On Fri, Aug 23, 2024 at 3:20 PM Daniel Borkmann <daniel@xxxxxxxxxxxxx> wrote:
>
> Add a test case which attempts to write into .rodata section of the
> BPF program, and for comparison this adds test cases also for .bss
> and .data section.
>
> Before fix:
>
> # ./vmtest.sh -- ./test_progs -t verifier_const
> [...]
> ./test_progs -t verifier_const
> tester_init:PASS:tester_log_buf 0 nsec
> process_subtest:PASS:obj_open_mem 0 nsec
> process_subtest:PASS:specs_alloc 0 nsec
> run_subtest:PASS:obj_open_mem 0 nsec
> run_subtest:FAIL:unexpected_load_success unexpected success: 0
> #465/1 verifier_const/rodata: write rejected:FAIL
> #465/2 verifier_const/bss: write accepted:OK
> #465/3 verifier_const/data: write accepted:OK
> #465 verifier_const:FAIL
> [...]
>
> After fix:
>
> # ./vmtest.sh -- ./test_progs -t verifier_const
> [...]
> ./test_progs -t verifier_const
> #465/1 verifier_const/rodata: write rejected:OK
> #465/2 verifier_const/bss: write accepted:OK
> #465/3 verifier_const/data: write accepted:OK
> #465 verifier_const:OK
> [...]
>
> Signed-off-by: Daniel Borkmann <daniel@xxxxxxxxxxxxx>
> ---
> .../selftests/bpf/prog_tests/tc_links.c | 1 +
> .../selftests/bpf/prog_tests/verifier.c | 2 +
> .../selftests/bpf/progs/verifier_const.c | 42 +++++++++++++++++++
> 3 files changed, 45 insertions(+)
> create mode 100644 tools/testing/selftests/bpf/progs/verifier_const.c
>
> diff --git a/tools/testing/selftests/bpf/prog_tests/tc_links.c b/tools/testing/selftests/bpf/prog_tests/tc_links.c
> index 1af9ec1149aa..92c647dfd6f1 100644
> --- a/tools/testing/selftests/bpf/prog_tests/tc_links.c
> +++ b/tools/testing/selftests/bpf/prog_tests/tc_links.c
> @@ -9,6 +9,7 @@
> #define ping_cmd "ping -q -c1 -w1 127.0.0.1 > /dev/null"
>
> #include "test_tc_link.skel.h"
> +#include "test_const.skel.h"
>
> #include "netlink_helpers.h"
> #include "tc_helpers.h"
> diff --git a/tools/testing/selftests/bpf/prog_tests/verifier.c b/tools/testing/selftests/bpf/prog_tests/verifier.c
> index 9dc3687bc406..c0cb1a145274 100644
> --- a/tools/testing/selftests/bpf/prog_tests/verifier.c
> +++ b/tools/testing/selftests/bpf/prog_tests/verifier.c
> @@ -21,6 +21,7 @@
> #include "verifier_cgroup_inv_retcode.skel.h"
> #include "verifier_cgroup_skb.skel.h"
> #include "verifier_cgroup_storage.skel.h"
> +#include "verifier_const.skel.h"
> #include "verifier_const_or.skel.h"
> #include "verifier_ctx.skel.h"
> #include "verifier_ctx_sk_msg.skel.h"
> @@ -140,6 +141,7 @@ void test_verifier_cfg(void) { RUN(verifier_cfg); }
> void test_verifier_cgroup_inv_retcode(void) { RUN(verifier_cgroup_inv_retcode); }
> void test_verifier_cgroup_skb(void) { RUN(verifier_cgroup_skb); }
> void test_verifier_cgroup_storage(void) { RUN(verifier_cgroup_storage); }
> +void test_verifier_const(void) { RUN(verifier_const); }
> void test_verifier_const_or(void) { RUN(verifier_const_or); }
> void test_verifier_ctx(void) { RUN(verifier_ctx); }
> void test_verifier_ctx_sk_msg(void) { RUN(verifier_ctx_sk_msg); }
> diff --git a/tools/testing/selftests/bpf/progs/verifier_const.c b/tools/testing/selftests/bpf/progs/verifier_const.c
> new file mode 100644
> index 000000000000..81302d9738fa
> --- /dev/null
> +++ b/tools/testing/selftests/bpf/progs/verifier_const.c
> @@ -0,0 +1,42 @@
> +// SPDX-License-Identifier: GPL-2.0
> +/* Copyright (c) 2024 Isovalent */
> +
> +#include <linux/bpf.h>
> +#include <bpf/bpf_helpers.h>
> +#include "bpf_misc.h"
> +
> +const long foo = 42;
nit: would be "safer" to mark it as "const volatile long" to prevent
whatever smartness compiler might decide to do
> +long bar;
> +long bart = 96;
> +
> +SEC("tc/ingress")
> +__description("rodata: write rejected")
> +__failure __msg("write into map forbidden")
> +int tcx1(struct __sk_buff *skb)
> +{
> + char buff[] = { '8', '4', '\0' };
> + bpf_strtol(buff, sizeof(buff), 0, (long *)&foo);
> + return TCX_PASS;
> +}
> +
> +SEC("tc/ingress")
> +__description("bss: write accepted")
> +__success
> +int tcx2(struct __sk_buff *skb)
> +{
> + char buff[] = { '8', '4', '\0' };
> + bpf_strtol(buff, sizeof(buff), 0, &bar);
> + return TCX_PASS;
> +}
> +
> +SEC("tc/ingress")
> +__description("data: write accepted")
> +__success
> +int tcx3(struct __sk_buff *skb)
> +{
> + char buff[] = { '8', '4', '\0' };
> + bpf_strtol(buff, sizeof(buff), 0, &bart);
> + return TCX_PASS;
> +}
> +
> +char LICENSE[] SEC("license") = "GPL";
> --
> 2.43.0
>
>
