July 2024 - Linux-kselftest-mirror

[PATCH v1 0/9] selftests: kvm: s390: Add s390x ucontrol selftests

by Christoph Schlameuss

This patch series adds a selftest suite to validate the s390x architecture specific ucontrol KVM interface. When creating a VM on s390x it is possible to create it as userspace controlled VM or in short ucontrol VM. These VMs delegates the management of the VM to userspace instead of handling most events within the kernel. Consequently the userspace has to manage interrupts, memory allocation etc. Before this patch set this functionality lacks any public test cases. It is desirable to add test cases for this interface to be able to reduce the risk of breaking changes in the future. In order to provision a ucontrol VM the kernel needs to be compiled with the CONFIG_KVM_S390_UCONTROL enabled. The users with sys_admin capability can then create a new ucontrol VM providing the KVM_VM_S390_UCONTROL parameter to the KVM_CREATE_VM ioctl. The kernels existing selftest helper functions can only be partially be reused for these tests. The test cases cover existing special handling of ucontrol VMs within the implementation and basic VM creation and handling cases: * Reject setting HPAGE when VM is ucontrol * Assert KVM_GET_DIRTY_LOG is rejected * Assert KVM_S390_VM_MEM_LIMIT_SIZE is rejected * Assert state of initial SIE flags setup by the kernel * Run simple program in VM with and without DAT * Assert KVM_EXIT_S390_UCONTROL exit on not mapped memory access * Assert functionality of storage keys in ucontrol VM Running the test cases requires sys_admin capabilities to start the ucontrol VM. This can be achieved by running as root or with a command like: sudo setpriv --reuid nobody --inh-caps -all,+sys_admin \ --ambient-caps -all,+sys_admin --bounding-set -all,+sys_admin \ ./ucontrol_test The patch set does also contain some code cleanup / consolidation of architecture specific defines that are now used in multiple test cases. Christoph Schlameuss (9): selftests: kvm: s390: Define page sizes in shared header selftests: kvm: s390: Add kvm_s390_sie_block definition for userspace tests selftests: kvm: s390: Add s390x ucontrol test suite with hpage test selftests: kvm: s390: Add test fixture and simple VM setup tests selftests: kvm: s390: Add debug print functions selftests: kvm: s390: Add VM run test case selftests: kvm: s390: Add uc_map_unmap VM test case selftests: kvm: s390: Add uc_skey VM test case selftests: kvm: s390: Verify reject memory region operations for ucontrol VMs tools/testing/selftests/kvm/.gitignore | 1 + tools/testing/selftests/kvm/Makefile | 1 + .../selftests/kvm/include/s390x/debug_print.h | 78 +++ .../selftests/kvm/include/s390x/processor.h | 5 + .../testing/selftests/kvm/include/s390x/sie.h | 240 +++++++ .../selftests/kvm/lib/s390x/processor.c | 10 +- tools/testing/selftests/kvm/s390x/cmma_test.c | 7 +- tools/testing/selftests/kvm/s390x/config | 2 + .../testing/selftests/kvm/s390x/debug_test.c | 4 +- tools/testing/selftests/kvm/s390x/memop.c | 4 +- tools/testing/selftests/kvm/s390x/tprot.c | 5 +- .../selftests/kvm/s390x/ucontrol_test.c | 612 ++++++++++++++++++ 12 files changed, 953 insertions(+), 16 deletions(-) create mode 100644 tools/testing/selftests/kvm/include/s390x/debug_print.h create mode 100644 tools/testing/selftests/kvm/include/s390x/sie.h create mode 100644 tools/testing/selftests/kvm/s390x/config create mode 100644 tools/testing/selftests/kvm/s390x/ucontrol_test.c base-commit: 256abd8e550ce977b728be79a74e1729438b4948 -- 2.45.2

