From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wm1-f46.google.com (mail-wm1-f46.google.com [209.85.128.46]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 82D5A40F750 for ; Wed, 22 Jul 2026 10:45:06 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.46 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784717108; cv=none; b=WDTk7Gqg5Wk7DYH4H/gl1SIZzgtRqRWSNdwMTwBhtJB3bqGzSmT0MjFkUfm3J8irGGgIYd9S+9MCe67gyDxZf1M4yfdYFmYJK2JKHX+hnOMUGX4jURoWFVC8s1B9Bv4kccgybIyuLL8Go/s+pqdRy1gunPiVvoko4Ic0w++M8d8= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784717108; c=relaxed/simple; bh=fmndcjanViGcYEADoEdhV6jm9+Kn08sQMnFyvTnMC8s=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=T7Wi8MeWW9Fuz33P8EOB8SyFMNzNX3sktvmz/Tj0MPK0ecSWZ/8oeivoQ8cvhl5pzHj/thhg8VfkMevLtHEC1pC27jUZ69fqrXuGmvc00vAkAJbaXQn/SiRVkfjtIZSKtEkq6NWNi3Av+sEZ50d+cU6OCiHcqSMlPuJtlvIx1KE= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=Ff//GPZt; arc=none smtp.client-ip=209.85.128.46 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="Ff//GPZt" Received: by mail-wm1-f46.google.com with SMTP id 5b1f17b1804b1-4954f5e8020so20393355e9.2 for ; Wed, 22 Jul 2026 03:45:06 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1784717105; x=1785321905; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=bXbm3wjsqVGwtNUtH3eqoaK9MP9AOKrO2JGwf5Teq3o=; b=Ff//GPZt5Gj6XaSXRxCsrwQS5miKytkRw7b9aDh3oNYKX0EnUE2GNUQfRoMSf5GhGm zGxa7y8IarI9NUQYfVbtC5yaihSVvsFl9czpdEJujoVDfl/jsZQDA6clg/3178S7Kk2z t5mHutB+FVacBLtqYEe+J0lXUC7D3+dzWsqHkJQxVBnRXmoostYSW+F5w8yPaofMfhYm LOjvsRwNwwdxljItpvJLeymbtLaX3GTArFKdHNUfKBLzWKd0vwwQbbZTcT2NdM8Xhc/l MAj4UQ9jDB1gM/lkbUBIKW7UbGe6GZ12JkkFmN1BmnTNwGYG80iQXciVDzfIw82Tpso1 CKBQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784717105; x=1785321905; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=bXbm3wjsqVGwtNUtH3eqoaK9MP9AOKrO2JGwf5Teq3o=; b=qiSdATRmIAZgtQ1D/n6ncrrHo9+y0l5CcbKYqQLXzU4CoaltV1gbCy/Bl1Ya+//m8+ OoCoUZgJTiWiZ5N5/14RrJVBmvdlLVxQKkw4NTDdARlHI9b0jt+KHBkUijtNPkRd0ZJ/ 6Pq89R+KquZWZJu5r434SlE03Xnp/nBEDlnvpmVsgqr7G4g/rDwWwPjOCwDD8r2L8zyn Z3tvwjB41V4O44+ek/28MNCfX4s58neMf9yQH5hqI692Rmm/eroTijMPe2kEICNG8rUM p8ytSGY/hcaiaMYA+BVB1GVRpisa4t8s1E25ui/u+r5SS95Nt91ZQfccq40nyUUWTavK zLEA== X-Forwarded-Encrypted: i=1; AHgh+Roq3pJeEPWAvYaQp8q5CT7aJfXdhu36iUs9KejheICom3eaW0pLg28D3vVU7IiGQXPSSBexW7E=@vger.kernel.org X-Gm-Message-State: AOJu0Ywyb7pk4EzAjYiIe/0dE5S1w2cTBvi0depVT6MSOszhipqTrYNT Xjm3tIHL6kJLWckQIhjOk9u9Maoyd1+qdNrzq5EfY4AyLQh2/lEJkO+e X-Gm-Gg: AR+sD10gLj5JE5Z53I0EOub1otYaxfgeTD9SxNfClOPnTLcYwEHDxAq396C+w7GY9za ILk3cnjUIEXeOxE5A/j7F07txIiBVGTG20LW3bsfvsanWEhLn/PoYA+zcujIWPc4SyPjKHMOPtx zcPy8NQQB28I+6LXWxzCPceeIZzf4GOiF8qg+VwYI/iyZ0URhm0e6a/RRzR6w020tjFJywkemiv ogBTU9hzafSUcDQyB2dmVI48Au4rTYkDq8f6r6ZdrJWpl0mT4zkFE+JiZm0kJ2Gf3Rdvdz9c+OF 83IEg/7CF4c2y7CfDyqhLfcQxJgn7FHZ8CMUbQvpVNA/Rg6i58ZREt6tv2UcP7xPyWZlQ7+Dh/W kFGRWAfnQkW0e9OPtDx/75/GEZIaIUhRB2rufBMxbZgph6eBaEeRhvf02jj5KLaSCIjZPE0gtbJ CIoTdfQ6HU4lxaBjCtR6hTHygnbhYHhUMLLogiwMneOoRfjjs= X-Received: by 2002:a05:600c:1554:b0:495:3de8:33a6 with SMTP id 5b1f17b1804b1-4954a3dc7bcmr285551285e9.16.1784717104528; Wed, 22 Jul 2026 03:45:04 -0700 (PDT) Received: from mtardy-friendly-lvh-runner.europe-west1-c.c.cilium-dev.internal ([2600:1900:4010:1a8::]) by smtp.googlemail.com with ESMTPSA id 5b1f17b1804b1-4956a509901sm111090575e9.8.2026.07.22.03.45.04 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 22 Jul 2026 03:45:04 -0700 (PDT) From: Mahe Tardy To: bpf@vger.kernel.org Cc: andrew+netdev@lunn.ch, andrii@kernel.org, ast@kernel.org, daniel@iogearbox.net, davem@davemloft.net, eddyz87@gmail.com, edumazet@google.com, john.fastabend@gmail.com, kuba@kernel.org, liamwisehart@meta.com, martin.lau@linux.dev, pabeni@redhat.com, song@kernel.org, netdev@vger.kernel.org, sdf.kernel@gmail.com, ameryhung@gmail.com, kuniyu@google.com, Mahe Tardy Subject: [PATCH bpf-next v2 5/5] selftests/bpf: Add ksock test for async callback guard Date: Wed, 22 Jul 2026 10:44:54 +0000 Message-Id: <20260722104454.165911-6-mahe.tardy@gmail.