12852f8e0f
With latest llvm17, dynptr/test_dynptr_is_null subtest failed in my testing
VM. The failure log looks like below:
All error logs:
tester_init:PASS:tester_log_buf 0 nsec
process_subtest:PASS:obj_open_mem 0 nsec
process_subtest:PASS:Can't alloc specs array 0 nsec
verify_success:PASS:dynptr_success__open 0 nsec
verify_success:PASS:bpf_object__find_program_by_name 0 nsec
verify_success:PASS:dynptr_success__load 0 nsec
verify_success:PASS:bpf_program__attach 0 nsec
verify_success:FAIL:err unexpected err: actual 4 != expected 0
#65/9 dynptr/test_dynptr_is_null:FAIL
The error happens for bpf prog test_dynptr_is_null in dynptr_success.c:
if (bpf_dynptr_is_null(&ptr2)) {
err = 4;
goto exit;
}
The bpf_dynptr_is_null(&ptr) unexpectedly returned a non-zero value and
the control went to the error path. Digging further, I found the root cause
is due to function signature difference between kernel and user space.
In kernel, we have ...
__bpf_kfunc bool bpf_dynptr_is_null(struct bpf_dynptr_kern *ptr)
... while in bpf_kfuncs.h we have:
extern int bpf_dynptr_is_null(const struct bpf_dynptr *ptr) __ksym;
The kernel bpf_dynptr_is_null disasm code:
ffffffff812f1a90 <bpf_dynptr_is_null>:
ffffffff812f1a90: f3 0f 1e fa endbr64
ffffffff812f1a94: 0f 1f 44 00 00 nopl (%rax,%rax)
ffffffff812f1a99: 53 pushq %rbx
ffffffff812f1a9a: 48 89 fb movq %rdi, %rbx
ffffffff812f1a9d: e8 ae 29 17 00 callq 0xffffffff81464450 <__asan_load8_noabort>
ffffffff812f1aa2: 48 83 3b 00 cmpq $0x0, (%rbx)
ffffffff812f1aa6: 0f 94 c0 sete %al
ffffffff812f1aa9: 5b popq %rbx
ffffffff812f1aaa: c3 retq
Note that only 1-byte register %al is set and the other 7-bytes are not
touched. In bpf program, the asm code for the above bpf_dynptr_is_null(&ptr2):
266: 85 10 00 00 ff ff ff ff call -0x1
267: b4 01 00 00 04 00 00 00 w1 = 0x4
268: 16 00 03 00 00 00 00 00 if w0 == 0x0 goto +0x3 <LBB9_8>
Basically, 4-byte subregister is tested. This might cause error as the value
other than the lowest byte might not be 0.
This patch fixed the issue by using the identical func prototype across kernel
and selftest user space. The fixed bpf asm code:
267: 85 10 00 00 ff ff ff ff call -0x1
268: 54 00 00 00 01 00 00 00 w0 &= 0x1
269: b4 01 00 00 04 00 00 00 w1 = 0x4
270: 16 00 03 00 00 00 00 00 if w0 == 0x0 goto +0x3 <LBB9_8>
Signed-off-by: Yonghong Song <yhs@fb.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/bpf/20230517040404.4023912-1-yhs@fb.com
1688 lines
35 KiB
C
1688 lines
35 KiB
C
// SPDX-License-Identifier: GPL-2.0
|
|
/* Copyright (c) 2022 Facebook */
|
|
|
|
#include <errno.h>
|
|
#include <string.h>
|
|
#include <stdbool.h>
|
|
#include <linux/bpf.h>
|
|
#include <bpf/bpf_helpers.h>
|
|
#include <linux/if_ether.h>
|
|
#include "bpf_misc.h"
|
|
#include "bpf_kfuncs.h"
|
|
|
|
char _license[] SEC("license") = "GPL";
|
|
|
|
struct test_info {
|
|
int x;
|
|
struct bpf_dynptr ptr;
|
|
};
|
|
|
|
struct {
|
|
__uint(type, BPF_MAP_TYPE_ARRAY);
|
|
__uint(max_entries, 1);
|
|
__type(key, __u32);
|
|
__type(value, struct bpf_dynptr);
|
|
} array_map1 SEC(".maps");
|
|
|
|
struct {
|
|
__uint(type, BPF_MAP_TYPE_ARRAY);
|
|
__uint(max_entries, 1);
|
|
__type(key, __u32);
|
|
__type(value, struct test_info);
|
|
} array_map2 SEC(".maps");
|
|
|
|
struct {
|
|
__uint(type, BPF_MAP_TYPE_ARRAY);
|
|
__uint(max_entries, 1);
|
|
__type(key, __u32);
|
|
__type(value, __u32);
|
|
} array_map3 SEC(".maps");
|
|
|
|
struct {
|
|
__uint(type, BPF_MAP_TYPE_ARRAY);
|
|
__uint(max_entries, 1);
|
|
__type(key, __u32);
|
|
__type(value, __u64);
|
|
} array_map4 SEC(".maps");
|
|
|
|
struct sample {
|
|
int pid;
|
|
long value;
|
|
char comm[16];
|
|
};
|
|
|
|
struct {
|
|
__uint(type, BPF_MAP_TYPE_RINGBUF);
|
|
__uint(max_entries, 4096);
|
|
} ringbuf SEC(".maps");
|
|
|
|
int err, val;
|
|
|
|
static int get_map_val_dynptr(struct bpf_dynptr *ptr)
|
|
{
|
|
__u32 key = 0, *map_val;
|
|
|
|
bpf_map_update_elem(&array_map3, &key, &val, 0);
|
|
|
|
map_val = bpf_map_lookup_elem(&array_map3, &key);
|
|
if (!map_val)
|
|
return -ENOENT;
|
|
|
|
bpf_dynptr_from_mem(map_val, sizeof(*map_val), 0, ptr);
|
|
|
|
return 0;
|
|
}
|
|
|
|
/* Every bpf_ringbuf_reserve_dynptr call must have a corresponding
|
|
* bpf_ringbuf_submit/discard_dynptr call
|
|
*/
|
|
SEC("?raw_tp")
|
|
__failure __msg("Unreleased reference id=2")
|
|
int ringbuf_missing_release1(void *ctx)
|
|
{
|
|
struct bpf_dynptr ptr;
|
|
|
|
bpf_ringbuf_reserve_dynptr(&ringbuf, val, 0, &ptr);
|
|
|
|
/* missing a call to bpf_ringbuf_discard/submit_dynptr */
|
|
|
|
return 0;
|
|
}
|
|
|
|
SEC("?raw_tp")
|
|
__failure __msg("Unreleased reference id=4")
|
|
int ringbuf_missing_release2(void *ctx)
|
|
{
|
|
struct bpf_dynptr ptr1, ptr2;
|
|
struct sample *sample;
|
|
|
|
bpf_ringbuf_reserve_dynptr(&ringbuf, sizeof(*sample), 0, &ptr1);
|
|
bpf_ringbuf_reserve_dynptr(&ringbuf, sizeof(*sample), 0, &ptr2);
|
|
|
|
sample = bpf_dynptr_data(&ptr1, 0, sizeof(*sample));
|
|
if (!sample) {
|
|
bpf_ringbuf_discard_dynptr(&ptr1, 0);
|
|
bpf_ringbuf_discard_dynptr(&ptr2, 0);
|
|
return 0;
|
|
}
|
|
|
|
bpf_ringbuf_submit_dynptr(&ptr1, 0);
|
|
|
|
/* missing a call to bpf_ringbuf_discard/submit_dynptr on ptr2 */
|
|
|
|
return 0;
|
|
}
|
|
|
|
static int missing_release_callback_fn(__u32 index, void *data)