1 year, 3 months

2
20
0 0

[PATCH bpf-next v4 13/20] bpf, lsm: Add check for BPF LSM return value

by Xu Kuohai

From: Xu Kuohai <xukuohai(a)huawei.com> A bpf prog returning a positive number attached to file_alloc_security hook makes kernel panic. This happens because file system can not filter out the positive number returned by the LSM prog using IS_ERR, and misinterprets this positive number as a file pointer. Given that hook file_alloc_security never returned positive number before the introduction of BPF LSM, and other BPF LSM hooks may encounter similar issues, this patch adds LSM return value check in verifier, to ensure no unexpected value is returned. Fixes: 520b7aa00d8c ("bpf: lsm: Initialize the BPF LSM hooks") Reported-by: Xin Liu <liuxin350(a)huawei.com> Signed-off-by: Xu Kuohai <xukuohai(a)huawei.com> Acked-by: Eduard Zingerman <eddyz87(a)gmail.com> --- include/linux/bpf.h | 1 + include/linux/bpf_lsm.h | 9 +++++++ kernel/bpf/bpf_lsm.c | 30 ++++++++++++++++++++- kernel/bpf/btf.c | 5 +++- kernel/bpf/verifier.c | 60 ++++++++++++++++++++++++++++++++++------- 5 files changed, 94 insertions(+), 11 deletions(-) diff --git a/include/linux/bpf.h b/include/linux/bpf.h index 4f1d4a97b9d1..d255201035c4 100644 --- a/include/linux/bpf.h +++ b/include/linux/bpf.h @@ -927,6 +927,7 @@ struct bpf_insn_access_aux { }; }; struct bpf_verifier_log *log; /* for verbose logs */ + bool is_retval; /* is accessing function return value ? */ }; static inline void diff --git a/include/linux/bpf_lsm.h b/include/linux/bpf_lsm.h index 73e1f6dbec4a..ca5f2176c940 100644 --- a/include/linux/bpf_lsm.h +++ b/include/linux/bpf_lsm.h @@ -9,6 +9,7 @@ #include <linux/sched.h> #include <linux/bpf.h> +#include <linux/bpf_verifier.h> #include <linux/lsm_hooks.h> #ifdef CONFIG_BPF_LSM @@ -47,6 +48,8 @@ void bpf_lsm_find_cgroup_shim(const struct bpf_prog *prog, bpf_func_t *bpf_func) bool bpf_lsm_has_retval_param(const struct bpf_prog *prog); +int bpf_lsm_get_retval_range(const struct bpf_prog *prog, + struct bpf_retval_range *range); #else /* !CONFIG_BPF_LSM */ static inline bool bpf_lsm_is_sleepable_hook(u32 btf_id) @@ -84,6 +87,12 @@ static inline bool bpf_lsm_has_retval_param(const struct bpf_prog *prog) { return false; } + +static inline int bpf_lsm_get_retval_range(const struct bpf_prog *prog, + struct bpf_retval_range *range) +{ + return -EOPNOTSUPP; +} #endif /* CONFIG_BPF_LSM */ #endif /* _LINUX_BPF_LSM_H */ diff --git a/kernel/bpf/bpf_lsm.c b/kernel/bpf/bpf_lsm.c index a8f8358c77e3..9dd338099d4a 100644 --- a/kernel/bpf/bpf_lsm.c +++ b/kernel/bpf/bpf_lsm.c @@ -11,7 +11,6 @@ #include <linux/lsm_hooks.h> #include <linux/bpf_lsm.h> #include <linux/kallsyms.h> -#include <linux/bpf_verifier.h> #include <net/bpf_sk_storage.h> #include <linux/bpf_local_storage.h> #include <linux/btf_ids.h> @@ -420,3 +419,32 @@ bool bpf_lsm_has_retval_param(const struct bpf_prog *prog) return btf_id_set_contains(&retval_param_lsm_hooks, prog->aux->attach_btf_id); } + +/* hooks return 0 or 1 */ +BTF_SET_START(bool_lsm_hooks) +BTF_ID(func, bpf_lsm_xfrm_state_pol_flow_match) +BTF_ID(func, bpf_lsm_audit_rule_known) +BTF_ID(func, bpf_lsm_inode_xattr_skipcap) +BTF_SET_END(bool_lsm_hooks) + +int bpf_lsm_get_retval_range(const struct bpf_prog *prog, + struct bpf_retval_range *retval_range) +{ + /* no return value range for void hooks */ + if (!prog->aux->attach_func_proto->type) + return -EINVAL; + + if (btf_id_set_contains(&bool_lsm_hooks, prog->aux->attach_btf_id)) { + retval_range->minval = 0; + retval_range->maxval = 1; + } else { + /* All other LSM hooks, except task_prctl, return 0 on success + * and negative error code on failure. + * To keep things simple, we only allow bpf progs to return 0 + * or negative errno for task_prctl. + */ + retval_range->minval = -MAX_ERRNO; + retval_range->maxval = 0; + } + return 0; +} diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c index df299d600b10..ce892565367d 100644 --- a/kernel/bpf/btf.c +++ b/kernel/bpf/btf.c @@ -6416,8 +6416,11 @@ bool btf_ctx_access(int off, int size, enum bpf_access_type type, if (arg == nr_args) { switch (prog->expected_attach_type) { - case BPF_LSM_CGROUP: case BPF_LSM_MAC: + /* mark we are accessing the return value */ + info->is_retval = true; + fallthrough; + case BPF_LSM_CGROUP: case BPF_TRACE_FEXIT: /* When LSM