April 2022 - Linux-kselftest-mirror

[PATCH] userfaultfd/selftests: use swap() instead of open coding it

by Guo Zhengkui

Address the following coccicheck warning: tools/testing/selftests/vm/userfaultfd.c:1536:21-22: WARNING opportunity for swap(). tools/testing/selftests/vm/userfaultfd.c:1540:33-34: WARNING opportunity for swap(). by using swap() for the swapping of variable values and drop `tmp_area` that is not needed any more. `swap()` macro in userfaultfd.c is introduced in commit 681696862bc18 ("selftests: vm: remove dependecy from internal kernel macros") It has been tested with gcc (Debian 8.3.0-6) 8.3.0. Signed-off-by: Guo Zhengkui <guozhengkui(a)vivo.com> --- tools/testing/selftests/vm/userfaultfd.c | 9 ++------- 1 file changed, 2 insertions(+), 7 deletions(-) diff --git a/tools/testing/selftests/vm/userfaultfd.c b/tools/testing/selftests/vm/userfaultfd.c index 92a4516f8f0d..7aba3ced7545 100644 --- a/tools/testing/selftests/vm/userfaultfd.c +++ b/tools/testing/selftests/vm/userfaultfd.c @@ -1422,7 +1422,6 @@ static void userfaultfd_pagemap_test(unsigned int test_pgsize) static int userfaultfd_stress(void) { void *area; - char *tmp_area; unsigned long nr; struct uffdio_register uffdio_register; struct uffd_stats uffd_stats[nr_cpus]; @@ -1533,13 +1532,9 @@ static int userfaultfd_stress(void) count_verify[nr], nr); /* prepare next bounce */ - tmp_area = area_src; - area_src = area_dst; - area_dst = tmp_area; + swap(area_src, area_dst); - tmp_area = area_src_alias; - area_src_alias = area_dst_alias; - area_dst_alias = tmp_area; + swap(area_src_alias, area_dst_alias); uffd_stats_report(uffd_stats, nr_cpus); } -- 2.20.1

2 years, 11 months

3
2
0 0

WARNING: at arch/x86/kvm/../../../virt/kvm/kvm_main.c:3156 mark_page_dirty_in_slot