|
|
{
|
|
struct bpf_dynptr ptr;
|
|
|
|
bpf_ringbuf_reserve_dynptr(&ringbuf, val, 0, &ptr);
|
|
|
|
/* missing a call to bpf_ringbuf_discard/submit_dynptr */
|
|
|
|
return 0;
|
|
}
|
|
|
|
/* Any dynptr initialized within a callback must have bpf_dynptr_put called */
|
|
SEC("?raw_tp")
|
|
__failure __msg("Unreleased reference id")
|
|
int ringbuf_missing_release_callback(void *ctx)
|
|
{
|
|
bpf_loop(10, missing_release_callback_fn, NULL, 0);
|
|
return 0;
|
|
}
|
|
|
|
/* Can't call bpf_ringbuf_submit/discard_dynptr on a non-initialized dynptr */
|
|
SEC("?raw_tp")
|
|
__failure __msg("arg 1 is an unacquired reference")
|
|
int ringbuf_release_uninit_dynptr(void *ctx)
|
|
{
|
|
struct bpf_dynptr ptr;
|
|
|
|
/* this should fail */
|
|
bpf_ringbuf_submit_dynptr(&ptr, 0);
|
|
|
|
return 0;
|
|
}
|
|
|
|
/* A dynptr can't be used after it has been invalidated */
|
|
SEC("?raw_tp")
|
|
__failure __msg("Expected an initialized dynptr as arg #3")
|
|
int use_after_invalid(void *ctx)
|
|
{
|
|
struct bpf_dynptr ptr;
|
|
char read_data[64];
|
|
|
|
bpf_ringbuf_reserve_dynptr(&ringbuf, sizeof(read_data), 0, &ptr);
|
|
|
|
bpf_dynptr_read(read_data, sizeof(read_data), &ptr, 0, 0);
|
|
|
|
bpf_ringbuf_submit_dynptr(&ptr, 0);
|
|
|
|
/* this should fail */
|
|
bpf_dynptr_read(read_data, sizeof(read_data), &ptr, 0, 0);
|
|
|
|
return 0;
|
|
}
|
|
|
|
/* Can't call non-dynptr ringbuf APIs on a dynptr ringbuf sample */
|
|
SEC("?raw_tp")
|
|
__failure __msg("type=mem expected=ringbuf_mem")
|
|
int ringbuf_invalid_api(void *ctx)
|
|
{
|
|
struct bpf_dynptr ptr;
|
|
struct sample *sample;
|
|
|
|
bpf_ringbuf_reserve_dynptr(&ringbuf, sizeof(*sample), 0, &ptr);
|
|
sample = bpf_dynptr_data(&ptr, 0, sizeof(*sample));
|
|
if (!sample)
|
|
goto done;
|
|
|
|
sample->pid = 123;
|
|
|
|
/* invalid API use. need to use dynptr API to submit/discard */
|
|
bpf_ringbuf_submit(sample, 0);
|
|
|
|
done:
|
|
bpf_ringbuf_discard_dynptr(&ptr, 0);
|
|
return 0;
|
|
}
|
|
|
|
/* Can't add a dynptr to a map */
|
|
SEC("?raw_tp")
|
|
__failure __msg("invalid indirect read from stack")
|
|
int add_dynptr_to_map1(void *ctx)
|
|
{
|
|
struct bpf_dynptr ptr;
|
|
int key = 0;
|
|
|
|
bpf_ringbuf_reserve_dynptr(&ringbuf, val, 0, &ptr);
|
|
|
|
/* this should fail */
|
|
bpf_map_update_elem(&array_map1, &key, &ptr, 0);
|
|
|
|
bpf_ringbuf_submit_dynptr(&ptr, 0);
|
|
|
|
return 0;
|
|
}
|
|
|
|
/* Can't add a struct with an embedded dynptr to a map */
|
|
SEC("?raw_tp")
|
|
__failure __msg("invalid indirect read from stack")
|
|
int add_dynptr_to_map2(void *ctx)
|
|
{
|
|
struct test_info x;
|
|
int key = 0;
|
|
|
|
bpf_ringbuf_reserve_dynptr(&ringbuf, val, 0, &x.ptr);
|
|
|
|
/* this should fail */
|
|
bpf_map_update_elem(&array_map2, &key, &x, 0);
|
|
|
|
bpf_ringbuf_submit_dynptr(&x.ptr, 0);
|
|
|
|
return 0;
|
|
}
|
|
|
|
/* A data slice can't be accessed out of bounds */
|
|
SEC("?raw_tp")
|
|
__failure __msg("value is outside of the allowed memory range")
|
|
int data_slice_out_of_bounds_ringbuf(void *ctx)
|
|
{
|
|
struct bpf_dynptr ptr;
|
|
void *data;
|
|
|
|
bpf_ringbuf_reserve_dynptr(&ringbuf, 8, 0, &ptr);
|
|
|
|
data = bpf_dynptr_data(&ptr, 0, 8);
|
|
if (!data)
|
|
goto done;
|
|
|
|
/* can't index out of bounds of the data slice */
|
|
val = *((char *)data + 8);
|
|
|
|
done:
|
|
bpf_ringbuf_submit_dynptr(&ptr, 0);
|
|
return 0;
|
|
}
|
|
|
|
/* A data slice can't be accessed out of bounds */
|
|
SEC("?tc")
|
|
__failure __msg("value is outside of the allowed memory range")
|
|
int data_slice_out_of_bounds_skb(struct __sk_buff *skb)
|
|
{
|
|
struct bpf_dynptr ptr;
|
|
struct ethhdr *hdr;
|
|
char buffer[sizeof(*hdr)] = {};
|
|
|
|
bpf_dynptr_from_skb(skb, 0, &ptr);
|
|
|
|
hdr = bpf_dynptr_slice_rdwr(&ptr, 0, buffer, sizeof(buffer));
|
|
if (!hdr)
|
|
return SK_DROP;
|
|
|
|
/* this should fail */
|
|
*(__u8*)(hdr + 1) = 1;
|
|
|
|
return SK_PASS;
|
|
}
|
|
|
|
SEC("?raw_tp")
|
|
__failure __msg("value is outside of the allowed memory range")
|
|
int data_slice_out_of_bounds_map_value(void *ctx)
|
|
{
|
|
__u32 map_val;
|
|
struct bpf_dynptr ptr;
|
|
void *data;
|
|
|
|
get_map_val_dynptr(&ptr);
|
|
|
|
data = bpf_dynptr_data(&ptr, 0, sizeof(map_val));
|
|
if (!data)
|
|
return 0;
|
|
|
|
/* can't index out of bounds of the data slice */
|
|
val = *((char *)data + (sizeof(map_val) + 1));
|
|
|
|
return 0;
|
|
}
|
|
|
|
/* A data slice can't be used after it has been released */
|
|
SEC("?raw_tp")
|
|
__failure __msg("invalid mem access 'scalar'")
|
|
int data_slice_use_after_release1(void *ctx)
|
|
{
|
|
struct bpf_dynptr ptr;
|
|
struct sample *sample;
|
|
|
|
bpf_ringbuf_reserve_dynptr(&ringbuf, sizeof(*sample), 0, &ptr);
|
|
sample = bpf_dynptr_data(&ptr, 0, sizeof(*sample));
|
|
if (!sample)
|
|
goto done;
|
|
|
|
sample->pid = 123;
|
|
|
|
bpf_ringbuf_submit_dynptr(&ptr, 0);
|
|
|
|
/* this should fail */
|
|
val = sample->pid;
|
|
|
|
return 0;
|
|
|
|
done:
|
|
bpf_ringbuf_discard_dynptr(&ptr, 0);
|
|
return 0;
|
|
}
|
|
|
|
/* A data slice can't be used after it has been released.
|
|
*
|
|
* This tests the case where the data slice tracks a dynptr (ptr2)
|
|
* that is at a non-zero offset from the frame pointer (ptr1 is at fp,
|
|
* ptr2 is at fp - 16).