programs are attached to void LSM hooks * they use FEXIT trampolines and when attached to diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index a0bbef2d14e4..6f5d8ca995d6 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -2334,6 +2334,25 @@ static void mark_reg_unknown(struct bpf_verifier_env *env, __mark_reg_unknown(env, regs + regno); } +static int __mark_reg_s32_range(struct bpf_verifier_env *env, + struct bpf_reg_state *regs, + u32 regno, + s32 s32_min, + s32 s32_max) +{ + struct bpf_reg_state *reg = regs + regno; + + reg->s32_min_value = max_t(s32, reg->s32_min_value, s32_min); + reg->s32_max_value = min_t(s32, reg->s32_max_value, s32_max); + + reg->smin_value = max_t(s64, reg->smin_value, s32_min); + reg->smax_value = min_t(s64, reg->smax_value, s32_max); + + reg_bounds_sync(reg); + + return reg_bounds_sanity_check(env, reg, "s32_range"); +} + static void __mark_reg_not_init(const struct bpf_verifier_env *env, struct bpf_reg_state *reg) { @@ -5587,11 +5606,12 @@ static int check_packet_access(struct bpf_verifier_env *env, u32 regno, int off, /* check access to 'struct bpf_context' fields. Supports fixed offsets only */ static int check_ctx_access(struct bpf_verifier_env *env, int insn_idx, int off, int size, enum bpf_access_type t, enum bpf_reg_type *reg_type, - struct btf **btf, u32 *btf_id) + struct btf **btf, u32 *btf_id, bool *is_retval) { struct bpf_insn_access_aux info = { .reg_type = *reg_type, .log = &env->log, + .is_retval = false, }; if (env->ops->is_valid_access && @@ -5604,6 +5624,7 @@ static int check_ctx_access(struct bpf_verifier_env *env, int insn_idx, int off, * type of narrower access. */ *reg_type = info.reg_type; + *is_retval = info.is_retval; if (base_type(*reg_type) == PTR_TO_BTF_ID) { *btf = info.btf; @@ -6803,6 +6824,17 @@ static int check_stack_access_within_bounds( return grow_stack_state(env, state, -min_off /* size */); } +static bool get_func_retval_range(struct bpf_prog *prog, + struct bpf_retval_range *range) +{ + if (prog->type == BPF_PROG_TYPE_LSM && + prog->expected_attach_type == BPF_LSM_MAC && + !bpf_lsm_get_retval_range(prog, range)) { + return true; + } + return false; +} + /* check whether memory at (regno + off) is accessible for t = (read | write) * if t==write, value_regno is a register which value is stored into memory * if t==read, value_regno is a register which will receive the value from memory @@ -6907,6 +6939,8 @@ static int check_mem_access(struct bpf_verifier_env *env, int insn_idx, u32 regn if (!err && value_regno >= 0 && (t == BPF_READ || rdonly_mem)) mark_reg_unknown(env, regs, value_regno); } else if (reg->type == PTR_TO_CTX) { + bool is_retval = false; + struct bpf_retval_range range; enum bpf_reg_type reg_type = SCALAR_VALUE; struct btf *btf = NULL; u32 btf_id = 0; @@ -6922,7 +6956,7 @@ static int check_mem_access(struct bpf_verifier_env *env, int insn_idx, u32 regn return err; err = check_ctx_access(env, insn_idx, off, size, t, &reg_type, &btf, - &btf_id); + &btf_id, &is_retval); if (err) verbose_linfo(env, insn_idx, "; "); if (!err && t == BPF_READ && value_regno >= 0) { @@ -6931,7 +6965,14 @@ static int check_mem_access(struct bpf_verifier_env *env, int insn_idx, u32 regn * case, we know the offset is zero. */ if (reg_type == SCALAR_VALUE) { - mark_reg_unknown(env, regs, value_regno); + if (is_retval && get_func_retval_range(env->prog, &range)) { + err = __mark_reg_s32_range(env, regs, value_regno, + range.minval, range.maxval); + if (err) + return err; + } else { + mark_reg_unknown(env, regs, value_regno); + } } else { mark_reg_known_zero(env, regs, value_regno); @@ -15782,12 +15823,13 @@ static int check_return_code(struct bpf_verifier_env *env, int regno, const char case BPF_PROG_TYPE_LSM: if (env->prog->expected_attach_type != BPF_LSM_CGROUP) { - /* Regular BPF_PROG_TYPE_LSM programs can return - * any value. - */ - return 0; - } - if (!env->prog->aux->attach_func_proto->type) { + /* no range found, any return value is allowed */ + if (!get_func_retval_range(env->prog, &range)) + return 0; + /* no restricted range, any return value is allowed */ + if (range.minval == S32_MIN && range.maxval == S32_MAX) + return 0; + } else if (!env->prog->aux->attach_func_proto->type) { /* Make sure programs that attach to void * hooks don't try to modify return value. */ -- 2.30.2

