing/selftests/bpf/progs/struct_ops_refcounted_fail__global_subprog.c
new file mode 100644
index 000000000000..ae074aa62852
--- /dev/null
+++ b/tools/testing/selftests/bpf/progs/struct_ops_refcounted_fail__global_subprog.c
@@ -0,0 +1,39 @@
+#include <vmlinux.h>
+#include <bpf/bpf_tracing.h>
+#include "../test_kmods/bpf_testmod.h"
+#include "bpf_misc.h"
+
+char _license[] SEC("license") = "GPL";
+
+extern void bpf_task_release(struct task_struct *p) __ksym;
+
+__noinline int subprog_release(__u64 *ctx __arg_ctx)
+{
+ struct task_struct *task = (struct task_struct *)ctx[1];
+ int dummy = (int)ctx[0];
+
+ bpf_task_release(task);
+
+ return dummy + 1;
+}
+
+/* Test that the verifier rejects a program that contains a global
+ * subprogram with referenced kptr arguments
+ */
+SEC("struct_ops/test_refcounted")
+__failure __log_level(2)
+__msg("Validating subprog_release() func#1...")
+__msg("invalid bpf_context access off=8. Reference may already be released")
+int refcounted_fail__global_subprog(unsigned long long *ctx)
+{
+ struct task_struct *task = (struct task_struct *)ctx[1];
+
+ bpf_task_release(task);
+
+ return subprog_release(ctx);
+}
+
+SEC(".struct_ops.link")
+struct bpf_testmod_ops testmod_ref_acquire = {
+ .test_refcounted = (void *)refcounted_fail__global_subprog,
+};
diff --git a/tools/testing/selftests/bpf/progs/struct_ops_refcounted_fail__ref_leak.c b/tools/testing/selftests/bpf/progs/struct_ops_refcounted_fail__ref_leak.c
new file mode 100644
index 000000000000..e945b1a04294
--- /dev/null
+++ b/tools/testing/selftests/bpf/progs/struct_ops_refcounted_fail__ref_leak.c
@@ -0,0 +1,22 @@
+#include <vmlinux.h>
+#include <bpf/bpf_tracing.h>
+#include "../test_kmods/bpf_testmod.h"
+#include "bpf_misc.h"
+
+char _license[] SEC("license") = "GPL";
+
+/* Test that the verifier rejects a program that acquires a referenced
+ * kptr through context without releasing the reference
+ */
+SEC("struct_ops/test_refcounted")
+__failure __msg("Unreleased reference id=1 alloc_insn=0")
+int BPF_PROG(refcounted_fail__ref_leak, int dummy,
+ struct task_struct *task)
+{
+ return 0;
+}
+
+SEC(".struct_ops.link")
+struct bpf_testmod_ops testmod_ref_acquire = {
+ .test_refcounted = (void *)refcounted_fail__ref_leak,
+};
diff --git a/tools/testing/selftests/bpf/test_kmods/bpf_testmod.c b/tools/testing/selftests/bpf/test_kmods/bpf_testmod.c
index cc9dde507aba..802cbd871035 100644
--- a/tools/testing/selftests/bpf/test_kmods/bpf_testmod.c
+++ b/tools/testing/selftests/bpf/test_kmods/bpf_testmod.c
@@ -1176,10 +1176,17 @@ static int bpf_testmod_ops__test_maybe_null(int dummy,
return 0;
}
+static int bpf_testmod_ops__test_refcounted(int dummy,
+ struct task_struct *task__ref)
+{
+ return 0;
+}
+
static struct bpf_testmod_ops __bpf_testmod_ops = {
.test_1 = bpf_testmod_test_1,
.test_2 = bpf_testmod_test_2,
.test_maybe_null = bpf_testmod_ops__test_maybe_null,
+ .test_refcounted = bpf_testmod_ops__test_refcounted,
};
struct bpf_struct_ops bpf_bpf_testmod_ops = {
diff --git a/tools/testing/selftests/bpf/test_kmods/bpf_testmod.h b/tools/testing/selftests/bpf/test_kmods/bpf_testmod.h
index 356803d1c10e..c57b2f9dab10 100644
--- a/tools/testing/selftests/bpf/test_kmods/bpf_testmod.h
+++ b/tools/testing/selftests/bpf/test_kmods/bpf_testmod.h
@@ -36,6 +36,8 @@ struct bpf_testmod_ops {
/* Used to test nullable arguments. */
int (*test_maybe_null)(int dummy, struct task_struct *task);
int (*unsupported_ops)(void);
+ /* Used to test ref_acquired arguments. */
