Add a new mm_kfunc test suite that is responsible for verifying the
behaviour of the newly added mm_struct based BPF kfuncs. As of now,
these selftests cover the operability of the following:
struct mm_struct *bpf_task_mm_grab(struct task_struct *task);
void bpf_mm_drop(struct mm_struct *mm);
Signed-off-by: Matt Bobrowski <mattbobrowski@xxxxxxxxxx>
---
.../selftests/bpf/prog_tests/mm_kfunc.c | 48 ++++++++
.../selftests/bpf/progs/mm_kfunc_common.h | 19 ++++
.../selftests/bpf/progs/mm_kfunc_failure.c | 103 ++++++++++++++++++
.../selftests/bpf/progs/mm_kfunc_success.c | 30 +++++
4 files changed, 200 insertions(+)
create mode 100644 tools/testing/selftests/bpf/prog_tests/mm_kfunc.c
create mode 100644 tools/testing/selftests/bpf/progs/mm_kfunc_common.h
create mode 100644 tools/testing/selftests/bpf/progs/mm_kfunc_failure.c
create mode 100644 tools/testing/selftests/bpf/progs/mm_kfunc_success.c
diff --git a/tools/testing/selftests/bpf/prog_tests/mm_kfunc.c b/tools/testing/selftests/bpf/prog_tests/mm_kfunc.c
new file mode 100644
index 000000000000..aece5c25486d
--- /dev/null
+++ b/tools/testing/selftests/bpf/prog_tests/mm_kfunc.c
@@ -0,0 +1,48 @@
+// SPDX-License-Identifier: GPL-2.0
+/* Copyright (c) 2024 Google LLC. */
+
+#define _GNU_SOURCE
+#include <test_progs.h>
+
+#include "mm_kfunc_failure.skel.h"
+#include "mm_kfunc_success.skel.h"
+
+static void run_test(const char *prog_name)
+{
+ struct bpf_link *link;
+ struct bpf_program *prog;
+ struct mm_kfunc_success *skel;
+
+ skel = mm_kfunc_success__open_and_load();
+ if (!ASSERT_OK_PTR(skel, "mm_kfunc_success__open_and_load"))
+ return;
+
+ link = NULL;
+ prog = bpf_object__find_program_by_name(skel->obj, prog_name);
+ if (!ASSERT_OK_PTR(prog, "bpf_object__find_program_by_name"))
+ goto cleanup;
+
+ link = bpf_program__attach(prog);
+ ASSERT_OK_PTR(link, "bpf_program__attach");
+cleanup:
+ bpf_link__destroy(link);
+ mm_kfunc_success__destroy(skel);
+}
+
+static const char * const success_tests[] = {
+ "task_mm_grab_drop_from_argument",
+ "task_mm_acquire_release_from_current",
+};
+
+void test_mm_kfunc(void)
+{
+ int i = 0;
+
+ for (; i < ARRAY_SIZE(success_tests); i++) {
+ if (!test__start_subtest(success_tests[i]))
+ continue;
+ run_test(success_tests[i]);
+ }
+
+ RUN_TESTS(mm_kfunc_failure);
+}
diff --git a/tools/testing/selftests/bpf/progs/mm_kfunc_common.h b/tools/testing/selftests/bpf/progs/mm_kfunc_common.h
new file mode 100644
index 000000000000..043d74d4148b
--- /dev/null
+++ b/tools/testing/selftests/bpf/progs/mm_kfunc_common.h
@@ -0,0 +1,19 @@
+// SPDX-License-Identifier: GPL-2.0
+/* Copyright (c) 2024 Google LLC. */
+
+#ifndef _MM_KFUNC_COMMON_H
+#define _MM_KFUNC_COMMON_H
+
+#include <vmlinux.h>
+#include <errno.h>
+#include <bpf/bpf_helpers.h>
+#include <bpf/bpf_tracing.h>
+
+#include "bpf_misc.h"
+
+struct mm_struct *bpf_task_mm_grab(struct task_struct *task) __ksym;
+void bpf_mm_drop(struct mm_struct *mm) __ksym;
+
+char _license[] SEC("license") = "GPL";
+
+#endif /* _MM_KFUNC_COMMON_H */
diff --git a/tools/testing/selftests/bpf/progs/mm_kfunc_failure.c b/tools/testing/selftests/bpf/progs/mm_kfunc_failure.c
new file mode 100644
index 000000000000..d818dfcab20e
--- /dev/null
+++ b/tools/testing/selftests/bpf/progs/mm_kfunc_failure.c
@@ -0,0 +1,103 @@
+// SPDX-License-Identifier: GPL-2.0