1 year, 3 months

1
7
0 0

Re: [syzbot] [mm?] INFO: rcu detected stall in sys_wait4 (4)

by syzbot

syzbot suspects this issue was fixed by commit: commit fb66df20a7201e60f2b13d7f95d031b31a8831d3 Author: Vladimir Oltean <vladimir.oltean(a)nxp.com> Date: Mon May 27 15:39:55 2024 +0000 net/sched: taprio: extend minimum interval restriction to entire cycle too bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=10593441980000 start commit: fe46a7dd189e Merge tag 'sound-6.9-rc1' of git://git.kernel.. git tree: upstream kernel config: https://syzkaller.appspot.com/x/.config?x=fe78468a74fdc3b7 dashboard link: https://syzkaller.appspot.com/bug?extid=6969434de600a6ba9f07 syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1091a5f6180000 C reproducer: https://syzkaller.appspot.com/x/repro.c?x=17a22c13180000 If the result looks correct, please mark the issue as fixed by replying with: #syz fix: net/sched: taprio: extend minimum interval restriction to entire cycle too For information about bisection process see: https://goo.gl/tpsmEJ#bisection

1 year, 3 months

1
0
0 0

[PATCH] bpf, selftests: fix a resource leak in main()

by Ma Ke

The requested resources should be closed before return in main(), otherwise resource leak will occur. Add a check of cgroup_fd and close(). Fixes: 4939b2847d26 ("bpf, selftests: Use single cgroup helpers for both test_sockmap/progs") Signed-off-by: Ma Ke <make24(a)iscas.ac.cn> --- tools/testing/selftests/bpf/test_dev_cgroup.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/tools/testing/selftests/bpf/test_dev_cgroup.c b/tools/testing/selftests/bpf/test_dev_cgroup.c index adeaf63cb6fa..e97fc061fab2 100644 --- a/tools/testing/selftests/bpf/test_dev_cgroup.c +++ b/tools/testing/selftests/bpf/test_dev_cgroup.c @@ -81,5 +81,7 @@ int main(int argc, char **argv) cleanup_cgroup_environment(); out: + if (cgroup_fd >= 0) + close(cgroup_fd); return error; } -- 2.25.1