|
|
*/
|
|
SEC("?raw_tp")
|
|
__failure __msg("invalid mem access 'scalar'")
|
|
int data_slice_use_after_release2(void *ctx)
|
|
{
|
|
struct bpf_dynptr ptr1, ptr2;
|
|
struct sample *sample;
|
|
|
|
bpf_ringbuf_reserve_dynptr(&ringbuf, 64, 0, &ptr1);
|
|
bpf_ringbuf_reserve_dynptr(&ringbuf, sizeof(*sample), 0, &ptr2);
|
|
|
|
sample = bpf_dynptr_data(&ptr2, 0, sizeof(*sample));
|
|
if (!sample)
|
|
goto done;
|
|
|
|
sample->pid = 23;
|
|
|
|
bpf_ringbuf_submit_dynptr(&ptr2, 0);
|
|
|
|
/* this should fail */
|
|
sample->pid = 23;
|
|
|
|
bpf_ringbuf_submit_dynptr(&ptr1, 0);
|
|
|
|
return 0;
|
|
|
|
done:
|
|
bpf_ringbuf_discard_dynptr(&ptr2, 0);
|
|
bpf_ringbuf_discard_dynptr(&ptr1, 0);
|
|
return 0;
|
|
}
|
|
|
|
/* A data slice must be first checked for NULL */
|
|
SEC("?raw_tp")
|
|
__failure __msg("invalid mem access 'mem_or_null'")
|
|
int data_slice_missing_null_check1(void *ctx)
|
|
{
|
|
struct bpf_dynptr ptr;
|
|
void *data;
|
|
|
|
bpf_ringbuf_reserve_dynptr(&ringbuf, 8, 0, &ptr);
|
|
|
|
data = bpf_dynptr_data(&ptr, 0, 8);
|
|
|
|
/* missing if (!data) check */
|
|
|
|
/* this should fail */
|
|
*(__u8 *)data = 3;
|
|
|
|
bpf_ringbuf_submit_dynptr(&ptr, 0);
|
|
return 0;
|
|
}
|
|
|
|
/* A data slice can't be dereferenced if it wasn't checked for null */
|
|
SEC("?raw_tp")
|
|
__failure __msg("invalid mem access 'mem_or_null'")
|
|
int data_slice_missing_null_check2(void *ctx)
|
|
{
|
|
struct bpf_dynptr ptr;
|
|
__u64 *data1, *data2;
|
|
|
|
bpf_ringbuf_reserve_dynptr(&ringbuf, 16, 0, &ptr);
|
|
|
|
data1 = bpf_dynptr_data(&ptr, 0, 8);
|
|
data2 = bpf_dynptr_data(&ptr, 0, 8);
|
|
if (data1)
|
|
/* this should fail */
|
|
*data2 = 3;
|
|
|
|
bpf_ringbuf_discard_dynptr(&ptr, 0);
|
|
return 0;
|
|
}
|
|
|
|
/* Can't pass in a dynptr as an arg to a helper function that doesn't take in a
|
|
* dynptr argument
|
|
*/
|
|
SEC("?raw_tp")
|
|
__failure __msg("invalid indirect read from stack")
|
|
int invalid_helper1(void *ctx)
|
|
{
|
|
struct bpf_dynptr ptr;
|
|
|
|
get_map_val_dynptr(&ptr);
|
|
|
|
/* this should fail */
|
|
bpf_strncmp((const char *)&ptr, sizeof(ptr), "hello!");
|
|
|
|
return 0;
|
|
}
|
|
|
|
/* A dynptr can't be passed into a helper function at a non-zero offset */
|
|
SEC("?raw_tp")
|
|
__failure __msg("cannot pass in dynptr at an offset=-8")
|
|
int invalid_helper2(void *ctx)
|
|
{
|
|
struct bpf_dynptr ptr;
|
|
char read_data[64];
|
|
|
|
get_map_val_dynptr(&ptr);
|
|
|
|
/* this should fail */
|
|
bpf_dynptr_read(read_data, sizeof(read_data), (void *)&ptr + 8, 0, 0);
|
|
return 0;
|
|
}
|
|
|
|
/* A bpf_dynptr is invalidated if it's been written into */
|
|
SEC("?raw_tp")
|
|
__failure __msg("Expected an initialized dynptr as arg #1")
|
|
int invalid_write1(void *ctx)
|
|
{
|
|
struct bpf_dynptr ptr;
|
|
void *data;
|
|
__u8 x = 0;
|
|
|
|
get_map_val_dynptr(&ptr);
|
|
|
|
memcpy(&ptr, &x, sizeof(x));
|
|
|
|
/* this should fail */
|
|
data = bpf_dynptr_data(&ptr, 0, 1);
|
|
__sink(data);
|
|
|
|
return 0;
|
|
}
|
|
|
|
/*
|
|
* A bpf_dynptr can't be used as a dynptr if it has been written into at a fixed
|
|
* offset
|
|
*/
|
|
SEC("?raw_tp")
|
|
__failure __msg("cannot overwrite referenced dynptr")
|
|
int invalid_write2(void *ctx)
|
|
{
|
|
struct bpf_dynptr ptr;
|
|
char read_data[64];
|
|
__u8 x = 0;
|
|
|
|
bpf_ringbuf_reserve_dynptr(&ringbuf, 64, 0, &ptr);
|
|
|
|
memcpy((void *)&ptr + 8, &x, sizeof(x));
|
|
|
|
/* this should fail */
|
|
bpf_dynptr_read(read_data, sizeof(read_data), &ptr, 0, 0);
|
|
|
|
bpf_ringbuf_submit_dynptr(&ptr, 0);
|
|
|
|
return 0;
|
|
}
|
|
|
|
/*
|
|
* A bpf_dynptr can't be used as a dynptr if it has been written into at a
|
|
* non-const offset
|
|
*/
|
|
SEC("?raw_tp")
|
|
__failure __msg("cannot overwrite referenced dynptr")
|
|
int invalid_write3(void *ctx)
|
|
{
|
|
struct bpf_dynptr ptr;
|
|
char stack_buf[16];
|
|
unsigned long len;
|
|
__u8 x = 0;
|
|
|
|
bpf_ringbuf_reserve_dynptr(&ringbuf, 8, 0, &ptr);
|
|
|
|
memcpy(stack_buf, &val, sizeof(val));
|
|
len = stack_buf[0] & 0xf;
|
|
|
|
memcpy((void *)&ptr + len, &x, sizeof(x));
|
|
|
|
/* this should fail */
|
|
bpf_ringbuf_submit_dynptr(&ptr, 0);
|
|
|
|
return 0;
|
|
}
|
|
|
|
static int invalid_write4_callback(__u32 index, void *data)
|
|
{
|
|
*(__u32 *)data = 123;
|
|
|
|
return 0;
|
|
}
|
|
|
|
/* If the dynptr is written into in a callback function, it should
|
|
* be invalidated as a dynptr
|
|
*/
|
|
SEC("?raw_tp")
|
|
__failure __msg("cannot overwrite referenced dynptr")
|
|
int invalid_write4(void *ctx)
|
|
{
|
|
struct bpf_dynptr ptr;
|
|
|
|
bpf_ringbuf_reserve_dynptr(&ringbuf, 64, 0, &ptr);
|
|
|
|
bpf_loop(10, invalid_write4_callback, &ptr, 0);
|
|
|
|
/* this should fail */
|
|
bpf_ringbuf_submit_dynptr(&ptr, 0);
|
|
|
|
return 0;
|
|
}
|
|
|
|
/* A globally-defined bpf_dynptr can't be used (it must reside as a stack frame) */
|
|
struct bpf_dynptr global_dynptr;
|
|
|
|
SEC("?raw_tp")
|
|
