From: Kumar Kartikeya Dwivedi <memxor@gmail.com>
To: Alexei Starovoitov <alexei.starovoitov@gmail.com>
Cc: bpf@vger.kernel.org, "Alexei Starovoitov" <ast@kernel.org>,
"Daniel Borkmann" <daniel@iogearbox.net>,
"Andrii Nakryiko" <andrii@kernel.org>,
netdev@vger.kernel.org, netfilter-devel@vger.kernel.org,
"Martin KaFai Lau" <kafai@fb.com>,
"Song Liu" <songliubraving@fb.com>, "Yonghong Song" <yhs@fb.com>,
"John Fastabend" <john.fastabend@gmail.com>,
"Maxim Mikityanskiy" <maximmi@nvidia.com>,
"Pablo Neira Ayuso" <pablo@netfilter.org>,
"Florian Westphal" <fw@strlen.de>,
"Jesper Dangaard Brouer" <brouer@redhat.com>,
"Toke Høiland-Jørgensen" <toke@redhat.com>
Subject: Re: [PATCH bpf-next v6 11/11] selftests/bpf: Add test for race in btf_try_get_module
Date: Thu, 6 Jan 2022 14:34:00 +0530 [thread overview]
Message-ID: <20220106090400.6p34bempgv2wzocj@apollo.legion> (raw)
In-Reply-To: <20220105062033.lufu57xhpyou3sie@ast-mbp.dhcp.thefacebook.com>
On Wed, Jan 05, 2022 at 11:50:33AM IST, Alexei Starovoitov wrote:
> On Sun, Jan 02, 2022 at 09:51:15PM +0530, Kumar Kartikeya Dwivedi wrote:
> > This adds a complete test case to ensure we never take references to
> > modules not in MODULE_STATE_LIVE, which can lead to UAF, and it also
> > ensures we never access btf->kfunc_set_tab in an inconsistent state.
> >
> > The test uses userfaultfd to artifically widen the race.
>
> Fancy!
> Does it have to use a different module?
> Can it be part of bpf_testmod somehow?
I was thinking of doing it with bpf_testmod, but then I realised it would be a
problem with parallel mode of test_progs, where another selftest in parallel may
rely on bpf_testmod (which this test would unload, load and make it fault, and
then fail the load before restoring it by loading again), so I went with
bpf_testmod.
Maybe we can hardcode a list of tests to be executed serially in --workers=n > 1
mode? All serial tests are then executed in the beginning (or end), and then it
starts invoking others in parallel as usual.
--
Kartikeya
next prev parent reply other threads:[~2022-01-06 9:04 UTC|newest]
Thread overview: 24+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-01-02 16:21 [PATCH bpf-next v6 00/11] Introduce unstable CT lookup helpers Kumar Kartikeya Dwivedi
2022-01-02 16:21 ` [PATCH bpf-next v6 01/11] kernel: Implement try_module_get_live Kumar Kartikeya Dwivedi
2022-01-25 18:50 ` Luis Chamberlain
2022-01-02 16:21 ` [PATCH bpf-next v6 02/11] bpf: Fix UAF due to race between btf_try_get_module and load_module Kumar Kartikeya Dwivedi
2022-01-05 6:10 ` Alexei Starovoitov
2022-01-06 8:46 ` Kumar Kartikeya Dwivedi
2022-01-02 16:21 ` [PATCH bpf-next v6 03/11] bpf: Populate kfunc BTF ID sets in struct btf Kumar Kartikeya Dwivedi
2022-01-05 6:19 ` Alexei Starovoitov
2022-01-06 8:59 ` Kumar Kartikeya Dwivedi
2022-01-06 23:40 ` Alexei Starovoitov
2022-01-07 6:26 ` Kumar Kartikeya Dwivedi
2022-01-02 16:21 ` [PATCH bpf-next v6 04/11] bpf: Remove check_kfunc_call callback and old kfunc BTF ID API Kumar Kartikeya Dwivedi
2022-01-02 16:21 ` [PATCH bpf-next v6 05/11] bpf: Introduce mem, size argument pair support for kfunc Kumar Kartikeya Dwivedi
2022-01-02 16:21 ` [PATCH bpf-next v6 06/11] bpf: Add reference tracking support to kfunc Kumar Kartikeya Dwivedi
2022-01-02 16:21 ` [PATCH bpf-next v6 07/11] net/netfilter: Add unstable CT lookup helpers for XDP and TC-BPF Kumar Kartikeya Dwivedi
2022-01-02 16:21 ` [PATCH bpf-next v6 08/11] selftests/bpf: Add test for unstable CT lookup API Kumar Kartikeya Dwivedi
2022-01-02 16:21 ` [PATCH bpf-next v6 09/11] selftests/bpf: Add test_verifier support to fixup kfunc call insns Kumar Kartikeya Dwivedi
2022-01-02 16:21 ` [PATCH bpf-next v6 10/11] selftests/bpf: Extend kfunc selftests Kumar Kartikeya Dwivedi
2022-01-02 16:21 ` [PATCH bpf-next v6 11/11] selftests/bpf: Add test for race in btf_try_get_module Kumar Kartikeya Dwivedi
2022-01-05 6:20 ` Alexei Starovoitov
2022-01-06 9:04 ` Kumar Kartikeya Dwivedi [this message]
2022-01-06 19:39 ` Andrii Nakryiko
2022-01-07 7:22 ` Kumar Kartikeya Dwivedi
2022-01-07 20:10 ` Andrii Nakryiko
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20220106090400.6p34bempgv2wzocj@apollo.legion \
--to=memxor@gmail.com \
--cc=alexei.starovoitov@gmail.com \
--cc=andrii@kernel.org \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=brouer@redhat.com \
--cc=daniel@iogearbox.net \
--cc=fw@strlen.de \
--cc=john.fastabend@gmail.com \
--cc=kafai@fb.com \
--cc=maximmi@nvidia.com \
--cc=netdev@vger.kernel.org \
--cc=netfilter-devel@vger.kernel.org \
--cc=pablo@netfilter.org \
--cc=songliubraving@fb.com \
--cc=toke@redhat.com \
--cc=yhs@fb.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).