From mboxrd@z Thu Jan 1 00:00:00 1970 From: Song Liu Subject: Re: [PATCH v3 bpf-next 2/2] bpf: add tests for direct packet access from CGROUP_SKB Date: Thu, 18 Oct 2018 06:53:38 +0000 Message-ID: References: <20181018053949.4064426-1-songliubraving@fb.com> <20181018053949.4064426-3-songliubraving@fb.com> <20181018062557.zyeoiker7jigcv6q@ast-mbp.dhcp.thefacebook.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Cc: "netdev@vger.kernel.org" , "ast@kernel.org" , "daniel@iogearbox.net" , Kernel Team To: Alexei Starovoitov Return-path: Received: from mx0a-00082601.pphosted.com ([67.231.145.42]:51396 "EHLO mx0a-00082601.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727337AbeJROxy (ORCPT ); Thu, 18 Oct 2018 10:53:54 -0400 In-Reply-To: <20181018062557.zyeoiker7jigcv6q@ast-mbp.dhcp.thefacebook.com> Content-Language: en-US Content-ID: <36408698BF173D49AA43E9C18EEECBC6@namprd15.prod.outlook.com> Sender: netdev-owner@vger.kernel.org List-ID: > On Oct 17, 2018, at 11:25 PM, Alexei Starovoitov wrote: >=20 > On Wed, Oct 17, 2018 at 10:39:49PM -0700, Song Liu wrote: >> Tests are added to make sure CGROUP_SKB cannot access: >> tc_classid, data_meta, flow_keys >>=20 >> and can read and write: >> mark, prority, and cb[0-4] >>=20 >> and can read other fields. >>=20 >> To make selftest with skb->sk work, a dummy sk is added in >> bpf_prog_test_run_skb(). >>=20 >> Signed-off-by: Song Liu >> --- >> net/bpf/test_run.c | 4 + >> tools/testing/selftests/bpf/test_verifier.c | 170 ++++++++++++++++++++ >> 2 files changed, 174 insertions(+) >>=20 >> diff --git a/net/bpf/test_run.c b/net/bpf/test_run.c >> index 0c423b8cd75c..c7210e2f1ae9 100644 >> --- a/net/bpf/test_run.c >> +++ b/net/bpf/test_run.c >> @@ -10,6 +10,7 @@ >> #include >> #include >> #include >> +#include >>=20 >> static __always_inline u32 bpf_test_run_one(struct bpf_prog *prog, void = *ctx, >> struct bpf_cgroup_storage *storage[MAX_BPF_CGROUP_STORAGE_TYPE]) >> @@ -115,6 +116,7 @@ int bpf_prog_test_run_skb(struct bpf_prog *prog, con= st union bpf_attr *kattr, >> u32 retval, duration; >> int hh_len =3D ETH_HLEN; >> struct sk_buff *skb; >> + struct sock sk; >> void *data; >> int ret; >>=20 >> @@ -142,6 +144,8 @@ int bpf_prog_test_run_skb(struct bpf_prog *prog, con= st union bpf_attr *kattr, >> kfree(data); >> return -ENOMEM; >> } >> + sock_init_data(NULL, &sk); >> + skb->sk =3D &sk; >=20 > I was about to apply it, but it crashes as: > [ 16.830822] BUG: unable to handle kernel paging request at 00000001442= 7b974 > [ 16.831363] PGD 8000000135ecf067 P4D 8000000135ecf067 PUD 0 > [ 16.831792] Oops: 0000 [#1] SMP PTI > [ 16.832061] CPU: 1 PID: 1965 Comm: test_verifier Not tainted 4.19.0-rc= 7-02550-ga76dee97ff12 #1153 > [ 16.832712] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIO= S 1.11.0-2.el7 04/01/2014 > [ 16.833358] RIP: 0010:cmp_map_id+0x10/0x50 > [ 16.835036] RSP: 0018:ffffc9000080faf8 EFLAGS: 00010246 > [ 16.835429] RAX: 00000000ffffffff RBX: 0000000036069ee8 RCX: 000000000= 0000000 > [ 16.835958] RDX: 000000014427b970 RSI: 000000014427b970 RDI: ffffc9000= 080fb44 > [ 16.836496] RBP: 000000000000000c R08: ffffffff810f7330 R09: 000000003= 6069ee8 > [ 16.837026] R10: 0000000000000000 R11: 0000000000000001 R12: 000000000= 0000000 > [ 16.837554] R13: ffffffff810f7330 R14: 000000014427b970 R15: 000000001= b034f74 > [ 16.838083] FS: 00007fae50663700(0000) GS:ffff88013ba80000(0000) knlG= S:0000000000000000 > [ 16.838677] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > [ 16.839105] CR2: 000000014427b974 CR3: 0000000135934005 CR4: 000000000= 03606e0 > [ 16.839632] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 000000000= 0000000 > [ 16.840157] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 000000000= 0000400 > [ 16.840682] Call Trace: > [ 16.840897] bsearch+0x50/0x90 > [ 16.841144] map_id_range_down+0x81/0xa0 > [ 16.841438] make_kuid+0xf/0x10 > [ 16.841677] sock_init_data+0x24f/0x260 > [ 16.841979] bpf_prog_test_run_skb+0x9e/0x270 >=20 > I suspect sock_net_set(sk, &init_net) is necessary before sock_init_data(= ) call. I am not able to repro this, even with CONFIG_KASAN and CONFIG_PAGE_POISONI= NG.=20 Let me try a better approach on this. Thanks, Song