__failure __msg("type=map_value expected=fp")
|
|
int global(void *ctx)
|
|
{
|
|
/* this should fail */
|
|
bpf_ringbuf_reserve_dynptr(&ringbuf, 16, 0, &global_dynptr);
|
|
|
|
bpf_ringbuf_discard_dynptr(&global_dynptr, 0);
|
|
|
|
return 0;
|
|
}
|
|
|
|
/* A direct read should fail */
|
|
SEC("?raw_tp")
|
|
__failure __msg("invalid read from stack")
|
|
int invalid_read1(void *ctx)
|
|
{
|
|
struct bpf_dynptr ptr;
|
|
|
|
bpf_ringbuf_reserve_dynptr(&ringbuf, 64, 0, &ptr);
|
|
|
|
/* this should fail */
|
|
val = *(int *)&ptr;
|
|
|
|
bpf_ringbuf_discard_dynptr(&ptr, 0);
|
|
|
|
return 0;
|
|
}
|
|
|
|
/* A direct read at an offset should fail */
|
|
SEC("?raw_tp")
|
|
__failure __msg("cannot pass in dynptr at an offset")
|
|
int invalid_read2(void *ctx)
|
|
{
|
|
struct bpf_dynptr ptr;
|
|
char read_data[64];
|
|
|
|
get_map_val_dynptr(&ptr);
|
|
|
|
/* this should fail */
|
|
bpf_dynptr_read(read_data, sizeof(read_data), (void *)&ptr + 1, 0, 0);
|
|
|
|
return 0;
|
|
}
|
|
|
|
/* A direct read at an offset into the lower stack slot should fail */
|
|
SEC("?raw_tp")
|
|
__failure __msg("invalid read from stack")
|
|
int invalid_read3(void *ctx)
|
|
{
|
|
struct bpf_dynptr ptr1, ptr2;
|
|
|
|
bpf_ringbuf_reserve_dynptr(&ringbuf, 16, 0, &ptr1);
|
|
bpf_ringbuf_reserve_dynptr(&ringbuf, 16, 0, &ptr2);
|
|
|
|
/* this should fail */
|
|
memcpy(&val, (void *)&ptr1 + 8, sizeof(val));
|
|
|
|
bpf_ringbuf_discard_dynptr(&ptr1, 0);
|
|
bpf_ringbuf_discard_dynptr(&ptr2, 0);
|
|
|
|
return 0;
|
|
}
|
|
|
|
static int invalid_read4_callback(__u32 index, void *data)
|
|
{
|
|
/* this should fail */
|
|
val = *(__u32 *)data;
|
|
|
|
return 0;
|
|
}
|
|
|
|
/* A direct read within a callback function should fail */
|
|
SEC("?raw_tp")
|
|
__failure __msg("invalid read from stack")
|
|
int invalid_read4(void *ctx)
|
|
{
|
|
struct bpf_dynptr ptr;
|
|
|
|
bpf_ringbuf_reserve_dynptr(&ringbuf, 64, 0, &ptr);
|
|
|
|
bpf_loop(10, invalid_read4_callback, &ptr, 0);
|
|
|
|
bpf_ringbuf_submit_dynptr(&ptr, 0);
|
|
|
|
return 0;
|
|
}
|
|
|
|
/* Initializing a dynptr on an offset should fail */
|
|
SEC("?raw_tp")
|
|
__failure __msg("cannot pass in dynptr at an offset=0")
|
|
int invalid_offset(void *ctx)
|
|
{
|
|
struct bpf_dynptr ptr;
|
|
|
|
/* this should fail */
|
|
bpf_ringbuf_reserve_dynptr(&ringbuf, 64, 0, &ptr + 1);
|
|
|
|
bpf_ringbuf_discard_dynptr(&ptr, 0);
|
|
|
|
return 0;
|
|
}
|
|
|
|
/* Can't release a dynptr twice */
|
|
SEC("?raw_tp")
|
|
__failure __msg("arg 1 is an unacquired reference")
|
|
int release_twice(void *ctx)
|
|
{
|
|
struct bpf_dynptr ptr;
|
|
|
|
bpf_ringbuf_reserve_dynptr(&ringbuf, 16, 0, &ptr);
|
|
|
|
bpf_ringbuf_discard_dynptr(&ptr, 0);
|
|
|
|
/* this second release should fail */
|
|
bpf_ringbuf_discard_dynptr(&ptr, 0);
|
|
|
|
return 0;
|
|
}
|
|
|
|
static int release_twice_callback_fn(__u32 index, void *data)
|
|
{
|
|
/* this should fail */
|
|
bpf_ringbuf_discard_dynptr(data, 0);
|
|
|
|
return 0;
|
|
}
|
|
|
|
/* Test that releasing a dynptr twice, where one of the releases happens
|
|
* within a callback function, fails
|
|
*/
|
|
SEC("?raw_tp")
|
|
__failure __msg("arg 1 is an unacquired reference")
|
|
int release_twice_callback(void *ctx)
|
|
{
|
|
struct bpf_dynptr ptr;
|
|
|
|
bpf_ringbuf_reserve_dynptr(&ringbuf, 32, 0, &ptr);
|
|
|
|
bpf_ringbuf_discard_dynptr(&ptr, 0);
|
|
|
|
bpf_loop(10, release_twice_callback_fn, &ptr, 0);
|
|
|
|
return 0;
|
|
}
|
|
|
|
/* Reject unsupported local mem types for dynptr_from_mem API */
|
|
SEC("?raw_tp")
|
|
__failure __msg("Unsupported reg type fp for bpf_dynptr_from_mem data")
|
|
int dynptr_from_mem_invalid_api(void *ctx)
|
|
{
|
|
struct bpf_dynptr ptr;
|
|
int x = 0;
|
|
|
|
/* this should fail */
|
|
bpf_dynptr_from_mem(&x, sizeof(x), 0, &ptr);
|
|
|
|
return 0;
|
|
}
|
|
|
|
SEC("?tc")
|
|
__failure __msg("cannot overwrite referenced dynptr") __log_level(2)
|
|
int dynptr_pruning_overwrite(struct __sk_buff *ctx)
|
|
{
|
|
asm volatile (
|
|
"r9 = 0xeB9F; \
|
|
r6 = %[ringbuf] ll; \
|
|
r1 = r6; \
|
|
r2 = 8; \
|
|
r3 = 0; \
|
|
r4 = r10; \
|
|
r4 += -16; \
|
|
call %[bpf_ringbuf_reserve_dynptr]; \
|
|
if r0 == 0 goto pjmp1; \
|
|
goto pjmp2; \
|
|
pjmp1: \
|
|
*(u64 *)(r10 - 16) = r9; \
|
|
pjmp2: \
|
|
r1 = r10; \
|
|
r1 += -16; \
|
|
r2 = 0; \
|
|
call %[bpf_ringbuf_discard_dynptr]; "
|
|
:
|
|
: __imm(bpf_ringbuf_reserve_dynptr),
|
|
__imm(bpf_ringbuf_discard_dynptr),
|
|
__imm_addr(ringbuf)
|
|
: __clobber_all
|
|
);
|
|
return 0;
|
|
}
|
|
|
|
SEC("?tc")
|
|
__success __msg("12: safe") __log_level(2)
|
|
int dynptr_pruning_stacksafe(struct __sk_buff *ctx)
|
|
{
|
|
asm volatile (
|
|
"r9 = 0xeB9F; \
|
|
r6 = %[ringbuf] ll; \
|
|
r1 = r6; \
|
|
r2 = 8; \
|
|
r3 = 0; \
|
|
r4 = r10; \
|
|
r4 += -16; \
|
|
call %[bpf_ringbuf_reserve_dynptr]; \
|
|
if r0 == 0 goto stjmp1; \
|
|
goto stjmp2; \
|
|
stjmp1: \
|
|
r9 = r9; \
|
|
stjmp2: \
|
|
r1 = r10; \
|
|
r1 += -16; \
|