by Naresh Kamboju

While running kselftest kvm test cases on x86_64 devices the following kernel warning was reported. metadata: git_ref: master git_repo: https://gitlab.com/Linaro/lkft/mirrors/torvalds/linux-mainline git_sha: 1930a6e739c4b4a654a69164dbe39e554d228915 git_describe: v5.17-12882-g1930a6e739c4 kernel_version: 5.17.0 kernel-config: https://builds.tuxbuild.com/272RGo17Agp9s62duqGs3mP2d0S/config # selftests: kvm: evmcs_test # Running L1 which uses EVMCS to run L2 # Injecting NMI into L1 before L2 had a chance to run after restore # Trying extra KVM_GET_NESTED_STATE/KVM_SET_NESTED_STATE cycle ok 4 selftests: kvm: evmcs_test # selftests: kvm: emulator_error_test # module parameter 'allow_smaller_maxphyaddr' is not set. Skipping test. ok 5 selftests: kvm: emulator_error_test # selftests: kvm: hyperv_clock [ 62.510388] ------------[ cut here ]------------ [ 62.515064] WARNING: CPU: 1 PID: 915 at arch/x86/kvm/../../../virt/kvm/kvm_main.c:3156 mark_page_dirty_in_slot+0xba/0xd0 [ 62.525968] Modules linked in: x86_pkg_temp_thermal fuse [ 62.531307] CPU: 1 PID: 915 Comm: hyperv_clock Not tainted 5.17.0 #1 [ 62.537691] Hardware name: Supermicro SYS-5019S-ML/X11SSH-F, BIOS 2.0b 07/27/2017 [ 62.545185] RIP: 0010:mark_page_dirty_in_slot+0xba/0xd0 [ 62.550452] Code: 89 ea 09 c6 e8 57 d4 00 00 5b 41 5c 41 5d 41 5e 5d c3 48 8b 83 c0 00 00 00 49 63 d5 f0 48 0f ab 10 5b 41 5c 41 5d 41 5e 5d c3 <0f> 0b 5b 41 5c 41 5d 41 5e 5d c3 0f 1f 44 00 00 eb 80 0f 1f 40 00 [ 62.569265] RSP: 0018:ffffa347c1663b50 EFLAGS: 00010246 [ 62.574502] RAX: 0000000080000000 RBX: ffff8f01149ce600 RCX: 0000000000000000 [ 62.581700] RDX: 0000000000000000 RSI: ffffffffa302ab31 RDI: ffffffffa302ab31 [ 62.588874] RBP: ffffa347c1663b70 R08: 0000000000000000 R09: 0000000000000001 [ 62.596046] R10: 0000000000000001 R11: 0000000000000000 R12: ffffa347c1665000 [ 62.603213] R13: 0000000000000022 R14: 0000000000000000 R15: 0000000000000004 [ 62.610389] FS: 00007fe3799c1740(0000) GS:ffff8f041fc80000(0000) knlGS:0000000000000000 [ 62.618697] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 62.624467] CR2: 0000000000000000 CR3: 000000010614e004 CR4: 00000000003726e0 [ 62.631684] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 62.638833] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 62.646009] Call Trace: [ 62.648480] <TASK> [ 62.650604] __kvm_write_guest_page+0xc8/0x100 [ 62.655112] kvm_write_guest+0x61/0xb0 [ 62.658884] kvm_hv_invalidate_tsc_page+0xd3/0x140 [ 62.663699] ? kvm_hv_invalidate_tsc_page+0x72/0x140 [ 62.668684] kvm_arch_vm_ioctl+0x20f/0xbc0 [ 62.672798] ? __lock_acquire+0x3af/0x2450 [ 62.676956] ? __this_cpu_preempt_check+0x13/0x20 [ 62.681706] kvm_vm_ioctl+0x6f1/0xe20 [ 62.685423] ? ktime_get_coarse_real_ts64+0xc7/0xd0 [ 62.690323] ? __this_cpu_preempt_check+0x13/0x20 [ 62.695048] ? lockdep_hardirqs_on+0x7e/0x100 [ 62.699423] ? blk_log_with_error+0x3b/0x70 [ 62.703644] ? __audit_syscall_entry+0xcd/0x130 [ 62.708220] ? selinux_file_ioctl+0xa6/0x130 [ 62.712542] ? selinux_file_ioctl+0xa6/0x130 [ 62.716869] __x64_sys_ioctl+0x91/0xc0 [ 62.720686] do_syscall_64+0x5c/0x80 [ 62.724305] ? __this_cpu_preempt_check+0x13/0x20 [ 62.729059] ? lock_is_held_type+0xdd/0x130 [ 62.733264] ? do_syscall_64+0x69/0x80 [ 62.737069] ? __this_cpu_preempt_check+0x13/0x20 [ 62.741791] ? lockdep_hardirqs_on+0x7e/0x100 [ 62.746219] ? syscall_exit_to_user_mode+0x3e/0x50 [ 62.751082] ? do_syscall_64+0x69/0x80 [ 62.754904] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 62.760027] RIP: 0033:0x7fe3792bf8f7 [ 62.763687] Code: b3 66 90 48 8b 05 a1 35 2c 00 64 c7 00 26 00 00 00 48 c7 c0 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 71 35 2c 00 f7 d8 64 89 01 48 [ 62.782497] RSP: 002b:00007ffe035acf38 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 62.790131] RAX: ffffffffffffffda RBX: 000000004030ae7b RCX: 00007fe3792bf8f7 [ 62.797334] RDX: 00007ffe035acf70 RSI: 000000004030ae7b RDI: 0000000000000006 [ 62.804539] RBP: 0000000000000007 R08: 000000000040e320 R09: 0000000000000007 [ 62.811737] R10: 000000000004da6b R11: 0000000000000246 R12: 00007fe3799c7000 [ 62.818914] R13: 0000000000000007 R14: 00000000000058cb R15: 00000000000e8f42 [ 62.826141] </TASK> [ 62.828378] irq event stamp: 6435 [ 62.831765] hardirqs last enabled at (6445): [<ffffffffa3272a88>] __up_console_sem+0x58/0x60 [ 62.840354] hardirqs last disabled at (6454): [<ffffffffa3272a6d>] __up_console_sem+0x3d/0x60 [ 62.848944] softirqs last enabled at (6392): [<ffffffffa4600341>] __do_softirq+0x341/0x4cc [ 62.857362] softirqs last disabled at (6473): [<ffffffffa31ef29f>] irq_exit_rcu+0xdf/0x140 [ 62.865700] ---[ end trace 0000000000000000 ]--- ok 6 selftests: kvm: hyperv_clock Reported-by: Linux Kernel Functional Testing <lkft(a)linaro.org> -- Linaro LKFT https://lkft.linaro.org [1] https://lkft.validation.linaro.org/scheduler/job/4805876#L1528

