Commit 1410620c authored by Udip Pant's avatar Udip Pant Committed by Alexei Starovoitov
Browse files

selftests/bpf: Test for map update access from within EXT programs



This adds further tests to ensure access permissions and restrictions
are applied properly for some map types such as sock-map.
It also adds another negative tests to assert static functions cannot be
replaced. In the 'unreliable' mode it still fails with error 'tracing progs
cannot use bpf_spin_lock yet' with the change in the verifier

Signed-off-by: default avatarUdip Pant <udippant@fb.com>
Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
Link: https://lore.kernel.org/bpf/20200825232003.2877030-5-udippant@fb.com
parent 50d19736
Loading
Loading
Loading
Loading
+30 −3
Original line number Diff line number Diff line
@@ -142,7 +142,20 @@ static void test_func_replace_verify(void)
				  prog_name, false);
}

static void test_func_replace_return_code(void)
static void test_func_sockmap_update(void)
{
	const char *prog_name[] = {
		"freplace/cls_redirect",
	};
	test_fexit_bpf2bpf_common("./freplace_cls_redirect.o",
				  "./test_cls_redirect.o",
				  ARRAY_SIZE(prog_name),
				  prog_name, false);
}

static void test_obj_load_failure_common(const char *obj_file,
					  const char *target_obj_file)

{
	/*
	 * standalone test that asserts failure to load freplace prog
@@ -151,8 +164,6 @@ static void test_func_replace_return_code(void)
	struct bpf_object *obj = NULL, *pkt_obj;
	int err, pkt_fd;
	__u32 duration = 0;
	const char *target_obj_file = "./connect4_prog.o";
	const char *obj_file = "./freplace_connect_v4_prog.o";

	err = bpf_prog_load(target_obj_file, BPF_PROG_TYPE_UNSPEC,
			    &pkt_obj, &pkt_fd);
@@ -181,11 +192,27 @@ close_prog:
	bpf_object__close(pkt_obj);
}

static void test_func_replace_return_code(void)
{
	/* test invalid return code in the replaced program */
	test_obj_load_failure_common("./freplace_connect_v4_prog.o",
				     "./connect4_prog.o");
}

static void test_func_map_prog_compatibility(void)
{
	/* test with spin lock map value in the replaced program */
	test_obj_load_failure_common("./freplace_attach_probe.o",
				     "./test_attach_probe.o");
}

void test_fexit_bpf2bpf(void)
{
	test_target_no_callees();
	test_target_yes_callees();
	test_func_replace();
	test_func_replace_verify();
	test_func_sockmap_update();
	test_func_replace_return_code();
	test_func_map_prog_compatibility();
}
+40 −0
Original line number Diff line number Diff line
// SPDX-License-Identifier: GPL-2.0
// Copyright (c) 2020 Facebook

#include <linux/ptrace.h>
#include <linux/bpf.h>
#include <bpf/bpf_helpers.h>
#include <bpf/bpf_tracing.h>

#define VAR_NUM 2

struct hmap_elem {
	struct bpf_spin_lock lock;
	int var[VAR_NUM];
};

struct {
	__uint(type, BPF_MAP_TYPE_HASH);
	__uint(max_entries, 1);
	__type(key, __u32);
	__type(value, struct hmap_elem);
} hash_map SEC(".maps");

SEC("freplace/handle_kprobe")
int new_handle_kprobe(struct pt_regs *ctx)
{
	struct hmap_elem zero = {}, *val;
	int key = 0;

	val = bpf_map_lookup_elem(&hash_map, &key);
	if (!val)
		return 1;
	/* spin_lock in hash map */
	bpf_spin_lock(&val->lock);
	val->var[0] = 99;
	bpf_spin_unlock(&val->lock);

	return 0;
}

char _license[] SEC("license") = "GPL";
+34 −0
Original line number Diff line number Diff line
// SPDX-License-Identifier: GPL-2.0
// Copyright (c) 2020 Facebook

#include <linux/stddef.h>
#include <linux/bpf.h>
#include <linux/pkt_cls.h>
#include <bpf/bpf_endian.h>
#include <bpf/bpf_helpers.h>

struct bpf_map_def SEC("maps") sock_map = {
	.type = BPF_MAP_TYPE_SOCKMAP,
	.key_size = sizeof(int),
	.value_size = sizeof(int),
	.max_entries = 2,
};

SEC("freplace/cls_redirect")
int freplace_cls_redirect_test(struct __sk_buff *skb)
{
	int ret = 0;
	const int zero = 0;
	struct bpf_sock *sk;

	sk = bpf_map_lookup_elem(&sock_map, &zero);
	if (!sk)
		return TC_ACT_SHOT;

	ret = bpf_map_update_elem(&sock_map, &zero, sk, 0);
	bpf_sk_release(sk);

	return ret == 0 ? TC_ACT_OK : TC_ACT_SHOT;
}

char _license[] SEC("license") = "GPL";