> On Oct 17, 2018, at 11:25 PM, Alexei Starovoitov
> <alexei.starovoi...@gmail.com> wrote:
>
> On Wed, Oct 17, 2018 at 10:39:49PM -0700, Song Liu wrote:
>> Tests are added to make sure CGROUP_SKB cannot access:
>> tc_classid, data_meta, flow_keys
>>
>> and can read and write:
>> mark, prority, and cb[0-4]
>>
>> and can read other fields.
>>
>> To make selftest with skb->sk work, a dummy sk is added in
>> bpf_prog_test_run_skb().
>>
>> Signed-off-by: Song Liu <songliubrav...@fb.com>
>> ---
>> net/bpf/test_run.c | 4 +
>> tools/testing/selftests/bpf/test_verifier.c | 170 ++++++++++++++++++++
>> 2 files changed, 174 insertions(+)
>>
>> diff --git a/net/bpf/test_run.c b/net/bpf/test_run.c
>> index 0c423b8cd75c..c7210e2f1ae9 100644
>> --- a/net/bpf/test_run.c
>> +++ b/net/bpf/test_run.c
>> @@ -10,6 +10,7 @@
>> #include <linux/etherdevice.h>
>> #include <linux/filter.h>
>> #include <linux/sched/signal.h>
>> +#include <net/sock.h>
>>
>> static __always_inline u32 bpf_test_run_one(struct bpf_prog *prog, void *ctx,
>> struct bpf_cgroup_storage *storage[MAX_BPF_CGROUP_STORAGE_TYPE])
>> @@ -115,6 +116,7 @@ int bpf_prog_test_run_skb(struct bpf_prog *prog, const
>> union bpf_attr *kattr,
>> u32 retval, duration;
>> int hh_len = ETH_HLEN;
>> struct sk_buff *skb;
>> + struct sock sk;
>> void *data;
>> int ret;
>>
>> @@ -142,6 +144,8 @@ int bpf_prog_test_run_skb(struct bpf_prog *prog, const
>> union bpf_attr *kattr,
>> kfree(data);
>> return -ENOMEM;
>> }
>> + sock_init_data(NULL, &sk);
>> + skb->sk = &sk;
>
> I was about to apply it, but it crashes as:
> [ 16.830822] BUG: unable to handle kernel paging request at 000000014427b974
> [ 16.831363] PGD 8000000135ecf067 P4D 8000000135ecf067 PUD 0
> [ 16.831792] Oops: 0000 [#1] SMP PTI
> [ 16.832061] CPU: 1 PID: 1965 Comm: test_verifier Not tainted
> 4.19.0-rc7-02550-ga76dee97ff12 #1153
> [ 16.832712] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
> 1.11.0-2.el7 04/01/2014
> [ 16.833358] RIP: 0010:cmp_map_id+0x10/0x50
> [ 16.835036] RSP: 0018:ffffc9000080faf8 EFLAGS: 00010246
> [ 16.835429] RAX: 00000000ffffffff RBX: 0000000036069ee8 RCX:
> 0000000000000000
> [ 16.835958] RDX: 000000014427b970 RSI: 000000014427b970 RDI:
> ffffc9000080fb44
> [ 16.836496] RBP: 000000000000000c R08: ffffffff810f7330 R09:
> 0000000036069ee8
> [ 16.837026] R10: 0000000000000000 R11: 0000000000000001 R12:
> 0000000000000000
> [ 16.837554] R13: ffffffff810f7330 R14: 000000014427b970 R15:
> 000000001b034f74
> [ 16.838083] FS: 00007fae50663700(0000) GS:ffff88013ba80000(0000)
> knlGS:0000000000000000
> [ 16.838677] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [ 16.839105] CR2: 000000014427b974 CR3: 0000000135934005 CR4:
> 00000000003606e0
> [ 16.839632] DR0: 0000000000000000 DR1: 0000000000000000 DR2:
> 0000000000000000
> [ 16.840157] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7:
> 0000000000000400
> [ 16.840682] Call Trace:
> [ 16.840897] bsearch+0x50/0x90
> [ 16.841144] map_id_range_down+0x81/0xa0
> [ 16.841438] make_kuid+0xf/0x10
> [ 16.841677] sock_init_data+0x24f/0x260
> [ 16.841979] bpf_prog_test_run_skb+0x9e/0x270
>
> I suspect sock_net_set(sk, &init_net) is necessary before sock_init_data()
> call.
I am not able to repro this, even with CONFIG_KASAN and CONFIG_PAGE_POISONING.
Let me try a better approach on this.
Thanks,
Song