2 years, 11 months

3
2
0 0

Re: [PATCH v3] net: fix wrong network header length

by Lina Wang

On Thu, Feb 17, 2022 at 12:45 AM Paolo Abeni <pabeni(a)redhat.com> wrote: > > Hello, > > On Thu, 2022-02-17 at 15:01 +0800, Lina Wang wrote: > So that bpf helper has to be somehow involved, but iperf udp test > says nothing about it. > Please craft a _complete_ selftest. Finally, I have wrote selftest, please check https://lore.kernel.org/bpf/20220407084727.10241-1-lina.wang@mediatek.com/ https://lore.kernel.org/bpf/20220407084727.10241-2-lina.wang@mediatek.com/ https://lore.kernel.org/bpf/20220407084727.10241-3-lina.wang@mediatek.com/ Thanks

2 years, 11 months

1
0
0 0

[PATCH] testing/selftests/mqueue: Fix mq_perf_tests to free the allocated cpu set

by Athira Rajeev

The selftest "mqueue/mq_perf_tests.c" use CPU_ALLOC to allocate CPU set. This cpu set is used further in pthread_attr_setaffinity_np and by pthread_create in the code. But in current code, allocated cpu set is not freed. Fix this by adding CPU_FREE after its usage is done. Signed-off-by: Athira Rajeev <atrajeev(a)linux.vnet.ibm.com> --- tools/testing/selftests/mqueue/mq_perf_tests.c | 1 + 1 file changed, 1 insertion(+) diff --git a/tools/testing/selftests/mqueue/mq_perf_tests.c b/tools/testing/selftests/mqueue/mq_perf_tests.c index b019e0b8221c..17c41f216bef 100644 --- a/tools/testing/selftests/mqueue/mq_perf_tests.c +++ b/tools/testing/selftests/mqueue/mq_perf_tests.c @@ -732,6 +732,7 @@ int main(int argc, char *argv[]) pthread_attr_destroy(&thread_attr); } + CPU_FREE(cpu_set); if (!continuous_mode) { pthread_join(cpu_threads[0], &retval); shutdown((long)retval, "perf_test_thread()", __LINE__); -- 2.35.1

