selftests/bpf: test references to sock_common
authorLorenz Bauer <lmb@cloudflare.com>
Fri, 22 Mar 2019 01:54:05 +0000 (09:54 +0800)
committerAlexei Starovoitov <ast@kernel.org>
Fri, 22 Mar 2019 01:59:11 +0000 (18:59 -0700)
Make sure that returning a struct sock_common * reference invokes
the reference tracking machinery in the verifier.

Signed-off-by: Lorenz Bauer <lmb@cloudflare.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
tools/testing/selftests/bpf/verifier/ref_tracking.c

index a6905e5..ebcbf15 100644 (file)
        .result = REJECT,
 },
 {
+       "reference tracking: leak potential reference to sock_common",
+       .insns = {
+       BPF_SK_LOOKUP(skc_lookup_tcp),
+       BPF_MOV64_REG(BPF_REG_6, BPF_REG_0), /* leak reference */
+       BPF_EXIT_INSN(),
+       },
+       .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+       .errstr = "Unreleased reference",
+       .result = REJECT,
+},
+{
        "reference tracking: leak potential reference on stack",
        .insns = {
        BPF_SK_LOOKUP(sk_lookup_tcp),
        .result = REJECT,
 },
 {
+       "reference tracking: zero potential reference to sock_common",
+       .insns = {
+       BPF_SK_LOOKUP(skc_lookup_tcp),
+       BPF_MOV64_IMM(BPF_REG_0, 0), /* leak reference */
+       BPF_EXIT_INSN(),
+       },
+       .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+       .errstr = "Unreleased reference",
+       .result = REJECT,
+},
+{
        "reference tracking: copy and zero potential references",
        .insns = {
        BPF_SK_LOOKUP(sk_lookup_tcp),
        .result = REJECT,
 },
 {
+       "reference tracking: release reference to sock_common without check",
+       .insns = {
+       BPF_SK_LOOKUP(skc_lookup_tcp),
+       /* reference in r0 may be NULL */
+       BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
+       BPF_MOV64_IMM(BPF_REG_2, 0),
+       BPF_EMIT_CALL(BPF_FUNC_sk_release),
+       BPF_EXIT_INSN(),
+       },
+       .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+       .errstr = "type=sock_common_or_null expected=sock",
+       .result = REJECT,
+},
+{
        "reference tracking: release reference",
        .insns = {
        BPF_SK_LOOKUP(sk_lookup_tcp),
        .result = ACCEPT,
 },
 {
+       "reference tracking: release reference to sock_common",
+       .insns = {
+       BPF_SK_LOOKUP(skc_lookup_tcp),
+       BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
+       BPF_EMIT_CALL(BPF_FUNC_sk_release),
+       BPF_EXIT_INSN(),
+       },
+       .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+       .result = ACCEPT,
+},
+{
        "reference tracking: release reference 2",
        .insns = {
        BPF_SK_LOOKUP(sk_lookup_tcp),