Cover what the verifier has to get right for the msk returned by bpf_skc_to_mptcp_sock(): it must not be accepted by bpf_sk_release(), it must go away with the subflow it was derived from, and the subflow reference still has to be released.
# ./test_progs -t verifier_mptcp #658/1 verifier_mptcp/bpf_skc_to_mptcp_sock: release the acquired subflow:OK #658/2 verifier_mptcp/bpf_skc_to_mptcp_sock: msk is not the acquired subflow:OK #658/3 verifier_mptcp/bpf_skc_to_mptcp_sock: msk dies with the subflow it came from:OK #658/4 verifier_mptcp/bpf_skc_to_mptcp_sock: subflow is still owned after the cast:OK #658 verifier_mptcp:OK Summary: 1/4 PASSED, 0 SKIPPED, 0/0 FAILED Signed-off-by: Jiayuan Chen <[email protected]> --- .../selftests/bpf/prog_tests/verifier.c | 2 + .../selftests/bpf/progs/verifier_mptcp.c | 101 ++++++++++++++++++ 2 files changed, 103 insertions(+) create mode 100644 tools/testing/selftests/bpf/progs/verifier_mptcp.c diff --git a/tools/testing/selftests/bpf/prog_tests/verifier.c b/tools/testing/selftests/bpf/prog_tests/verifier.c index f7f94ccebce2..63316e4be6bb 100644 --- a/tools/testing/selftests/bpf/prog_tests/verifier.c +++ b/tools/testing/selftests/bpf/prog_tests/verifier.c @@ -74,6 +74,7 @@ #include "verifier_mem_size_reg.skel.h" #include "verifier_meta_access.skel.h" #include "verifier_movsx.skel.h" +#include "verifier_mptcp.skel.h" #include "verifier_mtu.skel.h" #include "verifier_mul.skel.h" #include "verifier_netfilter_ctx.skel.h" @@ -238,6 +239,7 @@ void test_verifier_may_goto_2(void) { RUN(verifier_may_goto_2); } void test_verifier_mem_size_reg(void) { RUN(verifier_mem_size_reg); } void test_verifier_meta_access(void) { RUN(verifier_meta_access); } void test_verifier_movsx(void) { RUN(verifier_movsx); } +void test_verifier_mptcp(void) { RUN(verifier_mptcp); } void test_verifier_mul(void) { RUN(verifier_mul); } void test_verifier_netfilter_ctx(void) { RUN(verifier_netfilter_ctx); } void test_verifier_netfilter_retcode(void) { RUN(verifier_netfilter_retcode); } diff --git a/tools/testing/selftests/bpf/progs/verifier_mptcp.c b/tools/testing/selftests/bpf/progs/verifier_mptcp.c new file mode 100644 index 000000000000..1f679265e043 --- /dev/null +++ b/tools/testing/selftests/bpf/progs/verifier_mptcp.c @@ -0,0 +1,101 @@ +// SPDX-License-Identifier: GPL-2.0 + +#include "bpf_tracing_net.h" +#include <bpf/bpf_helpers.h> +#include "bpf_misc.h" + +char _license[] SEC("license") = "GPL"; + +__u32 token; + +static __always_inline struct bpf_sock *lookup_subflow(struct __sk_buff *skb) +{ + struct bpf_sock_tuple tuple = {}; + + return bpf_skc_lookup_tcp(skb, &tuple, sizeof(tuple.ipv4), + BPF_F_CURRENT_NETNS, 0); +} + +SEC("tc") +__description("bpf_skc_to_mptcp_sock: release the acquired subflow") +__success +int mptcp_cast_release_subflow(struct __sk_buff *skb) +{ + struct mptcp_sock *msk; + struct bpf_sock *sk; + + sk = lookup_subflow(skb); + if (!sk) + return 0; + + msk = bpf_skc_to_mptcp_sock(sk); + if (msk) + token = msk->token; + + bpf_sk_release(sk); + return 0; +} + +SEC("tc") +__description("bpf_skc_to_mptcp_sock: msk is not the acquired subflow") +__failure __msg("release helper bpf_sk_release expects referenced PTR_TO_BTF_ID") +int mptcp_cast_release_msk(struct __sk_buff *skb) +{ + struct mptcp_sock *msk; + struct bpf_sock *sk; + + sk = lookup_subflow(skb); + if (!sk) + return 0; + + msk = bpf_skc_to_mptcp_sock(sk); + if (!msk) { + bpf_sk_release(sk); + return 0; + } + + bpf_sk_release((struct bpf_sock *)msk); + return 0; +} + +SEC("tc") +__description("bpf_skc_to_mptcp_sock: msk dies with the subflow it came from") +__failure __msg("invalid mem access 'scalar'") +int mptcp_cast_use_after_release(struct __sk_buff *skb) +{ + struct mptcp_sock *msk; + struct bpf_sock *sk; + + sk = lookup_subflow(skb); + if (!sk) + return 0; + + msk = bpf_skc_to_mptcp_sock(sk); + if (!msk) { + bpf_sk_release(sk); + return 0; + } + + bpf_sk_release(sk); + token = msk->token; + return 0; +} + +SEC("tc") +__description("bpf_skc_to_mptcp_sock: subflow is still owned after the cast") +__failure __msg("Unreleased reference") +int mptcp_cast_leak_subflow(struct __sk_buff *skb) +{ + struct mptcp_sock *msk; + struct bpf_sock *sk; + + sk = lookup_subflow(skb); + if (!sk) + return 0; + + msk = bpf_skc_to_mptcp_sock(sk); + if (msk) + token = msk->token; + + return 0; +} -- 2.43.0
