Commit c17f9734 authored by Jordan Rife's avatar Jordan Rife Committed by Martin KaFai Lau
Browse files

selftests/bpf: Migrate LOAD_REJECT test cases to prog_tests 



Move LOAD_REJECT test cases from test_sock.c to an equivalent set of
verifier tests in progs/verifier_sock.c.

Signed-off-by: default avatarJordan Rife <jrife@google.com>
Link: https://lore.kernel.org/r/20241022152913.574836-3-jrife@google.com


Signed-off-by: default avatarMartin KaFai Lau <martin.lau@kernel.org>
parent 94682d6a

tools/testing/selftests/bpf/progs/verifier_sock.c

+60 −0
Original line number Diff line number Diff line
@@ -977,4 +977,64 @@ l1_%=: r0 = *(u8*)(r7 + 0); \ 
	: __clobber_all);

}



SEC("cgroup/post_bind4")

__description("sk->src_ip6[0] [load 1st byte]")

__failure __msg("invalid bpf_context access off=28 size=2")

__naked void post_bind4_read_src_ip6(void)

{

	asm volatile ("					\

	r6 = r1;					\

	r7 = *(u16*)(r6 + %[bpf_sock_src_ip6_0]);	\

	r0 = 1;						\

	exit;						\

"	:

	: __imm_const(bpf_sock_src_ip6_0, offsetof(struct bpf_sock, src_ip6[0]))

	: __clobber_all);

}



SEC("cgroup/post_bind4")

__description("sk->mark [load mark]")

__failure __msg("invalid bpf_context access off=16 size=2")

__naked void post_bind4_read_mark(void)

{

	asm volatile ("					\

	r6 = r1;					\

	r7 = *(u16*)(r6 + %[bpf_sock_mark]);		\

	r0 = 1;						\

	exit;						\

"	:

	: __imm_const(bpf_sock_mark, offsetof(struct bpf_sock, mark))

	: __clobber_all);

}



SEC("cgroup/post_bind6")

__description("sk->src_ip4 [load src_ip4]")

__failure __msg("invalid bpf_context access off=24 size=2")

__naked void post_bind6_read_src_ip4(void)

{

	asm volatile ("					\

	r6 = r1;					\

	r7 = *(u16*)(r6 + %[bpf_sock_src_ip4]);		\

	r0 = 1;						\

	exit;						\

"	:

	: __imm_const(bpf_sock_src_ip4, offsetof(struct bpf_sock, src_ip4))

	: __clobber_all);

}



SEC("cgroup/sock_create")

__description("sk->src_port [word load]")

__failure __msg("invalid bpf_context access off=44 size=2")

__naked void sock_create_read_src_port(void)

{

	asm volatile ("					\

	r6 = r1;					\

	r7 = *(u16*)(r6 + %[bpf_sock_src_port]);	\

	r0 = 1;						\

	exit;						\

"	:

	: __imm_const(bpf_sock_src_port, offsetof(struct bpf_sock, src_port))

	: __clobber_all);

}



char _license[] SEC("license") = "GPL";

tools/testing/selftests/bpf/test_sock.c

+0 −52
Original line number Diff line number Diff line
@@ -47,58 +47,6 @@ struct sock_test { 
};



static struct sock_test tests[] = {

	{

		.descr = "bind4 load with invalid access: src_ip6",

		.insns = {

			BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),

			BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_6,

				    offsetof(struct bpf_sock, src_ip6[0])),

			BPF_MOV64_IMM(BPF_REG_0, 1),

			BPF_EXIT_INSN(),

		},

		.expected_attach_type = BPF_CGROUP_INET4_POST_BIND,

		.attach_type = BPF_CGROUP_INET4_POST_BIND,

		.result = LOAD_REJECT,

	},

	{

		.descr = "bind4 load with invalid access: mark",

		.insns = {

			BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),

			BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_6,

				    offsetof(struct bpf_sock, mark)),

			BPF_MOV64_IMM(BPF_REG_0, 1),

			BPF_EXIT_INSN(),

		},

		.expected_attach_type = BPF_CGROUP_INET4_POST_BIND,

		.attach_type = BPF_CGROUP_INET4_POST_BIND,

		.result = LOAD_REJECT,

	},

	{

		.descr = "bind6 load with invalid access: src_ip4",

		.insns = {

			BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),

			BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_6,

				    offsetof(struct bpf_sock, src_ip4)),

			BPF_MOV64_IMM(BPF_REG_0, 1),

			BPF_EXIT_INSN(),

		},

		.expected_attach_type = BPF_CGROUP_INET6_POST_BIND,

		.attach_type = BPF_CGROUP_INET6_POST_BIND,

		.result = LOAD_REJECT,

	},

	{

		.descr = "sock_create load with invalid access: src_port",

		.insns = {

			BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),

			BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_6,

				    offsetof(struct bpf_sock, src_port)),

			BPF_MOV64_IMM(BPF_REG_0, 1),

			BPF_EXIT_INSN(),

		},

		.expected_attach_type = BPF_CGROUP_INET_SOCK_CREATE,

		.attach_type = BPF_CGROUP_INET_SOCK_CREATE,

		.result = LOAD_REJECT,

	},

	{

		.descr = "sock_create load w/o expected_attach_type (compat mode)",

		.insns = {