2 years, 11 months

2
2
0 0

[PATCH v2] selftest/vm clarify error statement in gup_test

by Sidhartha Kumar

Print three possible reasons /sys/kernel/debug/gup_test cannot be opened to help users of this test diagnose failures. Signed-off-by: Sidhartha Kumar <sidhartha.kumar(a)oracle.com> --- v2: - Add support for skipping the test due to unmet dependencies. - Use errno to print a more specific message. - Add check for root privileges. - dropped CC to stable. tools/testing/selftests/vm/gup_test.c | 22 +++++++++++++-- tools/testing/selftests/vm/run_vmtests.sh | 33 ++++++++++++++++------- 2 files changed, 44 insertions(+), 11 deletions(-) diff --git a/tools/testing/selftests/vm/gup_test.c b/tools/testing/selftests/vm/gup_test.c index fe043f67798b0..bdedaa6c58e18 100644 --- a/tools/testing/selftests/vm/gup_test.c +++ b/tools/testing/selftests/vm/gup_test.c @@ -1,7 +1,9 @@ #include <fcntl.h> +#include <errno.h> #include <stdio.h> #include <stdlib.h> #include <unistd.h> +#include <dirent.h> #include <sys/ioctl.h> #include <sys/mman.h> #include <sys/stat.h> @@ -9,6 +11,7 @@ #include <pthread.h> #include <assert.h> #include "../../../../mm/gup_test.h" +#include "../kselftest.h" #define MB (1UL << 20) #define PAGE_SIZE sysconf(_SC_PAGESIZE) @@ -205,8 +208,23 @@ int main(int argc, char **argv) gup_fd = open("/sys/kernel/debug/gup_test", O_RDWR); if (gup_fd == -1) { - perror("open"); - exit(1); + switch (errno) { + case EACCES: + if (getuid()) + printf("Please run this test as root\n"); + break; + case ENOENT: + if (opendir("/sys/kernel/debug") == NULL) { + printf("mount debugfs at /sys/kernel/debug\n"); + break; + } + printf("check if CONFIG_GUP_TEST is enabled in kernel config\n"); + break; + default: + perror("failed to open /sys/kernel/debug/gup_test"); + break; + } + exit(KSFT_SKIP); } p = mmap(NULL, size, PROT_READ | PROT_WRITE, flags, filed, 0); diff --git a/tools/testing/selftests/vm/run_vmtests.sh b/tools/testing/selftests/vm/run_vmtests.sh index 45e803af7c775..88e15fbb50278 100755 --- a/tools/testing/selftests/vm/run_vmtests.sh +++ b/tools/testing/selftests/vm/run_vmtests.sh @@ -127,22 +127,32 @@ echo "------------------------------------------------------" echo "running: gup_test -u # get_user_pages_fast() benchmark" echo "------------------------------------------------------" ./gup_test -u -if [ $? -ne 0 ]; then +ret_val=$? + +if [ $ret_val -eq 0 ]; then + echo "[PASS]" +elif [ $ret_val -eq $ksft_skip ]; then + echo "[SKIP]" + exitcode=$ksft_skip +else echo "[FAIL]" exitcode=1 -else - echo "[PASS]" fi echo "------------------------------------------------------" echo "running: gup_test -a # pin_user_pages_fast() benchmark" echo "------------------------------------------------------" ./gup_test -a -if [ $? -ne 0 ]; then +ret_val=$? + +if [ $ret_val -eq 0 ]; then + echo "[PASS]" +elif [ $ret_val -eq $ksft_skip ]; then + echo "[SKIP]" + exitcode=$ksft_skip +else echo "[FAIL]" exitcode=1 -else - echo "[PASS]" fi echo "------------------------------------------------------------" @@ -150,11 +160,16 @@ echo "# Dump pages 0, 19, and 4096, using pin_user_pages:" echo "running: gup_test -ct -F 0x1 0 19 0x1000 # dump_page() test" echo "------------------------------------------------------------" ./gup_test -ct -F 0x1 0 19 0x1000 -if [ $? -ne 0 ]; then +ret_val=$? + +if [ $ret_val -eq 0 ]; then + echo "[PASS]" +elif [ $ret_val -eq $ksft_skip ]; then + echo "[SKIP]" + exitcode=$ksft_skip +else echo "[FAIL]" exitcode=1 -else - echo "[PASS]" fi echo "-------------------" -- 2.27.0

2 years, 11 months

3
3
0 0

[PATCH bpf v5 1/2] bpf: Support dual-stack sockets in bpf_tcp_check_syncookie

by Maxim Mikityanskiy

bpf_tcp_gen_syncookie looks at the IP version in the IP header and validates the address family of the socket. It supports IPv4 packets in AF_INET6 dual-stack sockets. On the other hand, bpf_tcp_check_syncookie looks only at the address family of the socket, ignoring the real IP version in headers, and validates only the packet size. This implementation has some drawbacks: 1. Packets are not validated properly, allowing a BPF program to trick bpf_tcp_check_syncookie into handling an IPv6 packet on an IPv4 socket. 2. Dual-stack sockets fail the checks on IPv4 packets. IPv4 clients end up receiving a SYNACK with the cookie, but the following ACK gets dropped. This patch fixes these issues by changing the checks in bpf_tcp_check_syncookie to match the ones in bpf_tcp_gen_syncookie. IP version from the header is taken into account, and it is validated properly with address family. Fixes: 399040847084 ("bpf: add helper to check for a valid SYN cookie") Signed-off-by: Maxim Mikityanskiy <maximmi(a)nvidia.com> Reviewed-by: Tariq Toukan <tariqt(a)nvidia.com> Acked-by: Arthur Fabre <afabre(a)cloudflare.com> --- net/core/filter.c | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-) diff --git a/net/core/filter.c b/net/core/filter.c index a7044e98765e..64470a727ef7 100644 --- a/net/core/filter.c +++ b/net/core/filter.c @@ -7016,24 +7016,33 @@ BPF_CALL_5(bpf_tcp_check_syncookie, struct sock *, sk, void *, iph, u32, iph_len if (!th->ack || th->rst || th->syn) return -ENOENT; + if (unlikely(iph_len < sizeof(struct iphdr))) + return -EINVAL; + if (tcp_synq_no_recent_overflow(sk)) return -ENOENT; cookie = ntohl(th->ack_seq) - 1; - switch (sk->sk_family) { - case AF_INET: - if (unlikely(iph_len < sizeof(struct iphdr))) + /* Both struct iphdr and struct ipv6hdr have the version field at the + * same offset so we can cast to the shorter header (struct iphdr). + */ + switch (((struct iphdr *)iph)->version) { + case 4: + if (sk->sk_family == AF_INET6 && ipv6_only_sock(sk)) return -EINVAL; ret = __cookie_v4_check((struct iphdr *)iph, th, cookie); break; #if IS_BUILTIN(CONFIG_IPV6) - case AF_INET6: + case 6: if (unlikely(iph_len < sizeof(struct ipv6hdr))) return -EINVAL; + if (sk->sk_family != AF_INET6) + return -EINVAL; + ret = __cookie_v6_check((struct ipv6hdr *)iph, th, cookie); break; #endif /* CONFIG_IPV6 */ -- 2.30.2