1 year, 3 months

2
1
0 0

[PATCH] bpf, selftests: fix a resource leak in main()

by Ma Ke

The requested resources should be closed before return in main(), otherwise resource leak will occur. Add a check of cgroup_fd and close(). Fixes: 4939b2847d26 ("bpf, selftests: Use single cgroup helpers for both test_sockmap/progs") Signed-off-by: Ma Ke <make24(a)iscas.ac.cn> --- tools/testing/selftests/bpf/test_cgroup_storage.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/tools/testing/selftests/bpf/test_cgroup_storage.c b/tools/testing/selftests/bpf/test_cgroup_storage.c index 0861ea60dcdd..4265f1348b6b 100644 --- a/tools/testing/selftests/bpf/test_cgroup_storage.c +++ b/tools/testing/selftests/bpf/test_cgroup_storage.c @@ -79,6 +79,8 @@ int main(int argc, char **argv) } cgroup_fd = cgroup_setup_and_join(TEST_CGROUP); + if (cgroup_fd < 0) + goto out; /* Attach the bpf program */ if (bpf_prog_attach(prog_fd, cgroup_fd, BPF_CGROUP_INET_EGRESS, 0)) { @@ -170,5 +172,7 @@ int main(int argc, char **argv) free(percpu_value); out: + if (cgroup_fd >= 0) + close(cgroup_fd); return error; } -- 2.25.1

1 year, 3 months

1
0
0 0

[PATCH] selftests/bpf:fix a resource leak in main()

by Ma Ke

The requested resources should be closed before return in main(), otherwise resource leak will occur. Add a check of cgfd before close(). Fixes: 5ecd8c22739b ("selftests/bpf: Selftest for bpf_skb_ancestor_cgroup_id") Signed-off-by: Ma Ke <make24(a)iscas.ac.cn> --- tools/testing/selftests/bpf/test_skb_cgroup_id_user.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/tools/testing/selftests/bpf/test_skb_cgroup_id_user.c b/tools/testing/selftests/bpf/test_skb_cgroup_id_user.c index ed518d075d1d..f84faddd72e6 100644 --- a/tools/testing/selftests/bpf/test_skb_cgroup_id_user.c +++ b/tools/testing/selftests/bpf/test_skb_cgroup_id_user.c @@ -176,7 +176,8 @@ int main(int argc, char **argv) err: err = -1; out: - close(cgfd); + if (cgfd >= 0) + close(cgfd); cleanup_cgroup_environment(); printf("[%s]\n", err ? "FAIL" : "PASS"); return err; -- 2.25.1

1 year, 3 months

1
0
0 0

[PATCH] selftests/bpf:fix a resource leak in run_tests()

by Ma Ke

The requested resources should be closed before return in run_tests(), otherwise resource leak will occur. Add a check of cg_fd before close(). Fixes: 1d436885b23b ("selftests/bpf: Selftest for sys_bind post-hooks.") Signed-off-by: Ma Ke <make24(a)iscas.ac.cn> --- tools/testing/selftests/bpf/test_sock.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/tools/testing/selftests/bpf/test_sock.c b/tools/testing/selftests/bpf/test_sock.c index 810c3740b2cc..bb5038fc15ac 100644 --- a/tools/testing/selftests/bpf/test_sock.c +++ b/tools/testing/selftests/bpf/test_sock.c @@ -550,7 +550,8 @@ int main(int argc, char **argv) err: err = -1; out: - close(cgfd); + if (cgfd >= 0) + close(cgfd); cleanup_cgroup_environment(); return err; } -- 2.25.1

1 year, 3 months

1
0
0 0

[PATCH] selftests/bpf:fix a resource leak in main()

by Ma Ke

The requested resources should be closed before return in main(), otherwise resource leak will occur. Add a check of cg_fd before close(). Fixes: 1f5fa9ab6e2e ("selftests/bpf: Test BPF_CGROUP_SYSCTL") Signed-off-by: Ma Ke <make24(a)iscas.ac.cn> --- tools/testing/selftests/bpf/test_sysctl.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/tools/testing/selftests/bpf/test_sysctl.c b/tools/testing/selftests/bpf/test_sysctl.c index bcdbd27f22f0..242246ba8d1e 100644 --- a/tools/testing/selftests/bpf/test_sysctl.c +++ b/tools/testing/selftests/bpf/test_sysctl.c @@ -1627,7 +1627,8 @@ int main(int argc, char **argv) err: err = -1; out: - close(cgfd); + if (cgfd >= 0) + close(cgfd); cleanup_cgroup_environment(); return err; } -- 2.25.1

