mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-08-30 23:59:33 -04:00
Code Issues Packages Projects Releases Wiki Activity

selftests/bpf: Add untrusted BTF write regression

Browse Source 
Add a TCP congestion-control struct_ops load test for a write through a
BTF pointer produced by bpf_rdonly_cast().

The test expects the verifier to reject the program before the TCP CA
btf_struct_access callback can whitelist the tcp_sock field write.

Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
Reviewed-by: Amery Hung <ameryhung@gmail.com>
Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
This commit is contained in:
Kumar Kartikeya Dwivedi
2026-07-08 05:07:51 +02:00
committed by Eduard Zingerman
parent ac65c710cc
commit 9eab4790f1
2 changed files with 38 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
tools/testing/selftests/bpf/prog_tests/bpf_tcp_ca.c
View File

@@ -14,6 +14,7 @@
#include "tcp_ca_incompl_cong_ops.skel.h"
#include "tcp_ca_unsupp_cong_op.skel.h"
#include "tcp_ca_kfunc.skel.h"
#include "tcp_ca_untrusted_btf_write.skel.h"
#include "bpf_cc_cubic.skel.h"
static const unsigned int total_bytes = 10 * 1024 * 1024;
@@ -579,6 +580,15 @@ static void test_tcp_ca_kfunc(void)
tcp_ca_kfunc__destroy(skel);
}
static void test_untrusted_btf_write(void)
{
struct tcp_ca_untrusted_btf_write *skel;
skel = tcp_ca_untrusted_btf_write__open_and_load();
ASSERT_ERR_PTR(skel, "tcp_ca_untrusted_btf_write__open_and_load");
tcp_ca_untrusted_btf_write__destroy(skel);
}
static void test_cc_cubic(void)
{
struct cb_opts cb_opts = {
@@ -637,6 +647,8 @@ void test_bpf_tcp_ca(void)
test_link_replace();
if (test__start_subtest("tcp_ca_kfunc"))
test_tcp_ca_kfunc();
if (test__start_subtest("untrusted_btf_write"))
test_untrusted_btf_write();
if (test__start_subtest("cc_cubic"))
test_cc_cubic();
if (test__start_subtest("dctcp_autoattach_map"))

26
tools/testing/selftests/bpf/progs/tcp_ca_untrusted_btf_write.c Normal file
View File

@@ -0,0 +1,26 @@
// SPDX-License-Identifier: GPL-2.0
#include "bpf_tracing_net.h"
#include <bpf/bpf_core_read.h>
#include <bpf/bpf_helpers.h>
#include <bpf/bpf_tracing.h>
char _license[] SEC("license") = "GPL";
SEC("struct_ops")
void BPF_PROG(untrusted_btf_write_init, struct sock *sk)
{
struct tcp_sock *tp;
int v = 1;
void *p;
p = bpf_rdonly_cast(&v, 0);
tp = bpf_rdonly_cast(p, bpf_core_type_id_kernel(struct tcp_sock));
tp->snd_cwnd = 1;
}
SEC(".struct_ops")
struct tcp_congestion_ops untrusted_btf_write = {
.init = (void *)untrusted_btf_write_init,
.name = "bpf_ro_btf",
};