Being able to pass a BTF struct sock* to bpf_sk_release would screw up
reference counting, and must therefore be prevented. Add a test which
ensures that this property holds.
Signed-off-by: Lorenz Bauer <lmb@xxxxxxxxxxxxxx>
---
.../bpf/prog_tests/reference_tracking.c | 20 ++++++++++++++++++-
.../bpf/progs/test_sk_ref_track_invalid.c | 20 +++++++++++++++++++
2 files changed, 39 insertions(+), 1 deletion(-)
create mode 100644 tools/testing/selftests/bpf/progs/test_sk_ref_track_invalid.c
diff --git a/tools/testing/selftests/bpf/prog_tests/reference_tracking.c b/tools/testing/selftests/bpf/prog_tests/reference_tracking.c
index ac1ee10cffd8..3f19c8a16bb4 100644
--- a/tools/testing/selftests/bpf/prog_tests/reference_tracking.c
+++ b/tools/testing/selftests/bpf/prog_tests/reference_tracking.c
@@ -1,7 +1,8 @@
// SPDX-License-Identifier: GPL-2.0
#include <test_progs.h>
+#include "test_sk_ref_track_invalid.skel.h"
-void test_reference_tracking(void)
+static void test_sk_lookup(void)
{
const char *file = "test_sk_lookup_kern.o";
const char *obj_name = "ref_track";
@@ -50,3 +51,20 @@ void test_reference_tracking(void)
cleanup:
bpf_object__close(obj);
}
+
+static void test_sk_release_invalid(void)
+{
+ struct test_sk_ref_track_invalid *skel;
+ int duration = 0;
+
+ skel = test_sk_ref_track_invalid__open_and_load();
+ if (CHECK(skel, "open_and_load", "verifier accepted sk_release of BTF struct sock*\n"))
+ test_sk_ref_track_invalid__destroy(skel);
+}
+
+void test_reference_tracking(void)
+{
+ test_sk_lookup();
+ if (test__start_subtest("invalid sk_release"))
+ test_sk_release_invalid();
+}
diff --git a/tools/testing/selftests/bpf/progs/test_sk_ref_track_invalid.c b/tools/testing/selftests/bpf/progs/test_sk_ref_track_invalid.c
new file mode 100644
index 000000000000..9017d92a807b
--- /dev/null
+++ b/tools/testing/selftests/bpf/progs/test_sk_ref_track_invalid.c
@@ -0,0 +1,20 @@
+// SPDX-License-Identifier: GPL-2.0
+// Copyright (c) 2020 Cloudflare
+
+#include "bpf_iter.h"
+#include <bpf/bpf_helpers.h>
+#include <bpf/bpf_endian.h>
+#include <bpf/bpf_tracing.h>
+
+char _license[] SEC("license") = "GPL";
+
+SEC("iter/bpf_sk_storage_map")
+int dump_bpf_sk_storage_map(struct bpf_iter__bpf_sk_storage_map *ctx)
+{
+ struct sock *sk = ctx->sk;
+
+ if (sk)
+ bpf_sk_release((struct bpf_sock *)sk);
+
+ return 0;
+}
--
2.25.1