2 years, 11 months

2
2
0 0

[PATCH bpf-next v3 00/27] bpf: RLIMIT_MEMLOCK cleanups

by Yafang Shao

We have switched to memcg based memory accouting and thus the rlimit is not needed any more. LIBBPF_STRICT_AUTO_RLIMIT_MEMLOCK was introduced in libbpf for backward compatibility, so we can use it instead now. This patchset cleanups the usage of RLIMIT_MEMLOCK in tools/bpf/, tools/testing/selftests/bpf and samples/bpf. The file tools/testing/selftests/bpf/bpf_rlimit.h is removed. The included header sys/resource.h is removed from many files as it is useless in these files. - v3: Get rid of bpf_rlimit.h and fix some typos (Andrii) - v2: Use libbpf_set_strict_mode instead. (Andrii) - v1: https://lore.kernel.org/bpf/20220320060815.7716-2-laoar.shao@gmail.com/ Yafang Shao (27): bpf: selftests: Use libbpf 1.0 API mode instead of RLIMIT_MEMLOCK in xdping bpf: selftests: Use libbpf 1.0 API mode instead of RLIMIT_MEMLOCK in xdpxceiver bpf: selftests: No need to include bpf_rlimit.h in test_tcpnotify_user bpf: selftests: No need to include bpf_rlimit.h in flow_dissector_load bpf: selftests: Set libbpf 1.0 API mode explicitly in get_cgroup_id_user bpf: selftests: Set libbpf 1.0 API mode explicitly in test_cgroup_storage bpf: selftests: Set libbpf 1.0 API mode explicitly in get_cgroup_id_user bpf: selftests: Set libbpf 1.0 API mode explicitly in test_lpm_map bpf: selftests: Set libbpf 1.0 API mode explicitly in test_lru_map bpf: selftests: Set libbpf 1.0 API mode explicitly in test_skb_cgroup_id_user bpf: selftests: Set libbpf 1.0 API mode explicitly in test_sock_addr bpf: selftests: Set libbpf 1.0 API mode explicitly in test_sock bpf: selftests: Set libbpf 1.0 API mode explicitly in test_sockmap bpf: selftests: Set libbpf 1.0 API mode explicitly in test_sysctl bpf: selftests: Set libbpf 1.0 API mode explicitly in test_tag bpf: selftests: Set libbpf 1.0 API mode explicitly in test_tcp_check_syncookie_user bpf: selftests: Set libbpf 1.0 API mode explicitly in test_verifier_log bpf: samples: Set libbpf 1.0 API mode explicitly in hbm bpf: selftests: Get rid of bpf_rlimit.h bpf: selftests: No need to include sys/resource.h in some files bpf: samples: Use libbpf 1.0 API mode instead of RLIMIT_MEMLOCK in xdpsock_user bpf: samples: Use libbpf 1.0 API mode instead of RLIMIT_MEMLOCK in xsk_fwd bpf: samples: No need to include sys/resource.h in many files bpf: bpftool: Remove useless return value of libbpf_set_strict_mode bpf: bpftool: Set LIBBPF_STRICT_AUTO_RLIMIT_MEMLOCK for legacy libbpf bpf: bpftool: remove RLIMIT_MEMLOCK bpf: runqslower: Use libbpf 1.0 API mode instead of RLIMIT_MEMLOCK samples/bpf/cpustat_user.c | 1 - samples/bpf/hbm.c | 5 ++-- samples/bpf/ibumad_user.c | 1 - samples/bpf/map_perf_test_user.c | 1 - samples/bpf/offwaketime_user.c | 1 - samples/bpf/sockex2_user.c | 1 - samples/bpf/sockex3_user.c | 1 - samples/bpf/spintest_user.c | 1 - samples/bpf/syscall_tp_user.c | 1 - samples/bpf/task_fd_query_user.c | 1 - samples/bpf/test_lru_dist.c | 1 - samples/bpf/test_map_in_map_user.c | 1 - samples/bpf/test_overhead_user.c | 1 - samples/bpf/tracex2_user.c | 1 - samples/bpf/tracex3_user.c | 1 - samples/bpf/tracex4_user.c | 1 - samples/bpf/tracex5_user.c | 1 - samples/bpf/tracex6_user.c | 1 - samples/bpf/xdp1_user.c | 1 - samples/bpf/xdp_adjust_tail_user.c | 1 - samples/bpf/xdp_monitor_user.c | 1 - samples/bpf/xdp_redirect_cpu_user.c | 1 - samples/bpf/xdp_redirect_map_multi_user.c | 1 - samples/bpf/xdp_redirect_user.c | 1 - samples/bpf/xdp_router_ipv4_user.c | 1 - samples/bpf/xdp_rxq_info_user.c | 1 - samples/bpf/xdp_sample_pkts_user.c | 1 - samples/bpf/xdp_sample_user.c | 1 - samples/bpf/xdp_tx_iptunnel_user.c | 1 - samples/bpf/xdpsock_user.c | 9 ++---- samples/bpf/xsk_fwd.c | 7 ++--- tools/bpf/bpftool/common.c | 8 ------ tools/bpf/bpftool/feature.c | 2 -- tools/bpf/bpftool/main.c | 6 ++-- tools/bpf/bpftool/main.h | 2 -- tools/bpf/bpftool/map.c | 2 -- tools/bpf/bpftool/pids.c | 1 - tools/bpf/bpftool/prog.c | 3 -- tools/bpf/bpftool/struct_ops.c | 2 -- tools/bpf/runqslower/runqslower.c | 18 ++---------- tools/testing/selftests/bpf/bench.c | 1 - tools/testing/selftests/bpf/bpf_rlimit.h | 28 ------------------- .../selftests/bpf/flow_dissector_load.c | 6 ++-- .../selftests/bpf/get_cgroup_id_user.c | 4 ++- tools/testing/selftests/bpf/prog_tests/btf.c | 1 - .../selftests/bpf/test_cgroup_storage.c | 4 ++- tools/testing/selftests/bpf/test_dev_cgroup.c | 4 ++- tools/testing/selftests/bpf/test_lpm_map.c | 4 ++- tools/testing/selftests/bpf/test_lru_map.c | 4 ++- .../selftests/bpf/test_skb_cgroup_id_user.c | 4 ++- tools/testing/selftests/bpf/test_sock.c | 4 ++- tools/testing/selftests/bpf/test_sock_addr.c | 4 ++- tools/testing/selftests/bpf/test_sockmap.c | 5 ++-- tools/testing/selftests/bpf/test_sysctl.c | 4 ++- tools/testing/selftests/bpf/test_tag.c | 4 ++- .../bpf/test_tcp_check_syncookie_user.c | 4 ++- .../selftests/bpf/test_tcpnotify_user.c | 1 - .../testing/selftests/bpf/test_verifier_log.c | 5 ++-- .../selftests/bpf/xdp_redirect_multi.c | 1 - tools/testing/selftests/bpf/xdping.c | 8 ++---- tools/testing/selftests/bpf/xdpxceiver.c | 6 ++-- 61 files changed, 57 insertions(+), 142 deletions(-) delete mode 100644 tools/testing/selftests/bpf/bpf_rlimit.h -- 2.17.1

