torvalds/linux
3
0
Fork 0
mirror of git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-03-22 07:27:12 +08:00
Code Issues Packages Projects Releases Wiki Activity

selftests/bpf: Add tests for arena fault reporting

Browse Source 
Add selftests for testing the reporting of arena page faults through BPF
streams. Two new bpf programs are added that read and write to an
unmapped arena address and the fault reporting is verified in the
userspace through streams.

The added bpf programs need to access the user_vm_start in struct
bpf_arena, this is done by casting &arena to struct bpf_arena *, but
barrier_var() is used on this ptr before accessing ptr->user_vm_start;
to stop GCC from issuing an out-of-bound access due to the cast from
smaller map struct to larger "struct bpf_arena"

Signed-off-by: Puranjay Mohan <puranjay@kernel.org>
Acked-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://lore.kernel.org/r/20250911145808.58042-7-puranjay@kernel.org
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
This commit is contained in:
Puranjay Mohan
2025-09-11 14:58:05 +00:00
committed by Alexei Starovoitov
parent edd03fcd76
commit 86f2225065
2 changed files with 190 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

49
tools/testing/selftests/bpf/prog_tests/stream.c
View File

@@ -57,3 +57,52 @@ void test_stream_syscall(void)
stream__destroy(skel);
}
static void test_address(struct bpf_program *prog, unsigned long *fault_addr_p)
{
LIBBPF_OPTS(bpf_test_run_opts, opts);
LIBBPF_OPTS(bpf_prog_stream_read_opts, ropts);
int ret, prog_fd;
char fault_addr[64];
char buf[1024];
prog_fd = bpf_program__fd(prog);
ret = bpf_prog_test_run_opts(prog_fd, &opts);
ASSERT_OK(ret, "ret");
ASSERT_OK(opts.retval, "retval");
sprintf(fault_addr, "0x%lx", *fault_addr_p);
ret = bpf_prog_stream_read(prog_fd, BPF_STREAM_STDERR, buf, sizeof(buf), &ropts);
ASSERT_GT(ret, 0, "stream read");
ASSERT_LE(ret, 1023, "len for buf");
buf[ret] = '\0';
if (!ASSERT_HAS_SUBSTR(buf, fault_addr, "fault_addr")) {
fprintf(stderr, "Output from stream:\n%s\n", buf);
fprintf(stderr, "Fault Addr: %s\n", fault_addr);
}
}
void test_stream_arena_fault_address(void)
{
struct stream *skel;
#if !defined(__x86_64__) && !defined(__aarch64__)
printf("%s:SKIP: arena fault reporting not supported\n", __func__);
test__skip();
return;
#endif
skel = stream__open_and_load();
if (!ASSERT_OK_PTR(skel, "stream__open_and_load"))
return;
if (test__start_subtest("read_fault"))
test_address(skel->progs.stream_arena_read_fault, &skel->bss->fault_addr);
if (test__start_subtest("write_fault"))
test_address(skel->progs.stream_arena_write_fault, &skel->bss->fault_addr);
stream__destroy(skel);
}