+/* Copyright (c) 2024 Google LLC. */
+
+#include "mm_kfunc_common.h"
+
+SEC("lsm.s/file_open")
+__failure __msg("Possibly NULL pointer passed to trusted arg0")
+int BPF_PROG(task_mm_grab_null_kfunc)
+{
+ struct mm_struct *acquired;
+
+ /* Can't pass a NULL pointer to bpf_task_mm_grab(). */
+ acquired = bpf_task_mm_grab(NULL);
+ if (!acquired)
+ return 0;
+ bpf_mm_drop(acquired);
+
+ return 0;
+}
+
+SEC("lsm/task_free")
+__failure __msg("R1 must be referenced or trusted")
+int BPF_PROG(task_mm_grab_from_lsm_task_free_kfunc, struct task_struct *task)
+{
+ struct mm_struct *acquired;
+
+ /* The task_struct supplied to this LSM hook isn't trusted. */
+ acquired = bpf_task_mm_grab(task);
+ if (!acquired)
+ return 0;
+ bpf_mm_drop(acquired);
+
+ return 0;
+}
+
+SEC("lsm.s/task_alloc")
+__failure __msg("arg#0 pointer type STRUCT task_struct must point")
+int BPF_PROG(task_mm_grab_fp_kfunc, struct task_struct *task, u64 clone_flags)
+{
+ struct task_struct *fp;
+ struct mm_struct *acquired;
+
+ fp = (struct task_struct *)&clone_flags;
+ /* Can't pass random frame pointer to bpf_task_mm_grab(). */
+ acquired = bpf_task_mm_grab(fp);
+ if (!acquired)
+ return 0;
+ bpf_mm_drop(acquired);
+
+ return 0;
+}
+
+SEC("lsm.s/task_alloc")
+__failure __msg("Unreleased reference")
+int BPF_PROG(task_mm_grab_unreleased_kfunc, struct task_struct *task)
+{
+ struct mm_struct *acquired;
+
+ acquired = bpf_task_mm_grab(task);
+ __sink(acquired);
+
+ /* Acquired but never released. */
+ return 0;
+}
+
+SEC("lsm.s/task_alloc")
+__failure __msg("R1 must be referenced or trusted")
+int BPF_PROG(task_mm_drop_untrusted_kfunc, struct task_struct *task)
+{
+ struct mm_struct *acquired;
+
+ /* task->mm from struct task_struct yields an untrusted pointer. */
+ acquired = task->mm;
+ if (!acquired)
+ return 0;
+ bpf_mm_drop(acquired);
+
+ return 0;
+}
+
+SEC("lsm/vm_enough_memory")
+__failure __msg("release kernel function bpf_mm_drop expects")
+int BPF_PROG(mm_drop_unacquired_kfunc, struct mm_struct *mm)
+{
+ /* Can't release an unacquired pointer. */
+ bpf_mm_drop(mm);
+
+ return 0;
+}
+
+SEC("lsm/vm_enough_memory")
+__failure __msg("arg#0 pointer type STRUCT mm_struct must point")
+int BPF_PROG(mm_drop_fp_kfunc, struct mm_struct *mm, long pages)
+{
+ struct mm_struct *fp;
+
+ fp = (struct mm_struct *)&pages;
+
+ /* Can't release random frame pointer. */
+ bpf_mm_drop(fp);
+
+ return 0;
+}
diff --git a/tools/testing/selftests/bpf/progs/mm_kfunc_success.c b/tools/testing/selftests/bpf/progs/mm_kfunc_success.c
new file mode 100644
index 000000000000..5400abd2ee2d
--- /dev/null
+++ b/tools/testing/selftests/bpf/progs/mm_kfunc_success.c
@@ -0,0 +1,30 @@
+// SPDX-License-Identifier: GPL-2.0
+/* Copyright (c) 2024 Google LLC. */
+
+#include "mm_kfunc_common.h"
+
+SEC("lsm.s/task_alloc")
+int BPF_PROG(task_mm_grab_drop_from_argument, struct task_struct *task)
+{
+ struct mm_struct *acquired;
+
+ acquired = bpf_task_mm_grab(task);
+ if (!acquired)
+ return 0;
+ bpf_mm_drop(acquired);
+
+ return 0;
+}
+
+SEC("lsm.s/file_open")
+int BPF_PROG(task_mm_acquire_release_from_current)
+{
+ struct mm_struct *acquired;
+
+ acquired = bpf_task_mm_grab(bpf_get_current_task_btf());
+ if (!acquired)
+ return 0;
+ bpf_mm_drop(acquired);
+
+ return 0;
+}
--
2.44.0.rc0.258.g7320e95886-goog
/M