2 years, 11 months

3
31
0 0

special_insns.h:36:9: error: array subscript 0 is outside array bounds of ‘unsigned int[0]’ [-Werror=array-bounds]

by Bruno Goncalves

Hello, Trying to build mainline kernel with gcc12 and selftests we get the following error: 00:01:22 In function ‘native_read_cr2’, 00:01:22 inlined from ‘vmx_vcpu_enter_exit’ at arch/x86/kvm/vmx/vmx.c:6772:24: 00:01:22 ./arch/x86/include/asm/special_insns.h:36:9: error: array subscript 0 is outside array bounds of ‘unsigned int[0]’ [-Werror=array-bounds] 00:01:22 36 | asm volatile("mov %%cr2,%0\n\t" : "=r" (val) : __FORCE_ORDER); 00:01:22 | ^~~ 00:01:22 In function ‘native_read_cr2’, 00:01:22 inlined from ‘vmx_vcpu_enter_exit’ at arch/x86/kvm/vmx/vmx.c:6778:19: 00:01:22 ./arch/x86/include/asm/special_insns.h:36:9: error: array subscript 0 is outside array bounds of ‘unsigned int[0]’ [-Werror=array-bounds] 00:01:22 36 | asm volatile("mov %%cr2,%0\n\t" : "=r" (val) : __FORCE_ORDER); 00:01:22 | ^~~ 00:01:22 cc1: all warnings being treated as errors 00:01:22 make[4]: *** [scripts/Makefile.build:288: arch/x86/kvm/vmx/vmx.o] Error 1 00:01:22 make[3]: *** [scripts/Makefile.build:550: arch/x86/kvm] Error 2 Full build log: https://s3.us-east-1.amazonaws.com/arr-cki-prod-datawarehouse-public/datawa… build config: https://s3.us-east-1.amazonaws.com/arr-cki-prod-datawarehouse-public/datawa… Thanks, Bruno Goncalves

