On 12.10.26 19:43, Mina Almasry wrote:
> Add devmem_bind_rx_unregister_check and devmem_bind_tx_unregister_check
> to nl_netdev.py to verify that unregistering a netdevsim device while a
> netlink socket holds an active RX or TX devmem binding synchronously
> detaches the dma_buf attachment and cleanly closes the netlink socket
> without use-after-free or page faults.
>
> Cc: Tariq Toukan <[email protected]>
> Cc: Kaifeng Wang <[email protected]>
> Signed-off-by: Mina Almasry <[email protected]>
> ---
> tools/testing/selftests/net/nl_netdev.py | 108 ++++++++++++++++++++++-
> 1 file changed, 105 insertions(+), 3 deletions(-)
>
> diff --git a/tools/testing/selftests/net/nl_netdev.py
> b/tools/testing/selftests/net/nl_netdev.py
> index ceb44c8e1fec5..bad230ee9dcd2 100755
> --- a/tools/testing/selftests/net/nl_netdev.py
> +++ b/tools/testing/selftests/net/nl_netdev.py
> @@ -6,10 +6,14 @@ Tests for the netdev netlink family.
> """
>
> import errno
> +import fcntl
> +import mmap
> +import os
> +import struct
> from os import system
> -from lib.py import ksft_run, ksft_exit
> +from lib.py import ksft_run, ksft_exit, KsftSkipEx
> from lib.py import ksft_eq, ksft_ge, ksft_ne, ksft_raises, ksft_busy_wait
> -from lib.py import NetdevFamily, NetdevSimDev, NlError, defer, ip
> +from lib.py import EthtoolFamily, NetdevFamily, NetdevSimDev, NlError,
> defer, ip
>
>
> def empty_check(nf) -> None:
> @@ -366,6 +370,102 @@ def page_pool_stats_ifindex_check(nf) -> None:
> ksft_eq(cm.exception.nl_msg.extack['bad-attr'], '.info.id')
>
>
> +def _create_udmabuf(num_pages=64) -> int:
> + """Create a sealed memfd-backed udmabuf fd for devmem tests."""
> + if not os.path.exists("/dev/udmabuf"):
> + raise KsftSkipEx("/dev/udmabuf is not available")
> +
> + size = num_pages * mmap.PAGESIZE
> + memfd = os.memfd_create("devmem-ksft", os.MFD_ALLOW_SEALING)
> + os.ftruncate(memfd, size)
> + fcntl.fcntl(memfd, 1033, 0x0002) # F_ADD_SEALS, F_SEAL_SHRINK
> + devfd = os.open("/dev/udmabuf", os.O_RDWR)
> + req = bytearray(struct.pack("IIQQ", memfd, 0, 0, size))
> + dmabuf_fd = fcntl.ioctl(devfd, 0x40187542, req) # UDMABUF_CREATE
Nit: this could be a constant
> + os.close(devfd)
> + os.close(memfd)
> + return dmabuf_fd
> +
> +
> +def _dmabuf_attached_devs():
> + """Return attached device names from debugfs dma_buf/bufinfo if
> available."""
> + path = "/sys/kernel/debug/dma_buf/bufinfo"
> + if not os.path.exists(path):
> + return None
> + with open(path, "r", encoding="utf-8") as f:
> + text = f.read()
> + attached = []
> + in_attached = False
> + for line in text.splitlines():
> + if line.strip() == "Attached Devices:":
> + in_attached = True
> + continue
> + if in_attached:
> + if line.startswith("\t") and line.strip():
> + attached.append(line.strip())
> + else:
> + in_attached = False
> + return attached
> +
> +
> +def devmem_bind_rx_unregister_check(_nf) -> None:
> + """Verify RX devmem bindings detach dma_buf synchronously on netdev
> unregister."""
> + dmabuf_fd = _create_udmabuf()
> + nf_priv = NetdevFamily()
> + ef = EthtoolFamily()
> + nsimdev = NetdevSimDev(queue_count=2)
> + nsim = nsimdev.nsims[0]
> +
> + ip(f"link set dev {nsim.ifname} up")
> + ef.rings_set({"header": {"dev-index": nsim.ifindex},
> + "tcp-data-split": "enabled"})
> + nf_priv.bind_rx({
> + "ifindex": nsim.ifindex,
> + "fd": dmabuf_fd,
> + "queues": [{"id": 1, "type": "rx"}],
> + })
> +
> + attached = _dmabuf_attached_devs()
> + if attached is not None:
> + ksft_ge(len(attached), 1)
> +
> + nsimdev.remove()
> +
> + attached = _dmabuf_attached_devs()
> + if attached is not None:
> + ksft_eq(len(attached), 0)
> +
> + del nf_priv
> + os.close(dmabuf_fd)
> +
> +
> +def devmem_bind_tx_unregister_check(_nf) -> None:
> + """Verify TX devmem bindings detach cleanly on netdev unregister without
> UAF."""
> + dmabuf_fd = _create_udmabuf()
> + nf_priv = NetdevFamily()
> + nsimdev = NetdevSimDev(queue_count=2)
> + nsim = nsimdev.nsims[0]
> +
> + ip(f"link set dev {nsim.ifname} up")
> + nf_priv.bind_tx({
> + "ifindex": nsim.ifindex,
> + "fd": dmabuf_fd,
> + })
> +
> + attached = _dmabuf_attached_devs()
> + if attached is not None:
> + ksft_ge(len(attached), 1)
> +
> + nsimdev.remove()
> +
> + attached = _dmabuf_attached_devs()
> + if attached is not None:
> + ksft_eq(len(attached), 0)
> +
> + del nf_priv
> + os.close(dmabuf_fd)
> +
> +
> def main() -> None:
> """ Ksft boiler plate main """
> nf = NetdevFamily()
> @@ -379,7 +479,9 @@ def main() -> None:
> page_pool_check,
> page_pool_dump_ifindex,
> page_pool_ifindex_leak_check,
> - page_pool_stats_ifindex_check
> + page_pool_stats_ifindex_check,
> + devmem_bind_rx_unregister_check,
> + devmem_bind_tx_unregister_check
> ],
> args=(nf, ))
> ksft_exit()
Other than the above nit:
Reviewed-by: Dragos Tatulea <[email protected]>
Thanks,
Dragos