|
r2 = 0; \
|
|
call %[bpf_ringbuf_discard_dynptr]; "
|
|
:
|
|
: __imm(bpf_ringbuf_reserve_dynptr),
|
|
__imm(bpf_ringbuf_discard_dynptr),
|
|
__imm_addr(ringbuf)
|
|
: __clobber_all
|
|
);
|
|
return 0;
|
|
}
|
|
|
|
SEC("?tc")
|
|
__failure __msg("cannot overwrite referenced dynptr") __log_level(2)
|
|
int dynptr_pruning_type_confusion(struct __sk_buff *ctx)
|
|
{
|
|
asm volatile (
|
|
"r6 = %[array_map4] ll; \
|
|
r7 = %[ringbuf] ll; \
|
|
r1 = r6; \
|
|
r2 = r10; \
|
|
r2 += -8; \
|
|
r9 = 0; \
|
|
*(u64 *)(r2 + 0) = r9; \
|
|
r3 = r10; \
|
|
r3 += -24; \
|
|
r9 = 0xeB9FeB9F; \
|
|
*(u64 *)(r10 - 16) = r9; \
|
|
*(u64 *)(r10 - 24) = r9; \
|
|
r9 = 0; \
|
|
r4 = 0; \
|
|
r8 = r2; \
|
|
call %[bpf_map_update_elem]; \
|
|
r1 = r6; \
|
|
r2 = r8; \
|
|
call %[bpf_map_lookup_elem]; \
|
|
if r0 != 0 goto tjmp1; \
|
|
exit; \
|
|
tjmp1: \
|
|
r8 = r0; \
|
|
r1 = r7; \
|
|
r2 = 8; \
|
|
r3 = 0; \
|
|
r4 = r10; \
|
|
r4 += -16; \
|
|
r0 = *(u64 *)(r0 + 0); \
|
|
call %[bpf_ringbuf_reserve_dynptr]; \
|
|
if r0 == 0 goto tjmp2; \
|
|
r8 = r8; \
|
|
r8 = r8; \
|
|
r8 = r8; \
|
|
r8 = r8; \
|
|
r8 = r8; \
|
|
r8 = r8; \
|
|
r8 = r8; \
|
|
goto tjmp3; \
|
|
tjmp2: \
|
|
*(u64 *)(r10 - 8) = r9; \
|
|
*(u64 *)(r10 - 16) = r9; \
|
|
r1 = r8; \
|
|
r1 += 8; \
|
|
r2 = 0; \
|
|
r3 = 0; \
|
|
r4 = r10; \
|
|
r4 += -16; \
|
|
call %[bpf_dynptr_from_mem]; \
|
|
tjmp3: \
|
|
r1 = r10; \
|
|
r1 += -16; \
|
|
r2 = 0; \
|
|
call %[bpf_ringbuf_discard_dynptr]; "
|
|
:
|
|
: __imm(bpf_map_update_elem),
|
|
__imm(bpf_map_lookup_elem),
|
|
__imm(bpf_ringbuf_reserve_dynptr),
|
|
__imm(bpf_dynptr_from_mem),
|
|
__imm(bpf_ringbuf_discard_dynptr),
|
|
__imm_addr(array_map4),
|
|
__imm_addr(ringbuf)
|
|
: __clobber_all
|
|
);
|
|
return 0;
|
|
}
|
|
|
|
SEC("?tc")
|
|
__failure __msg("dynptr has to be at a constant offset") __log_level(2)
|
|
int dynptr_var_off_overwrite(struct __sk_buff *ctx)
|
|
{
|
|
asm volatile (
|
|
"r9 = 16; \
|
|
*(u32 *)(r10 - 4) = r9; \
|
|
r8 = *(u32 *)(r10 - 4); \
|
|
if r8 >= 0 goto vjmp1; \
|
|
r0 = 1; \
|
|
exit; \
|
|
vjmp1: \
|
|
if r8 <= 16 goto vjmp2; \
|
|
r0 = 1; \
|
|
exit; \
|
|
vjmp2: \
|
|
r8 &= 16; \
|
|
r1 = %[ringbuf] ll; \
|
|
r2 = 8; \
|
|
r3 = 0; \
|
|
r4 = r10; \
|
|
r4 += -32; \
|
|
r4 += r8; \
|
|
call %[bpf_ringbuf_reserve_dynptr]; \
|
|
r9 = 0xeB9F; \
|
|
*(u64 *)(r10 - 16) = r9; \
|
|
r1 = r10; \
|
|
r1 += -32; \
|
|
r1 += r8; \
|
|
r2 = 0; \
|
|
call %[bpf_ringbuf_discard_dynptr]; "
|
|
:
|
|
: __imm(bpf_ringbuf_reserve_dynptr),
|
|
__imm(bpf_ringbuf_discard_dynptr),
|
|
__imm_addr(ringbuf)
|
|
: __clobber_all
|
|
);
|
|
return 0;
|
|
}
|
|
|
|
SEC("?tc")
|
|
__failure __msg("cannot overwrite referenced dynptr") __log_level(2)
|
|
int dynptr_partial_slot_invalidate(struct __sk_buff *ctx)
|
|
{
|
|
asm volatile (
|
|
"r6 = %[ringbuf] ll; \
|
|
r7 = %[array_map4] ll; \
|
|
r1 = r7; \
|
|
r2 = r10; \
|
|
r2 += -8; \
|
|
r9 = 0; \
|
|
*(u64 *)(r2 + 0) = r9; \
|
|
r3 = r2; \
|
|
r4 = 0; \
|
|
r8 = r2; \
|
|
call %[bpf_map_update_elem]; \
|
|
r1 = r7; \
|
|
r2 = r8; \
|
|
call %[bpf_map_lookup_elem]; \
|
|
if r0 != 0 goto sjmp1; \
|
|
exit; \
|
|
sjmp1: \
|
|
r7 = r0; \
|
|
r1 = r6; \
|
|
r2 = 8; \
|
|
r3 = 0; \
|
|
r4 = r10; \
|
|
r4 += -24; \
|
|
call %[bpf_ringbuf_reserve_dynptr]; \
|
|
*(u64 *)(r10 - 16) = r9; \
|
|
r1 = r7; \
|
|
r2 = 8; \
|
|
r3 = 0; \
|
|
r4 = r10; \
|
|
r4 += -16; \
|
|
call %[bpf_dynptr_from_mem]; \
|
|
r1 = r10; \
|
|
r1 += -512; \
|
|
r2 = 488; \
|
|
r3 = r10; \
|
|
r3 += -24; \
|
|
r4 = 0; \
|
|
r5 = 0; \
|
|
call %[bpf_dynptr_read]; \
|
|
r8 = 1; \
|
|
if r0 != 0 goto sjmp2; \
|
|
r8 = 0; \
|
|
sjmp2: \
|
|
r1 = r10; \
|
|
r1 += -24; \
|
|
r2 = 0; \
|
|
call %[bpf_ringbuf_discard_dynptr]; "
|
|
:
|
|
: __imm(bpf_map_update_elem),
|
|
__imm(bpf_map_lookup_elem),
|
|
__imm(bpf_ringbuf_reserve_dynptr),
|
|
__imm(bpf_ringbuf_discard_dynptr),
|
|
__imm(bpf_dynptr_from_mem),
|
|
__imm(bpf_dynptr_read),
|
|
__imm_addr(ringbuf),
|
|
__imm_addr(array_map4)
|
|
: __clobber_all
|
|
);
|
|
return 0;
|
|
}
|
|
|
|
/* Test that it is allowed to overwrite unreferenced dynptr. */
|
|
SEC("?raw_tp")
|
|
__success
|
|
int dynptr_overwrite_unref(void *ctx)
|
|
{
|
|
struct bpf_dynptr ptr;
|
|
|
|
if (get_map_val_dynptr(&ptr))
|
|
return 0;
|
|
if (get_map_val_dynptr(&ptr))
|
|
return 0;
|
|
if (get_map_val_dynptr(&ptr))
|
|
return 0;
|
|
|
|
return 0;
|
|
}
|
|
|
|
/* Test that slices are invalidated on reinitializing a dynptr. */
|
|
SEC("?raw_tp")
|
|
__failure __msg("invalid mem access 'scalar'")
|
|
int dynptr_invalidate_slice_reinit(void *ctx)
|
|
{
|
|
struct bpf_dynptr ptr;
|
|
__u8 *p;
|
|
|
|
if (get_map_val_dynptr(&ptr))
|
|
return 0;
|
|
p = bpf_dynptr_data(&ptr, 0, 1);
|
|
if (!p)
|
|
return 0;
|
|
if (get_map_val_dynptr(&ptr))
|
|
return 0;
|
|
/* this should fail */
|
|
return *p;
|
|
}
|
|
|
|
/* Invalidation of dynptr slices on destruction of dynptr should not miss
|
|
* mem_or_null pointers.