2 years, 11 months

1
0
0 0

[PATCH 00/18] bpf: Secure and authenticated preloading of eBPF programs

by Roberto Sassu

eBPF already allows programs to be preloaded and kept running without intervention from user space. There is a dedicated kernel module called bpf_preload, which contains the light skeleton of the iterators_bpf eBPF program. If this module is enabled in the kernel configuration, its loading will be triggered when the bpf filesystem is mounted (unless the module is built-in), and the links of iterators_bpf are pinned in that filesystem (they will appear as the progs.debug and maps.debug files). However, the current mechanism, if used to preload an LSM, would not offer the same security guarantees of LSMs integrated in the security subsystem. Also, it is not generic enough to be used for preloading arbitrary eBPF programs, unless the bpf_preload code is heavily modified. More specifically, the security problems are: - any program can be pinned to the bpf filesystem without limitations (unless a MAC mechanism enforces some restrictions); - programs being executed can be terminated at any time by deleting the pinned objects or unmounting the bpf filesystem. The usability problems are: - only a fixed amount of links can be pinned; - only links can be pinned, other object types are not supported; - code to pin objects has to be written manually; - preloading multiple eBPF programs is not practical, bpf_preload has to be modified to include additional light skeletons. Solve the security problems by mounting the bpf filesystem from the kernel, by preloading authenticated kernel modules (e.g. with module.sig_enforce) and by pinning objects to that filesystem. This particular filesystem instance guarantees that desired eBPF programs run until the very end of the kernel lifecycle, since even root cannot interfere with it. Solve the usability problems by generalizing the pinning function, to handle not only links but also maps and progs. Also increment the object reference count and call the pinning function directly from the preload method (currently in the bpf_preload kernel module) rather than from the bpf filesystem code itself, so that a generic eBPF program can do those operations depending on its objects (this also avoids the limitation of the fixed-size array for storing the objects to pin). Then, simplify the process of pinning objects defined by a generic eBPF program by automatically generating the required methods in the light skeleton. Also, generate a separate kernel module for each eBPF program to preload, so that existing ones don't have to be modified. Finally, support preloading multiple eBPF programs by allowing users to specify a list from the kernel configuration, at build time, or with the new kernel option bpf_preload_list=, at run-time. To summarize, this patch set makes it possible to plug in out-of-tree LSMs matching the security guarantees of their counterpart in the security subsystem, without having to modify the kernel itself. The same benefits are extended to other eBPF program types. Only one remaining problem is how to support auto-attaching eBPF programs with LSM type. It will be solved with a separate patch set. Patches 1-2 export some definitions, to build out-of-tree kernel modules with eBPF programs to preload. Patches 3-4 allow eBPF programs to pin objects by themselves. Patches 5-10 automatically generate the methods for preloading in the light skeleton. Patches 11-14 make it possible to preload multiple eBPF programs. Patch 15 automatically generates the kernel module for preloading an eBPF program, patch 16 does a kernel