1 year, 3 months

1
0
0 0

[PATCH] selftests: openat2: don't print total number of tests and then skip

by Muhammad Usama Anjum

Don't print that 88 sub-tests are going to be executed. But then skip. The error is printed that executed test was only 1 while 88 should have run: Old output: TAP version 13 1..88 ok 2 # SKIP all tests require euid == 0 # Planned tests != run tests (88 != 1) # Totals: pass:0 fail:0 xfail:0 xpass:0 skip:1 error:0 New and correct output: TAP version 13 1..0 # SKIP all tests require euid == 0 Signed-off-by: Muhammad Usama Anjum <usama.anjum(a)collabora.com> --- tools/testing/selftests/openat2/resolve_test.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/tools/testing/selftests/openat2/resolve_test.c b/tools/testing/selftests/openat2/resolve_test.c index bbafad440893c..5472ec478d227 100644 --- a/tools/testing/selftests/openat2/resolve_test.c +++ b/tools/testing/selftests/openat2/resolve_test.c @@ -508,12 +508,13 @@ void test_openat2_opath_tests(void) int main(int argc, char **argv) { ksft_print_header(); - ksft_set_plan(NUM_TESTS); /* NOTE: We should be checking for CAP_SYS_ADMIN here... */ - if (geteuid() != 0) + if (geteuid()) ksft_exit_skip("all tests require euid == 0\n"); + ksft_set_plan(NUM_TESTS); + test_openat2_opath_tests(); if (ksft_get_fail_cnt() + ksft_get_error_cnt() > 0) -- 2.39.2

1 year, 3 months

3
6
0 0

[PATCH 0/2] Optimize the return_instance management of uretprobe

by Liao Chang

While exploring uretprobe syscall and trampoline for ARM64, we observed a slight performance gain for Redis benchmark using uretprobe syscall. This patchset aims to further improve the performance of uretprobe by optimizing the management of struct return_instance data. In details, uretprobe utilizes dynamically allocated memory for struct return_instance data. These data track the call chain of instrumented functions. This approach is not efficient, especially considering the inherent locality of function invocation. This patchset proposes a rework of the return_instances management. It replaces dynamic memory allocation with a statically allocated array. This approach leverages the stack-style usage of return_instance and remove the need for kamlloc/kfree operations. This patch has been tested on Kunpeng916 (Hi1616), 4 NUMA nodes, 64 cores @ 2.4GHz. Redis benchmarks show a throughput gain by 2% for Redis GET and SET commands: ------------------------------------------------------------------ Test case | No uretprobes | uretprobes | uretprobes | | (current) | (optimized) ================================================================== Redis SET (RPS) | 47025 | 40619 (-13.6%) | 41529 (-11.6%) ------------------------------------------------------------------ Redis GET (RPS) | 46715 | 41426 (-11.3%) | 42306 (-9.4%) ------------------------------------------------------------------ Liao Chang (2): uprobes: Optimize the return_instance related routines selftests/bpf: Add uretprobe test for return_instance management include/linux/uprobes.h | 10 +- kernel/events/uprobes.c | 162 +++++++++++------- .../bpf/prog_tests/uretprobe_depth.c | 150 ++++++++++++++++ .../selftests/bpf/progs/uretprobe_depth.c | 19 ++ 4 files changed, 274 insertions(+), 67 deletions(-) create mode 100644 tools/testing/selftests/bpf/prog_tests/uretprobe_depth.c create mode 100644 tools/testing/selftests/bpf/progs/uretprobe_depth.c -- 2.34.1

1 year, 3 months

3
6
0 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

Linux-kselftest-mirror July 2024