|
|
*/
|
|
SEC("?raw_tp")
|
|
__failure __msg("R1 type=scalar expected=percpu_ptr_")
|
|
int dynptr_invalidate_slice_or_null(void *ctx)
|
|
{
|
|
struct bpf_dynptr ptr;
|
|
__u8 *p;
|
|
|
|
if (get_map_val_dynptr(&ptr))
|
|
return 0;
|
|
|
|
p = bpf_dynptr_data(&ptr, 0, 1);
|
|
*(__u8 *)&ptr = 0;
|
|
/* this should fail */
|
|
bpf_this_cpu_ptr(p);
|
|
return 0;
|
|
}
|
|
|
|
/* Destruction of dynptr should also any slices obtained from it */
|
|
SEC("?raw_tp")
|
|
__failure __msg("R7 invalid mem access 'scalar'")
|
|
int dynptr_invalidate_slice_failure(void *ctx)
|
|
{
|
|
struct bpf_dynptr ptr1;
|
|
struct bpf_dynptr ptr2;
|
|
__u8 *p1, *p2;
|
|
|
|
if (get_map_val_dynptr(&ptr1))
|
|
return 0;
|
|
if (get_map_val_dynptr(&ptr2))
|
|
return 0;
|
|
|
|
p1 = bpf_dynptr_data(&ptr1, 0, 1);
|
|
if (!p1)
|
|
return 0;
|
|
p2 = bpf_dynptr_data(&ptr2, 0, 1);
|
|
if (!p2)
|
|
return 0;
|
|
|
|
*(__u8 *)&ptr1 = 0;
|
|
/* this should fail */
|
|
return *p1;
|
|
}
|
|
|
|
/* Invalidation of slices should be scoped and should not prevent dereferencing
|
|
* slices of another dynptr after destroying unrelated dynptr
|
|
*/
|
|
SEC("?raw_tp")
|
|
__success
|
|
int dynptr_invalidate_slice_success(void *ctx)
|
|
{
|
|
struct bpf_dynptr ptr1;
|
|
struct bpf_dynptr ptr2;
|
|
__u8 *p1, *p2;
|
|
|
|
if (get_map_val_dynptr(&ptr1))
|
|
return 1;
|
|
if (get_map_val_dynptr(&ptr2))
|
|
return 1;
|
|
|
|
p1 = bpf_dynptr_data(&ptr1, 0, 1);
|
|
if (!p1)
|
|
return 1;
|
|
p2 = bpf_dynptr_data(&ptr2, 0, 1);
|
|
if (!p2)
|
|
return 1;
|
|
|
|
*(__u8 *)&ptr1 = 0;
|
|
return *p2;
|
|
}
|
|
|
|
/* Overwriting referenced dynptr should be rejected */
|
|
SEC("?raw_tp")
|
|
__failure __msg("cannot overwrite referenced dynptr")
|
|
int dynptr_overwrite_ref(void *ctx)
|
|
{
|
|
struct bpf_dynptr ptr;
|
|
|
|
bpf_ringbuf_reserve_dynptr(&ringbuf, 64, 0, &ptr);
|
|
/* this should fail */
|
|
if (get_map_val_dynptr(&ptr))
|
|
bpf_ringbuf_discard_dynptr(&ptr, 0);
|
|
return 0;
|
|
}
|
|
|
|
/* Reject writes to dynptr slot from bpf_dynptr_read */
|
|
SEC("?raw_tp")
|
|
__failure __msg("potential write to dynptr at off=-16")
|
|
int dynptr_read_into_slot(void *ctx)
|
|
{
|
|
union {
|
|
struct {
|
|
char _pad[48];
|
|
struct bpf_dynptr ptr;
|
|
};
|
|
char buf[64];
|
|
} data;
|
|
|
|
bpf_ringbuf_reserve_dynptr(&ringbuf, 64, 0, &data.ptr);
|
|
/* this should fail */
|
|
bpf_dynptr_read(data.buf, sizeof(data.buf), &data.ptr, 0, 0);
|
|
|
|
return 0;
|
|
}
|
|
|
|
/* bpf_dynptr_slice()s are read-only and cannot be written to */
|
|
SEC("?tc")
|
|
__failure __msg("R0 cannot write into rdonly_mem")
|
|
int skb_invalid_slice_write(struct __sk_buff *skb)
|
|
{
|
|
struct bpf_dynptr ptr;
|
|
struct ethhdr *hdr;
|
|
char buffer[sizeof(*hdr)] = {};
|
|
|
|
bpf_dynptr_from_skb(skb, 0, &ptr);
|
|
|
|
hdr = bpf_dynptr_slice(&ptr, 0, buffer, sizeof(buffer));
|
|
if (!hdr)
|
|
return SK_DROP;
|
|
|
|
/* this should fail */
|
|
hdr->h_proto = 1;
|
|
|
|
return SK_PASS;
|
|
}
|
|
|
|
/* The read-only data slice is invalidated whenever a helper changes packet data */
|
|
SEC("?tc")
|
|
__failure __msg("invalid mem access 'scalar'")
|
|
int skb_invalid_data_slice1(struct __sk_buff *skb)
|
|
{
|
|
struct bpf_dynptr ptr;
|
|
struct ethhdr *hdr;
|
|
char buffer[sizeof(*hdr)] = {};
|
|
|
|
bpf_dynptr_from_skb(skb, 0, &ptr);
|
|
|
|
hdr = bpf_dynptr_slice(&ptr, 0, buffer, sizeof(buffer));
|
|
if (!hdr)
|
|
return SK_DROP;
|
|
|
|
val = hdr->h_proto;
|
|
|
|
if (bpf_skb_pull_data(skb, skb->len))
|
|
return SK_DROP;
|
|
|
|
/* this should fail */
|
|
val = hdr->h_proto;
|
|
|
|
return SK_PASS;
|
|
}
|
|
|
|
/* The read-write data slice is invalidated whenever a helper changes packet data */
|
|
SEC("?tc")
|
|
__failure __msg("invalid mem access 'scalar'")
|
|
int skb_invalid_data_slice2(struct __sk_buff *skb)
|
|
{
|
|
struct bpf_dynptr ptr;
|
|
struct ethhdr *hdr;
|
|
char buffer[sizeof(*hdr)] = {};
|
|
|
|
bpf_dynptr_from_skb(skb, 0, &ptr);
|
|
|
|
hdr = bpf_dynptr_slice_rdwr(&ptr, 0, buffer, sizeof(buffer));
|
|
if (!hdr)
|
|
return SK_DROP;
|
|
|
|
hdr->h_proto = 123;
|
|
|
|
if (bpf_skb_pull_data(skb, skb->len))
|
|
return SK_DROP;
|
|
|
|
/* this should fail */
|
|
hdr->h_proto = 1;
|
|
|
|
return SK_PASS;
|
|
}
|
|
|
|
/* The read-only data slice is invalidated whenever bpf_dynptr_write() is called */
|
|
SEC("?tc")
|
|
__failure __msg("invalid mem access 'scalar'")
|
|
int skb_invalid_data_slice3(struct __sk_buff *skb)
|
|
{
|
|
char write_data[64] = "hello there, world!!";
|
|
struct bpf_dynptr ptr;
|
|
struct ethhdr *hdr;
|
|
char buffer[sizeof(*hdr)] = {};
|
|
|
|
bpf_dynptr_from_skb(skb, 0, &ptr);
|
|
|
|
hdr = bpf_dynptr_slice(&ptr, 0, buffer, sizeof(buffer));
|
|
if (!hdr)
|
|
return SK_DROP;
|
|
|
|
val = hdr->h_proto;
|
|
|
|
bpf_dynptr_write(&ptr, 0, write_data, sizeof(write_data), 0);
|
|
|
|
/* this should fail */
|
|
val = hdr->h_proto;
|
|
|
|
return SK_PASS;
|
|
}
|
|
|
|
/* The read-write data slice is invalidated whenever bpf_dynptr_write() is called */
|
|
SEC("?tc")
|
|
__failure __msg("invalid mem access 'scalar'")
|
|
int skb_invalid_data_slice4(struct __sk_buff *skb)
|
|
{
|
|
char write_data[64] = "hello there, world!!";
|
|
struct bpf_dynptr ptr;
|
|
struct ethhdr *hdr;
|
|
char buffer[sizeof(*hdr)] = {};
|
|
|
|
bpf_dynptr_from_skb(skb, 0, &ptr);
|
|
hdr = bpf_dynptr_slice_rdwr(&ptr, 0, buffer, sizeof(buffer));
|
|
if (!hdr)
|
|
return SK_DROP;
|
|
|
|
hdr->h_proto = 123;
|
|
|
|
bpf_dynptr_write(&ptr, 0, write_data, sizeof(write_data), 0);
|
|
|
|
/* this should fail */
|
|
hdr->h_proto = 1;
|
|
|
|
return SK_PASS;
|
|
}
|
|
|
|
/* The read-only data slice is invalidated whenever a helper changes packet data */
|
|
SEC("?xdp")
|
|
__failure __msg("invalid mem access 'scalar'")
|
|
int xdp_invalid_data_slice1(struct xdp_md *xdp)
|
|
{
|
|
struct bpf_dynptr ptr;
|
|
struct ethhdr *hdr;
|
|
char buffer[sizeof(*hdr)] = {};
|
|
|
