[PATCH bpf 2/3] bpf: selftest: Ensure the return value of bpf_skc_to helpers must be checked

[Martin KaFai Lau]

This patch tests:

int bpf_cls(struct __sk_buff *skb)
{
        /* REG_6: sk
         * REG_7: tp
         * REG_8: req_sk
         */

        sk = skb->sk;
        if (!sk)
                return 0;

        tp = bpf_skc_to_tcp_sock(sk);
        req_sk = bpf_skc_to_tcp_request_sock(sk);
        if (!req_sk)
                return 0;

        /* !tp has not been tested, so verifier should reject. */
        return *(__u8 *)tp;
}

Signed-off-by: Martin KaFai Lau <ka...@fb.com>
---
 tools/testing/selftests/bpf/verifier/sock.c | 25 +++++++++++++++++++++
 1 file changed, 25 insertions(+)

diff --git a/tools/testing/selftests/bpf/verifier/sock.c 
b/tools/testing/selftests/bpf/verifier/sock.c
index b1aac2641498..ce13ece08d51 100644
--- a/tools/testing/selftests/bpf/verifier/sock.c
+++ b/tools/testing/selftests/bpf/verifier/sock.c
@@ -631,3 +631,28 @@
        .prog_type = BPF_PROG_TYPE_SK_REUSEPORT,
        .result = ACCEPT,
 },
+{
+       "mark null check on return value of bpf_skc_to helpers",
+       .insns = {
+       BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_1, offsetof(struct __sk_buff, 
sk)),
+       BPF_JMP_IMM(BPF_JNE, BPF_REG_1, 0, 2),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
+       BPF_EMIT_CALL(BPF_FUNC_skc_to_tcp_sock),
+       BPF_MOV64_REG(BPF_REG_7, BPF_REG_0),
+       BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
+       BPF_EMIT_CALL(BPF_FUNC_skc_to_tcp_request_sock),
+       BPF_MOV64_REG(BPF_REG_8, BPF_REG_0),
+       BPF_JMP_IMM(BPF_JNE, BPF_REG_8, 0, 2),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_7, 0),
+       BPF_EXIT_INSN(),
+       },
+       .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+       .result = REJECT,
+       .errstr = "invalid mem access",
+       .result_unpriv = REJECT,
+       .errstr_unpriv = "unknown func",
+},
-- 
2.24.1