mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-08-30 13:23:02 -04:00
Code Issues Packages Projects Releases Wiki Activity

selftests/bpf: Test map lookup result refinement

Browse Source 
A map-of-maps lookup value is refined to a map pointer (map_ptr_or_null)
at lookup time by refine_map_lookup_value(). Test that it is rejected
wherever a raw map value would be read as bytes, so the inner map
descriptor cannot leak.

Signed-off-by: Amery Hung <ameryhung@gmail.com>
Link: https://lore.kernel.org/bpf/20260801074633.1595644-8-ameryhung@gmail.com
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
This commit is contained in:
Amery Hung
2026-08-01 00:46:22 -07:00
committed by Kumar Kartikeya Dwivedi
parent d4e7fb59c0
commit e6d200dd10
2 changed files with 75 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
tools/testing/selftests/bpf/prog_tests/verifier.c
View File

@@ -61,6 +61,7 @@
#include "verifier_loops1.skel.h"
#include "verifier_lwt.skel.h"
#include "verifier_map_in_map.skel.h"
#include "verifier_map_lookup_refine.skel.h"
#include "verifier_map_ptr.skel.h"
#include "verifier_map_ptr_mixing.skel.h"
#include "verifier_map_ret_val.skel.h"
@@ -215,6 +216,7 @@ void test_verifier_liveness_exp(void) { RUN(verifier_liveness_exp); }
void test_verifier_loops1(void) { RUN(verifier_loops1); }
void test_verifier_lwt(void) { RUN(verifier_lwt); }
void test_verifier_map_in_map(void) { RUN(verifier_map_in_map); }
void test_verifier_map_lookup_refine(void) { RUN(verifier_map_lookup_refine); }
void test_verifier_map_ptr(void) { RUN(verifier_map_ptr); }
void test_verifier_map_ptr_mixing(void) { RUN(verifier_map_ptr_mixing); }
void test_verifier_map_ret_val(void) { RUN(verifier_map_ret_val); }

73
tools/testing/selftests/bpf/progs/verifier_map_lookup_refine.c Normal file
View File

@@ -0,0 +1,73 @@
// SPDX-License-Identifier: GPL-2.0
#include <vmlinux.h>
#include <bpf/bpf_helpers.h>
#include "bpf_misc.h"
#include "bpf_kfuncs.h"
char _license[] SEC("license") = "GPL";
struct inner_map {
__uint(type, BPF_MAP_TYPE_ARRAY);
__uint(max_entries, 1);
__type(key, int);
__type(value, int);
} inner_map SEC(".maps");
struct {
__uint(type, BPF_MAP_TYPE_ARRAY_OF_MAPS);
__uint(max_entries, 1);
__type(key, int);
__array(values, struct inner_map);
} outer_map SEC(".maps") = {
.values = { [0] = &inner_map },
};
SEC("?tc")
__failure __msg("type=map_ptr_or_null expected=fp")
int mapofmaps_value_as_kfunc_mem_buf(struct __sk_buff *skb)
{
struct bpf_dynptr dptr;
__u32 key = 0;
void *inner;
char *p;
inner = bpf_map_lookup_elem(&outer_map, &key);
/* intentionally NOT NULL-checked: type is map_ptr_or_null */
bpf_dynptr_from_skb(skb, 0, &dptr);
/* arg3 is mem+size */
p = bpf_dynptr_slice(&dptr, 0, inner, 4);
if (p)
return p[0];
return 0;
}
SEC("?tc")
__failure __msg("type=map_ptr_or_null expected=fp")
int mapofmaps_value_as_helper_mem_buf(struct __sk_buff *skb)
{
__u32 key = 0;
void *inner;
inner = bpf_map_lookup_elem(&outer_map, &key);
/* intentionally NOT NULL-checked: type is map_ptr_or_null */
/* arg1 is mem+size */
return bpf_csum_diff(inner, 4, NULL, 0, 0) + skb->len;
}
SEC("?tc")
__failure __msg("type=map_ptr_or_null expected=fp")
int mapofmaps_value_as_helper_fixed_mem(struct __sk_buff *skb)
{
char th[sizeof(struct tcphdr)] = {};
__u32 key = 0;
void *inner;
inner = bpf_map_lookup_elem(&outer_map, &key);
/* intentionally NOT NULL-checked: type is map_ptr_or_null */
/* arg1 is fixed-sized mem */
return bpf_tcp_raw_check_syncookie_ipv4(inner, (void *)th);
}