|
bpf_dynptr_from_xdp(xdp, 0, &ptr);
|
|
hdr = bpf_dynptr_slice(&ptr, 0, buffer, sizeof(buffer));
|
|
if (!hdr)
|
|
return SK_DROP;
|
|
|
|
val = hdr->h_proto;
|
|
|
|
if (bpf_xdp_adjust_head(xdp, 0 - (int)sizeof(*hdr)))
|
|
return XDP_DROP;
|
|
|
|
/* this should fail */
|
|
val = hdr->h_proto;
|
|
|
|
return XDP_PASS;
|
|
}
|
|
|
|
/* The read-write data slice is invalidated whenever a helper changes packet data */
|
|
SEC("?xdp")
|
|
__failure __msg("invalid mem access 'scalar'")
|
|
int xdp_invalid_data_slice2(struct xdp_md *xdp)
|
|
{
|
|
struct bpf_dynptr ptr;
|
|
struct ethhdr *hdr;
|
|
char buffer[sizeof(*hdr)] = {};
|
|
|
|
bpf_dynptr_from_xdp(xdp, 0, &ptr);
|
|
hdr = bpf_dynptr_slice_rdwr(&ptr, 0, buffer, sizeof(buffer));
|
|
if (!hdr)
|
|
return SK_DROP;
|
|
|
|
hdr->h_proto = 9;
|
|
|
|
if (bpf_xdp_adjust_head(xdp, 0 - (int)sizeof(*hdr)))
|
|
return XDP_DROP;
|
|
|
|
/* this should fail */
|
|
hdr->h_proto = 1;
|
|
|
|
return XDP_PASS;
|
|
}
|
|
|
|
/* Only supported prog type can create skb-type dynptrs */
|
|
SEC("?raw_tp")
|
|
__failure __msg("calling kernel function bpf_dynptr_from_skb is not allowed")
|
|
int skb_invalid_ctx(void *ctx)
|
|
{
|
|
struct bpf_dynptr ptr;
|
|
|
|
/* this should fail */
|
|
bpf_dynptr_from_skb(ctx, 0, &ptr);
|
|
|
|
return 0;
|
|
}
|
|
|
|
/* Reject writes to dynptr slot for uninit arg */
|
|
SEC("?raw_tp")
|
|
__failure __msg("potential write to dynptr at off=-16")
|
|
int uninit_write_into_slot(void *ctx)
|
|
{
|
|
struct {
|
|
char buf[64];
|
|
struct bpf_dynptr ptr;
|
|
} data;
|
|
|
|
bpf_ringbuf_reserve_dynptr(&ringbuf, 80, 0, &data.ptr);
|
|
/* this should fail */
|
|
bpf_get_current_comm(data.buf, 80);
|
|
|
|
return 0;
|
|
}
|
|
|
|
/* Only supported prog type can create xdp-type dynptrs */
|
|
SEC("?raw_tp")
|
|
__failure __msg("calling kernel function bpf_dynptr_from_xdp is not allowed")
|
|
int xdp_invalid_ctx(void *ctx)
|
|
{
|
|
struct bpf_dynptr ptr;
|
|
|
|
/* this should fail */
|
|
bpf_dynptr_from_xdp(ctx, 0, &ptr);
|
|
|
|
return 0;
|
|
}
|
|
|
|
__u32 hdr_size = sizeof(struct ethhdr);
|
|
/* Can't pass in variable-sized len to bpf_dynptr_slice */
|
|
SEC("?tc")
|
|
__failure __msg("unbounded memory access")
|
|
int dynptr_slice_var_len1(struct __sk_buff *skb)
|
|
{
|
|
struct bpf_dynptr ptr;
|
|
struct ethhdr *hdr;
|
|
char buffer[sizeof(*hdr)] = {};
|
|
|
|
bpf_dynptr_from_skb(skb, 0, &ptr);
|
|
|
|
/* this should fail */
|
|
hdr = bpf_dynptr_slice(&ptr, 0, buffer, hdr_size);
|
|
if (!hdr)
|
|
return SK_DROP;
|
|
|
|
return SK_PASS;
|
|
}
|
|
|
|
/* Can't pass in variable-sized len to bpf_dynptr_slice */
|
|
SEC("?tc")
|
|
__failure __msg("must be a known constant")
|
|
int dynptr_slice_var_len2(struct __sk_buff *skb)
|
|
{
|
|
char buffer[sizeof(struct ethhdr)] = {};
|
|
struct bpf_dynptr ptr;
|
|
struct ethhdr *hdr;
|
|
|
|
bpf_dynptr_from_skb(skb, 0, &ptr);
|
|
|
|
if (hdr_size <= sizeof(buffer)) {
|
|
/* this should fail */
|
|
hdr = bpf_dynptr_slice_rdwr(&ptr, 0, buffer, hdr_size);
|
|
if (!hdr)
|
|
return SK_DROP;
|
|
hdr->h_proto = 12;
|
|
}
|
|
|
|
return SK_PASS;
|
|
}
|
|
|
|
static int callback(__u32 index, void *data)
|
|
{
|
|
*(__u32 *)data = 123;
|
|
|
|
return 0;
|
|
}
|
|
|
|
/* If the dynptr is written into in a callback function, its data
|
|
* slices should be invalidated as well.
|
|
*/
|
|
SEC("?raw_tp")
|
|
__failure __msg("invalid mem access 'scalar'")
|
|
int invalid_data_slices(void *ctx)
|
|
{
|
|
struct bpf_dynptr ptr;
|
|
__u32 *slice;
|
|
|
|
if (get_map_val_dynptr(&ptr))
|
|
return 0;
|
|
|
|
slice = bpf_dynptr_data(&ptr, 0, sizeof(__u32));
|
|
if (!slice)
|
|
return 0;
|
|
|
|
bpf_loop(10, callback, &ptr, 0);
|
|
|
|
/* this should fail */
|
|
*slice = 1;
|
|
|
|
return 0;
|
|
}
|
|
|
|
/* Program types that don't allow writes to packet data should fail if
|
|
* bpf_dynptr_slice_rdwr is called
|
|
*/
|
|
SEC("cgroup_skb/ingress")
|
|
__failure __msg("the prog does not allow writes to packet data")
|
|
int invalid_slice_rdwr_rdonly(struct __sk_buff *skb)
|
|
{
|
|
char buffer[sizeof(struct ethhdr)] = {};
|
|
struct bpf_dynptr ptr;
|
|
struct ethhdr *hdr;
|
|
|
|
bpf_dynptr_from_skb(skb, 0, &ptr);
|
|
|
|
/* this should fail since cgroup_skb doesn't allow
|
|
* changing packet data
|
|
*/
|
|
hdr = bpf_dynptr_slice_rdwr(&ptr, 0, buffer, sizeof(buffer));
|
|
__sink(hdr);
|
|
|
|
return 0;
|
|
}
|
|
|
|
/* bpf_dynptr_adjust can only be called on initialized dynptrs */
|
|
SEC("?raw_tp")
|
|
__failure __msg("Expected an initialized dynptr as arg #1")
|
|
int dynptr_adjust_invalid(void *ctx)
|
|
{
|
|
struct bpf_dynptr ptr;
|
|
|
|
/* this should fail */
|
|
bpf_dynptr_adjust(&ptr, 1, 2);
|
|
|
|
return 0;
|
|
}
|
|
|
|
/* bpf_dynptr_is_null can only be called on initialized dynptrs */
|
|
SEC("?raw_tp")
|
|
__failure __msg("Expected an initialized dynptr as arg #1")
|
|
int dynptr_is_null_invalid(void *ctx)
|
|
{
|
|
struct bpf_dynptr ptr;
|
|
|
|
/* this should fail */
|
|
bpf_dynptr_is_null(&ptr);
|
|
|
|
return 0;
|
|
}
|
|
|
|
/* bpf_dynptr_is_rdonly can only be called on initialized dynptrs */
|
|
SEC("?raw_tp")
|
|
__failure __msg("Expected an initialized dynptr as arg #1")
|
|
int dynptr_is_rdonly_invalid(void *ctx)
|
|
{
|
|
struct bpf_dynptr ptr;
|
|
|
|
/* this should fail */
|
|
bpf_dynptr_is_rdonly(&ptr);
|
|
|
|
return 0;
|
|
}
|
|
|
|
/* bpf_dynptr_size can only be called on initialized dynptrs */
|
|
SEC("?raw_tp")
|
|
__failure __msg("Expected an initialized dynptr as arg #1")
|
|
int dynptr_size_invalid(void *ctx)
|
|
{
|
|
struct bpf_dynptr ptr;
|
|
|
|
/* this should fail */
|
|
bpf_dynptr_size(&ptr);
|
|
|
|
return 0;
|
|
}
|
|
|
|
/* Only initialized dynptrs can be cloned */
|
|
SEC("?raw_tp")
|
|
__failure __msg("Expected an initialized dynptr as arg #1")
|
|
int clone_invalid1(void *ctx)
|
|
{
|
|
struct bpf_dynptr ptr1;
|
|
struct bpf_dynptr ptr2;
|
|
|
|
/* this should fail */
