Commit d798ce3f authored by Kumar Kartikeya Dwivedi's avatar Kumar Kartikeya Dwivedi Committed by Alexei Starovoitov
Browse files

selftests/bpf: Add tests for raw_tp null handling 



Ensure that trusted PTR_TO_BTF_ID accesses perform PROBE_MEM handling in
raw_tp program. Without the previous fix, this selftest crashes the
kernel due to a NULL-pointer dereference. Also ensure that dead code
elimination does not kick in for checks on the pointer.

Reviewed-by: default avatarJiri Olsa <jolsa@kernel.org>
Signed-off-by: default avatarKumar Kartikeya Dwivedi <memxor@gmail.com>
Link: https://lore.kernel.org/r/20241104171959.2938862-4-memxor@gmail.com


Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
parent 0e2fb011

tools/testing/selftests/bpf/bpf_testmod/bpf_testmod-events.h

+8 −0
Original line number Diff line number Diff line
@@ -40,6 +40,14 @@ DECLARE_TRACE(bpf_testmod_test_nullable_bare, 
	TP_ARGS(ctx__nullable)

);



struct sk_buff;



DECLARE_TRACE(bpf_testmod_test_raw_tp_null,

	TP_PROTO(struct sk_buff *skb),

	TP_ARGS(skb)

);





#undef BPF_TESTMOD_DECLARE_TRACE

#ifdef DECLARE_TRACE_WRITABLE

#define BPF_TESTMOD_DECLARE_TRACE(call, proto, args, size) \

tools/testing/selftests/bpf/bpf_testmod/bpf_testmod.c

+2 −0
Original line number Diff line number Diff line
@@ -380,6 +380,8 @@ bpf_testmod_test_read(struct file *file, struct kobject *kobj, 


	(void)bpf_testmod_test_arg_ptr_to_struct(&struct_arg1_2);



	(void)trace_bpf_testmod_test_raw_tp_null(NULL);



	struct_arg3 = kmalloc((sizeof(struct bpf_testmod_struct_arg_3) +

				sizeof(int)), GFP_KERNEL);

	if (struct_arg3 != NULL) {

tools/testing/selftests/bpf/prog_tests/raw_tp_null.c

0 → 100644
+25 −0
Original line number Diff line number Diff line 
// SPDX-License-Identifier: GPL-2.0

/* Copyright (c) 2024 Meta Platforms, Inc. and affiliates. */



#include <test_progs.h>

#include "raw_tp_null.skel.h"



void test_raw_tp_null(void)

{

	struct raw_tp_null *skel;



	skel = raw_tp_null__open_and_load();

	if (!ASSERT_OK_PTR(skel, "raw_tp_null__open_and_load"))

		return;



	skel->bss->tid = sys_gettid();



	if (!ASSERT_OK(raw_tp_null__attach(skel), "raw_tp_null__attach"))

		goto end;



	ASSERT_OK(trigger_module_test_read(2), "trigger testmod read");

	ASSERT_EQ(skel->bss->i, 3, "invocations");



end:

	raw_tp_null__destroy(skel);

}

tools/testing/selftests/bpf/progs/raw_tp_null.c

0 → 100644
+32 −0
Original line number Diff line number Diff line 
// SPDX-License-Identifier: GPL-2.0

/* Copyright (c) 2024 Meta Platforms, Inc. and affiliates. */



#include <vmlinux.h>

#include <bpf/bpf_tracing.h>



char _license[] SEC("license") = "GPL";



int tid;

int i;



SEC("tp_btf/bpf_testmod_test_raw_tp_null")

int BPF_PROG(test_raw_tp_null, struct sk_buff *skb)

{

	struct task_struct *task = bpf_get_current_task_btf();



	if (task->pid != tid)

		return 0;



	i = i + skb->mark + 1;

	/* The compiler may move the NULL check before this deref, which causes

	 * the load to fail as deref of scalar. Prevent that by using a barrier.

	 */

	barrier();

	/* If dead code elimination kicks in, the increment below will

	 * be removed. For raw_tp programs, we mark input arguments as

	 * PTR_MAYBE_NULL, so branch prediction should never kick in.

	 */

	if (!skb)

		i += 2;

	return 0;

}