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20260722104454.165911-1-mahe.tardy@gmail.com> References: <20260722104454.165911-1-mahe.tardy@gmail.com> Precedence: bulk X-Mailing-List: netdev@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Because the kfuncs are going through LSM hooks, allowing their use via workqueue callbacks would expose the wrong credentials. This test ensures the kfunc are preventing any use from these contexts. Signed-off-by: Mahe Tardy --- .../selftests/bpf/prog_tests/ksock_wq.c | 34 ++++++++++ tools/testing/selftests/bpf/progs/ksock_wq.c | 62 +++++++++++++++++++ 2 files changed, 96 insertions(+) create mode 100644 tools/testing/selftests/bpf/prog_tests/ksock_wq.c create mode 100644 tools/testing/selftests/bpf/progs/ksock_wq.c diff --git a/tools/testing/selftests/bpf/prog_tests/ksock_wq.c b/tools/testing/selftests/bpf/prog_tests/ksock_wq.c new file mode 100644 index 000000000000..184b134f3823 --- /dev/null +++ b/tools/testing/selftests/bpf/prog_tests/ksock_wq.c @@ -0,0 +1,34 @@ +// SPDX-License-Identifier: GPL-2.0 +/* Copyright (c) 2026 Isovalent */ + +#include + +#include "test_progs.h" +#include "ksock_wq.skel.h" + +void test_ksock_wq(void) +{ + LIBBPF_OPTS(bpf_test_run_opts, opts); + struct ksock_wq *skel; + int err; + + skel = ksock_wq__open_and_load(); + if (!ASSERT_OK_PTR(skel, "ksock_wq open and load")) + return; + + err = bpf_prog_test_run_opts(bpf_program__fd(skel->progs.ksock_wq_start), + &opts); + if (!ASSERT_OK(err, "run ksock_wq_start")) + goto out; + if (!ASSERT_OK(opts.retval, "ksock_wq_start retval")) + goto out; + + while (!__atomic_load_n(&skel->bss->callback_done, __ATOMIC_ACQUIRE)) + usleep(1000); + + ASSERT_EQ(skel->bss->create_err, -EOPNOTSUPP, + "workqueue create rejected"); + +out: + ksock_wq__destroy(skel); +} diff --git a/tools/testing/selftests/bpf/progs/ksock_wq.c b/tools/testing/selftests/bpf/progs/ksock_wq.c new file mode 100644 index 000000000000..16a1873d132e --- /dev/null +++ b/tools/testing/selftests/bpf/progs/ksock_wq.c @@ -0,0 +1,62 @@ +// SPDX-License-Identifier: GPL-2.0 +/* Copyright (c) 2026 Isovalent */ + +#include "vmlinux.h" +#include +#include "bpf_experimental.h" +#include "bpf_tracing_net.h" +#include "errno.h" +#include "ksock_common.h" + +struct ksock_wq_value { + struct bpf_wq work; +}; + +struct { + __uint(type, BPF_MAP_TYPE_ARRAY); + __uint(max_entries, 1); + __type(key, u32); + __type(value, struct ksock_wq_value); +} work_map SEC(".maps"); + +int create_err; +u32 callback_done; + +static int ksock_wq_callback(void *map, int *key, void *value) +{ + struct bpf_ksock_create_opts opts = { + .family = AF_INET, + .type = SOCK_DGRAM, + .protocol = IPPROTO_UDP, + }; + struct bpf_ksock *ks; + int err = 0; + + ks = bpf_ksock_create(&opts, sizeof(opts), &err); + if (ks) + bpf_ksock_release(ks); + create_err = err; + __sync_fetch_and_add(&callback_done, 1); + return 0; +} + +SEC("syscall") +int ksock_wq_start(void *ctx) +{ + struct ksock_wq_value *value; + u32 key = 0; + int err; + + value = bpf_map_lookup_elem(&work_map, &key); + if (!value) + return -ENOENT; + err = bpf_wq_init(&value->work, &work_map, 0); + if (err) + return err; + err = bpf_wq_set_callback(&value->work, ksock_wq_callback, 0); + if (err) + return err; + return bpf_wq_start(&value->work, 0); +} + +char __license[] SEC("license") = "GPL"; -- 2.34.1