mount of the bpf filesystem, and finally patches 17-18 test the functionality introduced. Roberto Sassu (18): bpf: Export bpf_link_inc() bpf-preload: Move bpf_preload.h to include/linux bpf-preload: Generalize object pinning from the kernel bpf-preload: Export and call bpf_obj_do_pin_kernel() bpf-preload: Generate static variables bpf-preload: Generate free_objs_and_skel() bpf-preload: Generate preload() bpf-preload: Generate load_skel() bpf-preload: Generate code to pin non-internal maps bpf-preload: Generate bpf_preload_ops bpf-preload: Store multiple bpf_preload_ops structures in a linked list bpf-preload: Implement new registration method for preloading eBPF programs bpf-preload: Move pinned links and maps to a dedicated directory in bpffs bpf-preload: Switch to new preload registration method bpf-preload: Generate code of kernel module to preload bpf-preload: Do kernel mount to ensure that pinned objects don't disappear bpf-preload/selftests: Add test for automatic generation of preload methods bpf-preload/selftests: Preload a test eBPF program and check pinned objects .../admin-guide/kernel-parameters.txt | 8 + fs/namespace.c | 1 + include/linux/bpf.h | 5 + include/linux/bpf_preload.h | 37 ++ init/main.c | 2 + kernel/bpf/inode.c | 295 +++++++++-- kernel/bpf/preload/Kconfig | 25 +- kernel/bpf/preload/bpf_preload.h | 16 - kernel/bpf/preload/bpf_preload_kern.c | 85 +--- kernel/bpf/preload/iterators/Makefile | 9 +- .../bpf/preload/iterators/iterators.lskel.h | 466 +++++++++++------- kernel/bpf/syscall.c | 1 + .../bpf/bpftool/Documentation/bpftool-gen.rst | 13 + tools/bpf/bpftool/bash-completion/bpftool | 6 +- tools/bpf/bpftool/gen.c | 331 +++++++++++++ tools/bpf/bpftool/main.c | 7 +- tools/bpf/bpftool/main.h | 1 + tools/testing/selftests/bpf/Makefile | 32 +- .../bpf/bpf_testmod_preload/.gitignore | 7 + .../bpf/bpf_testmod_preload/Makefile | 20 + .../gen_preload_methods.expected.diff | 97 ++++ .../bpf/prog_tests/test_gen_preload_methods.c | 27 + .../bpf/prog_tests/test_preload_methods.c | 69 +++ .../selftests/bpf/progs/gen_preload_methods.c | 23 + 24 files changed, 1246 insertions(+), 337 deletions(-) create mode 100644 include/linux/bpf_preload.h delete mode 100644 kernel/bpf/preload/bpf_preload.h create mode 100644 tools/testing/selftests/bpf/bpf_testmod_preload/.gitignore create mode 100644 tools/testing/selftests/bpf/bpf_testmod_preload/Makefile create mode 100644 tools/testing/selftests/bpf/prog_tests/gen_preload_methods.expected.diff create mode 100644 tools/testing/selftests/bpf/prog_tests/test_gen_preload_methods.c create mode 100644 tools/testing/selftests/bpf/prog_tests/test_preload_methods.c create mode 100644 tools/testing/selftests/bpf/progs/gen_preload_methods.c -- 2.32.0

2 years, 11 months

7
44
0 0

[PATCH v3 0/2] AARCH64: Enable GCC-based Shadow Call Stack

by Dan Li

Shadow call stacks will be available in GCC >= 12, this series makes the corresponding kernel configuration available when compiling the kernel with the gcc and adds corresponding tests in lkdtm. Dan Li (2): AARCH64: Add gcc Shadow Call Stack support lkdtm: Add Shadow Call Stack tests arch/Kconfig | 19 +++---- arch/arm64/Kconfig | 2 +- drivers/misc/lkdtm/Makefile | 1 + drivers/misc/lkdtm/core.c | 2 + drivers/misc/lkdtm/lkdtm.h | 4 ++ drivers/misc/lkdtm/scs.c | 67 +++++++++++++++++++++++++ include/linux/compiler-gcc.h | 4 ++ tools/testing/selftests/lkdtm/tests.txt | 2 + 8 files changed, 91 insertions(+), 10 deletions(-) create mode 100644 drivers/misc/lkdtm/scs.c -- 2.17.1

2 years, 11 months

2
15
0 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

Linux-kselftest-mirror April 2022