+ int (*test_refcounted)(int dummy, struct task_struct *task);
/* The following fields are used to test shadow copies. */
char onebyte;
--
2.47.1
next prev parent reply other threads:[~2025-01-31 19:29 UTC|newest]
Thread overview: 33+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-01-31 19:28 [PATCH bpf-next v3 00/18] bpf qdisc Amery Hung
2025-01-31 19:28 ` [PATCH bpf-next v3 01/18] bpf: Make every prog keep a copy of ctx_arg_info Amery Hung
2025-02-04 5:57 ` Eduard Zingerman
2025-01-31 19:28 ` [PATCH bpf-next v3 02/18] bpf: Support getting referenced kptr from struct_ops argument Amery Hung
2025-02-04 5:57 ` Eduard Zingerman
2025-01-31 19:28 ` Amery Hung [this message]
2025-02-04 5:58 ` [PATCH bpf-next v3 03/18] selftests/bpf: Test referenced kptr arguments of struct_ops programs Eduard Zingerman
2025-01-31 19:28 ` [PATCH bpf-next v3 04/18] bpf: Allow struct_ops prog to return referenced kptr Amery Hung
2025-02-04 5:58 ` Eduard Zingerman
2025-01-31 19:28 ` [PATCH bpf-next v3 05/18] selftests/bpf: Test returning referenced kptr from struct_ops programs Amery Hung
2025-02-04 5:58 ` Eduard Zingerman
2025-01-31 19:28 ` [PATCH bpf-next v3 06/18] bpf: Prepare to reuse get_ctx_arg_idx Amery Hung
2025-01-31 19:28 ` [PATCH bpf-next v3 07/18] bpf: Generalize finding member offset of struct_ops prog Amery Hung
2025-02-04 5:59 ` Eduard Zingerman
2025-01-31 19:28 ` [PATCH bpf-next v3 08/18] bpf: net_sched: Support implementation of Qdisc_ops in bpf Amery Hung
2025-02-04 22:18 ` Jakub Kicinski
2025-02-04 23:21 ` Amery Hung
2025-02-05 1:27 ` Jakub Kicinski
2025-02-05 4:13 ` Amery Hung
2025-01-31 19:28 ` [PATCH bpf-next v3 09/18] bpf: net_sched: Add basic bpf qdisc kfuncs Amery Hung
2025-01-31 19:28 ` [PATCH bpf-next v3 10/18] bpf: Search and add kfuncs in struct_ops prologue and epilogue Amery Hung
2025-02-04 5:59 ` Eduard Zingerman
2025-01-31 19:28 ` [PATCH bpf-next v3 11/18] bpf: net_sched: Add a qdisc watchdog timer Amery Hung
2025-01-31 19:28 ` [PATCH bpf-next v3 12/18] bpf: net_sched: Support updating bstats Amery Hung
2025-01-31 19:28 ` [PATCH bpf-next v3 13/18] bpf: net_sched: Support updating qstats Amery Hung
2025-01-31 19:28 ` [PATCH bpf-next v3 14/18] bpf: net_sched: Allow writing to more Qdisc members Amery Hung
2025-01-31 19:28 ` [PATCH bpf-next v3 15/18] libbpf: Support creating and destroying qdisc Amery Hung
2025-01-31 19:28 ` [PATCH bpf-next v3 16/18] selftests/bpf: Add a basic fifo qdisc test Amery Hung
2025-01-31 19:28 ` [PATCH bpf-next v3 17/18] selftests/bpf: Add a bpf fq qdisc to selftest Amery Hung
2025-01-31 19:28 ` [PATCH bpf-next v3 18/18] selftests/bpf: Test attaching bpf qdisc to mq and non root Amery Hung
2025-02-01 0:45 ` Amery Hung
2025-02-04 5:58 ` Eduard Zingerman
2025-02-04 18:17 ` Amery Hung
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20250131192912.133796-4-ameryhung@gmail.com \
--to=ameryhung@gmail.com \
--cc=alexei.starovoitov@gmail.com \
--cc=andrii@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=cong.wang@bytedance.com \
--cc=daniel@iogearbox.net \
--cc=edumazet@google.com \
--cc=ekarani.silvestre@ccc.ufcg.edu.br \
--cc=jhs@mojatatu.com \
--cc=jiri@resnulli.us \
--cc=kernel-team@meta.com \
--cc=kuba@kernel.org \
--cc=martin.lau@kernel.org \
--cc=ming.lei@redhat.com \
--cc=netdev@vger.kernel.org \
--cc=sinquersw@gmail.com \
--cc=stfomichev@gmail.com \
--cc=toke@redhat.com \
--cc=xiyou.wangcong@gmail.com \
--cc=yangpeihao@sjtu.edu.cn \
--cc=yepeilin.cs@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).