Commit 2a95471c authored by Alexei Starovoitov's avatar Alexei Starovoitov
Browse files

Merge branch 'prog_test_run-improvement' 



Lorenz Bauer says:

====================
Right now, there is no safe way to use BPF_PROG_TEST_RUN with data_out.
This is because bpf_test_finish copies the output buffer to user space
without checking its size. This can lead to the kernel overwriting
data in user space after the buffer if xdp_adjust_head and friends are
in play.

Thanks to everyone for their advice and patience with this patch set!

Changes in v5:
* Fix up libbpf.map

Changes in v4:
* Document bpf_prog_test_run and bpf_prog_test_run_xattr
* Use struct bpf_prog_test_run_attr for return values

Changes in v3:
* Introduce bpf_prog_test_run_xattr instead of modifying the existing
  function

Changes in v2:
* Make the syscall return ENOSPC if data_size_out is too small
* Make bpf_prog_test_run return EINVAL if size_out is missing
* Document the new behaviour of data_size_out
====================

Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
parents d59dd69d df47fc37

include/uapi/linux/bpf.h

+5 −2
Original line number Diff line number Diff line
@@ -374,8 +374,11 @@ union bpf_attr { 
	struct { /* anonymous struct used by BPF_PROG_TEST_RUN command */

		__u32		prog_fd;

		__u32		retval;

		__u32		data_size_in;

		__u32		data_size_out;

		__u32		data_size_in;	/* input: len of data_in */

		__u32		data_size_out;	/* input/output: len of data_out

						 *   returns ENOSPC if data_out

						 *   is too small.

						 */

		__aligned_u64	data_in;

		__aligned_u64	data_out;

		__u32		repeat;

net/bpf/test_run.c

+13 −2
Original line number Diff line number Diff line
@@ -74,8 +74,18 @@ static int bpf_test_finish(const union bpf_attr *kattr, 
{

	void __user *data_out = u64_to_user_ptr(kattr->test.data_out);

	int err = -EFAULT;

	u32 copy_size = size;



	if (data_out && copy_to_user(data_out, data, size))

	/* Clamp copy if the user has provided a size hint, but copy the full

	 * buffer if not to retain old behaviour.

	 */

	if (kattr->test.data_size_out &&

	    copy_size > kattr->test.data_size_out) {

		copy_size = kattr->test.data_size_out;

		err = -ENOSPC;

	}



	if (data_out && copy_to_user(data_out, data, copy_size))

		goto out;

	if (copy_to_user(&uattr->test.data_size_out, &size, sizeof(size)))

		goto out;
@@ -83,6 +93,7 @@ static int bpf_test_finish(const union bpf_attr *kattr, 
		goto out;

	if (copy_to_user(&uattr->test.duration, &duration, sizeof(duration)))

		goto out;

	if (err != -ENOSPC)

		err = 0;

out:

	return err;

tools/include/uapi/linux/bpf.h

+5 −2
Original line number Diff line number Diff line
@@ -374,8 +374,11 @@ union bpf_attr { 
	struct { /* anonymous struct used by BPF_PROG_TEST_RUN command */

		__u32		prog_fd;

		__u32		retval;

		__u32		data_size_in;

		__u32		data_size_out;

		__u32		data_size_in;	/* input: len of data_in */

		__u32		data_size_out;	/* input/output: len of data_out

						 *   returns ENOSPC if data_out

						 *   is too small.

						 */

		__aligned_u64	data_in;

		__aligned_u64	data_out;

		__u32		repeat;

tools/lib/bpf/bpf.c

+23 −0
Original line number Diff line number Diff line
@@ -463,6 +463,29 @@ int bpf_prog_test_run(int prog_fd, int repeat, void *data, __u32 size, 
	return ret;

}



int bpf_prog_test_run_xattr(struct bpf_prog_test_run_attr *test_attr)

{

	union bpf_attr attr;

	int ret;



	if (!test_attr->data_out && test_attr->data_size_out > 0)

		return -EINVAL;



	bzero(&attr, sizeof(attr));

	attr.test.prog_fd = test_attr->prog_fd;

	attr.test.data_in = ptr_to_u64(test_attr->data_in);

	attr.test.data_out = ptr_to_u64(test_attr->data_out);

	attr.test.data_size_in = test_attr->data_size_in;

	attr.test.data_size_out = test_attr->data_size_out;

	attr.test.repeat = test_attr->repeat;



	ret = sys_bpf(BPF_PROG_TEST_RUN, &attr, sizeof(attr));

	test_attr->data_size_out = attr.test.data_size_out;

	test_attr->retval = attr.test.retval;

	test_attr->duration = attr.test.duration;

	return ret;

}



int bpf_prog_get_next_id(__u32 start_id, __u32 *next_id)

{

	union bpf_attr attr;

tools/lib/bpf/bpf.h

+19 −0
Original line number Diff line number Diff line
@@ -118,6 +118,25 @@ LIBBPF_API int bpf_prog_attach(int prog_fd, int attachable_fd, 
LIBBPF_API int bpf_prog_detach(int attachable_fd, enum bpf_attach_type type);

LIBBPF_API int bpf_prog_detach2(int prog_fd, int attachable_fd,

				enum bpf_attach_type type);



struct bpf_prog_test_run_attr {

	int prog_fd;

	int repeat;

	const void *data_in;

	__u32 data_size_in;

	void *data_out;      /* optional */

	__u32 data_size_out; /* in: max length of data_out

			      * out: length of data_out */

	__u32 retval;        /* out: return code of the BPF program */

	__u32 duration;      /* out: average per repetition in ns */

};



LIBBPF_API int bpf_prog_test_run_xattr(struct bpf_prog_test_run_attr *test_attr);



/*

 * bpf_prog_test_run does not check that data_out is large enough. Consider

 * using bpf_prog_test_run_xattr instead.

 */

LIBBPF_API int bpf_prog_test_run(int prog_fd, int repeat, void *data,

				 __u32 size, void *data_out, __u32 *size_out,

				 __u32 *retval, __u32 *duration);

CRA Git | Maintained and supported by SUSTech CRA and CCSE