From: Roberto Sassu roberto.sassu@huawei.com
Modify test_lsm and verify_pkcs7_sig to ensure that they don't return positive values.
Signed-off-by: Roberto Sassu roberto.sassu@huawei.com --- tools/testing/selftests/bpf/progs/lsm.c | 4 ++++ .../selftests/bpf/progs/test_verify_pkcs7_sig.c | 11 +++++++++-- 2 files changed, 13 insertions(+), 2 deletions(-)
diff --git a/tools/testing/selftests/bpf/progs/lsm.c b/tools/testing/selftests/bpf/progs/lsm.c index d8d8af623bc2..42252750d866 100644 --- a/tools/testing/selftests/bpf/progs/lsm.c +++ b/tools/testing/selftests/bpf/progs/lsm.c @@ -88,6 +88,10 @@ SEC("lsm/file_mprotect") int BPF_PROG(test_int_hook, struct vm_area_struct *vma, unsigned long reqprot, unsigned long prot, int ret) { + /* file_mprotect hook must return zero or negative values. */ + if (ret > 0) + ret = -EINVAL; + if (ret != 0) return ret;
diff --git a/tools/testing/selftests/bpf/progs/test_verify_pkcs7_sig.c b/tools/testing/selftests/bpf/progs/test_verify_pkcs7_sig.c index ce419304ff1f..d3cab4370f29 100644 --- a/tools/testing/selftests/bpf/progs/test_verify_pkcs7_sig.c +++ b/tools/testing/selftests/bpf/progs/test_verify_pkcs7_sig.c @@ -42,14 +42,14 @@ struct { char _license[] SEC("license") = "GPL";
SEC("lsm.s/bpf") -int BPF_PROG(bpf, int cmd, union bpf_attr *attr, unsigned int size) +s64 BPF_PROG(bpf, int cmd, union bpf_attr *attr, unsigned int size) { struct bpf_dynptr data_ptr, sig_ptr; struct data *data_val; struct bpf_key *trusted_keyring; __u32 pid; __u64 value; - int ret, zero = 0; + s64 ret, zero = 0;
pid = bpf_get_current_pid_tgid() >> 32; if (pid != monitored_pid) @@ -86,5 +86,12 @@ int BPF_PROG(bpf, int cmd, union bpf_attr *attr, unsigned int size)
bpf_key_put(trusted_keyring);
+ /* + * bpf hook must return zero or negative values, use s64 to propagate + * the bounds to R0. + */ + if (ret > 0) + return -EINVAL; + return ret; }