141
tools/testing/selftests/bpf/progs/stream.c
View File

@@ -5,6 +5,7 @@
#include <bpf/bpf_helpers.h>
#include "bpf_misc.h"
#include "bpf_experimental.h"
#include "bpf_arena_common.h"
struct arr_elem {
struct bpf_res_spin_lock lock;
@@ -17,10 +18,29 @@ struct {
__type(value, struct arr_elem);
} arrmap SEC(".maps");
struct {
__uint(type, BPF_MAP_TYPE_ARENA);
__uint(map_flags, BPF_F_MMAPABLE);
__uint(max_entries, 1); /* number of pages */
} arena SEC(".maps");
struct elem {
struct bpf_timer timer;
};
struct {
__uint(type, BPF_MAP_TYPE_ARRAY);
__uint(max_entries, 1);
__type(key, int);
__type(value, struct elem);
} array SEC(".maps");
#define ENOSPC 28
#define _STR "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
int size;
u64 fault_addr;
void *arena_ptr;
SEC("syscall")
__success __retval(0)
@@ -93,4 +113,125 @@ int stream_syscall(void *ctx)
return 0;
}
SEC("syscall")
__arch_x86_64
__arch_arm64
__success __retval(0)
__stderr("ERROR: Arena WRITE access at unmapped address 0x{{.*}}")
__stderr("CPU: {{[0-9]+}} UID: 0 PID: {{[0-9]+}} Comm: {{.*}}")
__stderr("Call trace:\n"
"{{([a-zA-Z_][a-zA-Z0-9_]*\\+0x[0-9a-fA-F]+/0x[0-9a-fA-F]+\n"
"|[ \t]+[^\n]+\n)*}}")
int stream_arena_write_fault(void *ctx)
{
struct bpf_arena *ptr = (void *)&arena;
u64 user_vm_start;
/* Prevent GCC bounds warning: casting &arena to struct bpf_arena *
* triggers bounds checking since the map definition is smaller than struct
* bpf_arena. barrier_var() makes the pointer opaque to GCC, preventing the
* bounds analysis
*/
barrier_var(ptr);
user_vm_start = ptr->user_vm_start;
fault_addr = user_vm_start + 0x7fff;
bpf_addr_space_cast(user_vm_start, 0, 1);
asm volatile (
"r1 = %0;"
"r2 = 1;"
"*(u32 *)(r1 + 0x7fff) = r2;"
:
: "r" (user_vm_start)
: "r1", "r2"
);
return 0;
}
SEC("syscall")
__arch_x86_64
__arch_arm64
__success __retval(0)
__stderr("ERROR: Arena READ access at unmapped address 0x{{.*}}")
__stderr("CPU: {{[0-9]+}} UID: 0 PID: {{[0-9]+}} Comm: {{.*}}")
__stderr("Call trace:\n"
"{{([a-zA-Z_][a-zA-Z0-9_]*\\+0x[0-9a-fA-F]+/0x[0-9a-fA-F]+\n"
"|[ \t]+[^\n]+\n)*}}")
int stream_arena_read_fault(void *ctx)
{
struct bpf_arena *ptr = (void *)&arena;
u64 user_vm_start;
/* Prevent GCC bounds warning: casting &arena to struct bpf_arena *
* triggers bounds checking since the map definition is smaller than struct
* bpf_arena. barrier_var() makes the pointer opaque to GCC, preventing the
* bounds analysis
*/
barrier_var(ptr);
user_vm_start = ptr->user_vm_start;
fault_addr = user_vm_start + 0x7fff;
bpf_addr_space_cast(user_vm_start, 0, 1);
asm volatile (
"r1 = %0;"
"r1 = *(u32 *)(r1 + 0x7fff);"
:
: "r" (user_vm_start)
: "r1"
);
return 0;
}
static __noinline void subprog(void)
{
int __arena *addr = (int __arena *)0xdeadbeef;
arena_ptr = &arena;
*addr = 1;
}
SEC("syscall")
__arch_x86_64
__arch_arm64
__success __retval(0)
__stderr("ERROR: Arena WRITE access at unmapped address 0x{{.*}}")
__stderr("CPU: {{[0-9]+}} UID: 0 PID: {{[0-9]+}} Comm: {{.*}}")
__stderr("Call trace:\n"
"{{([a-zA-Z_][a-zA-Z0-9_]*\\+0x[0-9a-fA-F]+/0x[0-9a-fA-F]+\n"
"|[ \t]+[^\n]+\n)*}}")
int stream_arena_subprog_fault(void *ctx)
{
subprog();
return 0;
}
static __noinline int timer_cb(void *map, int *key, struct bpf_timer *timer)
{
int __arena *addr = (int __arena *)0xdeadbeef;
arena_ptr = &arena;
*addr = 1;
return 0;
}
SEC("syscall")
__arch_x86_64
__arch_arm64
__success __retval(0)
__stderr("ERROR: Arena WRITE access at unmapped address 0x{{.*}}")
__stderr("CPU: {{[0-9]+}} UID: 0 PID: {{[0-9]+}} Comm: {{.*}}")
__stderr("Call trace:\n"
"{{([a-zA-Z_][a-zA-Z0-9_]*\\+0x[0-9a-fA-F]+/0x[0-9a-fA-F]+\n"
"|[ \t]+[^\n]+\n)*}}")
int stream_arena_callback_fault(void *ctx)
{
struct bpf_timer *arr_timer;
arr_timer = bpf_map_lookup_elem(&array, &(int){0});
if (!arr_timer)
return 0;
bpf_timer_init(arr_timer, &array, 1);
bpf_timer_set_callback(arr_timer, timer_cb);
bpf_timer_start(arr_timer, 0, 0);
return 0;
}
char _license[] SEC("license") = "GPL";