|
|
bpf_dynptr_clone(&ptr1, &ptr2);
|
|
|
|
return 0;
|
|
}
|
|
|
|
/* Can't overwrite an existing dynptr when cloning */
|
|
SEC("?xdp")
|
|
__failure __msg("cannot overwrite referenced dynptr")
|
|
int clone_invalid2(struct xdp_md *xdp)
|
|
{
|
|
struct bpf_dynptr ptr1;
|
|
struct bpf_dynptr clone;
|
|
|
|
bpf_dynptr_from_xdp(xdp, 0, &ptr1);
|
|
|
|
bpf_ringbuf_reserve_dynptr(&ringbuf, 64, 0, &clone);
|
|
|
|
/* this should fail */
|
|
bpf_dynptr_clone(&ptr1, &clone);
|
|
|
|
bpf_ringbuf_submit_dynptr(&clone, 0);
|
|
|
|
return 0;
|
|
}
|
|
|
|
/* Invalidating a dynptr should invalidate its clones */
|
|
SEC("?raw_tp")
|
|
__failure __msg("Expected an initialized dynptr as arg #3")
|
|
int clone_invalidate1(void *ctx)
|
|
{
|
|
struct bpf_dynptr clone;
|
|
struct bpf_dynptr ptr;
|
|
char read_data[64];
|
|
|
|
bpf_ringbuf_reserve_dynptr(&ringbuf, val, 0, &ptr);
|
|
|
|
bpf_dynptr_clone(&ptr, &clone);
|
|
|
|
bpf_ringbuf_submit_dynptr(&ptr, 0);
|
|
|
|
/* this should fail */
|
|
bpf_dynptr_read(read_data, sizeof(read_data), &clone, 0, 0);
|
|
|
|
return 0;
|
|
}
|
|
|
|
/* Invalidating a dynptr should invalidate its parent */
|
|
SEC("?raw_tp")
|
|
__failure __msg("Expected an initialized dynptr as arg #3")
|
|
int clone_invalidate2(void *ctx)
|
|
{
|
|
struct bpf_dynptr ptr;
|
|
struct bpf_dynptr clone;
|
|
char read_data[64];
|
|
|
|
bpf_ringbuf_reserve_dynptr(&ringbuf, val, 0, &ptr);
|
|
|
|
bpf_dynptr_clone(&ptr, &clone);
|
|
|
|
bpf_ringbuf_submit_dynptr(&clone, 0);
|
|
|
|
/* this should fail */
|
|
bpf_dynptr_read(read_data, sizeof(read_data), &ptr, 0, 0);
|
|
|
|
return 0;
|
|
}
|
|
|
|
/* Invalidating a dynptr should invalidate its siblings */
|
|
SEC("?raw_tp")
|
|
__failure __msg("Expected an initialized dynptr as arg #3")
|
|
int clone_invalidate3(void *ctx)
|
|
{
|
|
struct bpf_dynptr ptr;
|
|
struct bpf_dynptr clone1;
|
|
struct bpf_dynptr clone2;
|
|
char read_data[64];
|
|
|
|
bpf_ringbuf_reserve_dynptr(&ringbuf, val, 0, &ptr);
|
|
|
|
bpf_dynptr_clone(&ptr, &clone1);
|
|
|
|
bpf_dynptr_clone(&ptr, &clone2);
|
|
|
|
bpf_ringbuf_submit_dynptr(&clone2, 0);
|
|
|
|
/* this should fail */
|
|
bpf_dynptr_read(read_data, sizeof(read_data), &clone1, 0, 0);
|
|
|
|
return 0;
|
|
}
|
|
|
|
/* Invalidating a dynptr should invalidate any data slices
|
|
* of its clones
|
|
*/
|
|
SEC("?raw_tp")
|
|
__failure __msg("invalid mem access 'scalar'")
|
|
int clone_invalidate4(void *ctx)
|
|
{
|
|
struct bpf_dynptr ptr;
|
|
struct bpf_dynptr clone;
|
|
int *data;
|
|
|
|
bpf_ringbuf_reserve_dynptr(&ringbuf, val, 0, &ptr);
|
|
|
|
bpf_dynptr_clone(&ptr, &clone);
|
|
data = bpf_dynptr_data(&clone, 0, sizeof(val));
|
|
if (!data)
|
|
return 0;
|
|
|
|
bpf_ringbuf_submit_dynptr(&ptr, 0);
|
|
|
|
/* this should fail */
|
|
*data = 123;
|
|
|
|
return 0;
|
|
}
|
|
|
|
/* Invalidating a dynptr should invalidate any data slices
|
|
* of its parent
|
|
*/
|
|
SEC("?raw_tp")
|
|
__failure __msg("invalid mem access 'scalar'")
|
|
int clone_invalidate5(void *ctx)
|
|
{
|
|
struct bpf_dynptr ptr;
|
|
struct bpf_dynptr clone;
|
|
int *data;
|
|
|
|
bpf_ringbuf_reserve_dynptr(&ringbuf, val, 0, &ptr);
|
|
data = bpf_dynptr_data(&ptr, 0, sizeof(val));
|
|
if (!data)
|
|
return 0;
|
|
|
|
bpf_dynptr_clone(&ptr, &clone);
|
|
|
|
bpf_ringbuf_submit_dynptr(&clone, 0);
|
|
|
|
/* this should fail */
|
|
*data = 123;
|
|
|
|
return 0;
|
|
}
|
|
|
|
/* Invalidating a dynptr should invalidate any data slices
|
|
* of its sibling
|
|
*/
|
|
SEC("?raw_tp")
|
|
__failure __msg("invalid mem access 'scalar'")
|
|
int clone_invalidate6(void *ctx)
|
|
{
|
|
struct bpf_dynptr ptr;
|
|
struct bpf_dynptr clone1;
|
|
struct bpf_dynptr clone2;
|
|
int *data;
|
|
|
|
bpf_ringbuf_reserve_dynptr(&ringbuf, val, 0, &ptr);
|
|
|
|
bpf_dynptr_clone(&ptr, &clone1);
|
|
|
|
bpf_dynptr_clone(&ptr, &clone2);
|
|
|
|
data = bpf_dynptr_data(&clone1, 0, sizeof(val));
|
|
if (!data)
|
|
return 0;
|
|
|
|
bpf_ringbuf_submit_dynptr(&clone2, 0);
|
|
|
|
/* this should fail */
|
|
*data = 123;
|
|
|
|
return 0;
|
|
}
|
|
|
|
/* A skb clone's data slices should be invalid anytime packet data changes */
|
|
SEC("?tc")
|
|
__failure __msg("invalid mem access 'scalar'")
|
|
int clone_skb_packet_data(struct __sk_buff *skb)
|
|
{
|
|
char buffer[sizeof(__u32)] = {};
|
|
struct bpf_dynptr clone;
|
|
struct bpf_dynptr ptr;
|
|
__u32 *data;
|
|
|
|
bpf_dynptr_from_skb(skb, 0, &ptr);
|
|
|
|
bpf_dynptr_clone(&ptr, &clone);
|
|
data = bpf_dynptr_slice_rdwr(&clone, 0, buffer, sizeof(buffer));
|
|
if (!data)
|
|
return XDP_DROP;
|
|
|
|
if (bpf_skb_pull_data(skb, skb->len))
|
|
return SK_DROP;
|
|
|
|
/* this should fail */
|
|
*data = 123;
|
|
|
|
return 0;
|
|
}
|
|
|
|
/* A xdp clone's data slices should be invalid anytime packet data changes */
|
|
SEC("?xdp")
|
|
__failure __msg("invalid mem access 'scalar'")
|
|
int clone_xdp_packet_data(struct xdp_md *xdp)
|
|
{
|
|
char buffer[sizeof(__u32)] = {};
|
|
struct bpf_dynptr clone;
|
|
struct bpf_dynptr ptr;
|
|
struct ethhdr *hdr;
|
|
__u32 *data;
|
|
|
|
bpf_dynptr_from_xdp(xdp, 0, &ptr);
|
|
|
|
bpf_dynptr_clone(&ptr, &clone);
|
|
data = bpf_dynptr_slice_rdwr(&clone, 0, buffer, sizeof(buffer));
|
|
if (!data)
|
|
return XDP_DROP;
|
|
|
|
if (bpf_xdp_adjust_head(xdp, 0 - (int)sizeof(*hdr)))
|
|
return XDP_DROP;
|
|
|
|
/* this should fail */
|
|
*data = 123;
|
|
|
|
return 0;
|
|
}
|
|
|
|
/* Buffers that are provided must be sufficiently long */
|
|
SEC("?cgroup_skb/egress")
|
|
__failure __msg("memory, len pair leads to invalid memory access")
|
|
int test_dynptr_skb_small_buff(struct __sk_buff *skb)
|
|
{
|
|
struct bpf_dynptr ptr;
|
|
char buffer[8] = {};
|
|
__u64 *data;
|
|
|
|
if (bpf_dynptr_from_skb(skb, 0, &ptr)) {
|
|
err = 1;
|
|
return 1;
|
|
}
|
|
|
|
/* This may return NULL. SKB may require a buffer */
|
|
data = bpf_dynptr_slice(&ptr, 0, buffer, 9);
|
|
|
|
return !!data;
|
|
}
|