Skip to content

Commit 3f23ee5

Browse files
eddyz87Alexei Starovoitov
authored andcommitted
selftests/bpf: test for changing packet data from global functions
Check if verifier is aware of packet pointers invalidation done in global functions. Based on a test shared by Nick Zavaritsky in [0]. [0] https://lore.kernel.org/bpf/0498CA22-5779-4767-9C0C-A9515CEA711F@gmail.com/ Suggested-by: Nick Zavaritsky <mejedi@gmail.com> Signed-off-by: Eduard Zingerman <eddyz87@gmail.com> Link: https://lore.kernel.org/r/20241210041100.1898468-5-eddyz87@gmail.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>
1 parent 51081a3 commit 3f23ee5

File tree

1 file changed

+28
-0
lines changed

1 file changed

+28
-0
lines changed

tools/testing/selftests/bpf/progs/verifier_sock.c

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1037,4 +1037,32 @@ __naked void sock_create_read_src_port(void)
10371037
: __clobber_all);
10381038
}
10391039

1040+
__noinline
1041+
long skb_pull_data2(struct __sk_buff *sk, __u32 len)
1042+
{
1043+
return bpf_skb_pull_data(sk, len);
1044+
}
1045+
1046+
__noinline
1047+
long skb_pull_data1(struct __sk_buff *sk, __u32 len)
1048+
{
1049+
return skb_pull_data2(sk, len);
1050+
}
1051+
1052+
/* global function calls bpf_skb_pull_data(), which invalidates packet
1053+
* pointers established before global function call.
1054+
*/
1055+
SEC("tc")
1056+
__failure __msg("invalid mem access")
1057+
int invalidate_pkt_pointers_from_global_func(struct __sk_buff *sk)
1058+
{
1059+
int *p = (void *)(long)sk->data;
1060+
1061+
if ((void *)(p + 1) > (void *)(long)sk->data_end)
1062+
return TCX_DROP;
1063+
skb_pull_data1(sk, 0);
1064+
*p = 42; /* this is unsafe */
1065+
return TCX_PASS;
1066+
}
1067+
10401068
char _license[] SEC("license") = "GPL";

0 commit comments

Comments
 (0)