kernel_samsung_a53x/tools/testing/selftests/bpf
Eduard Zingerman 12ebd1d34e bpf: Allow reads from uninit stack
commit 6715df8d5d24655b9fd368e904028112b54c7de1 upstream.

This commits updates the following functions to allow reads from
uninitialized stack locations when env->allow_uninit_stack option is
enabled:
- check_stack_read_fixed_off()
- check_stack_range_initialized(), called from:
  - check_stack_read_var_off()
  - check_helper_mem_access()

Such change allows to relax logic in stacksafe() to treat STACK_MISC
and STACK_INVALID in a same way and make the following stack slot
configurations equivalent:

  |  Cached state    |  Current state   |
  |   stack slot     |   stack slot     |
  |------------------+------------------|
  | STACK_INVALID or | STACK_INVALID or |
  | STACK_MISC       | STACK_SPILL   or |
  |                  | STACK_MISC    or |
  |                  | STACK_ZERO    or |
  |                  | STACK_DYNPTR     |

This leads to significant verification speed gains (see below).

The idea was suggested by Andrii Nakryiko [1] and initial patch was
created by Alexei Starovoitov [2].

Currently the env->allow_uninit_stack is allowed for programs loaded
by users with CAP_PERFMON or CAP_SYS_ADMIN capabilities.

A number of test cases from verifier/*.c were expecting uninitialized
stack access to be an error. These test cases were updated to execute
in unprivileged mode (thus preserving the tests).

The test progs/test_global_func10.c expected "invalid indirect read
from stack" error message because of the access to uninitialized
memory region. This error is no longer possible in privileged mode.
The test is updated to provoke an error "invalid indirect access to
stack" because of access to invalid stack address (such error is not
verified by progs/test_global_func*.c series of tests).

The following tests had to be removed because these can't be made
unprivileged:
- verifier/sock.c:
  - "sk_storage_get(map, skb->sk, &stack_value, 1): partially init
  stack_value"
  BPF_PROG_TYPE_SCHED_CLS programs are not executed in unprivileged mode.
- verifier/var_off.c:
  - "indirect variable-offset stack access, max_off+size > max_initialized"
  - "indirect variable-offset stack access, uninitialized"
  These tests verify that access to uninitialized stack values is
  detected when stack offset is not a constant. However, variable
  stack access is prohibited in unprivileged mode, thus these tests
  are no longer valid.

 * * *

Here is veristat log comparing this patch with current master on a
set of selftest binaries listed in tools/testing/selftests/bpf/veristat.cfg
and cilium BPF binaries (see [3]):

$ ./veristat -e file,prog,states -C -f 'states_pct<-30' master.log current.log
File                        Program                     States (A)  States (B)  States    (DIFF)
--------------------------  --------------------------  ----------  ----------  ----------------
bpf_host.o                  tail_handle_ipv6_from_host         349         244    -105 (-30.09%)
bpf_host.o                  tail_handle_nat_fwd_ipv4          1320         895    -425 (-32.20%)
bpf_lxc.o                   tail_handle_nat_fwd_ipv4          1320         895    -425 (-32.20%)
bpf_sock.o                  cil_sock4_connect                   70          48     -22 (-31.43%)
bpf_sock.o                  cil_sock4_sendmsg                   68          46     -22 (-32.35%)
bpf_xdp.o                   tail_handle_nat_fwd_ipv4          1554         803    -751 (-48.33%)
bpf_xdp.o                   tail_lb_ipv4                      6457        2473   -3984 (-61.70%)
bpf_xdp.o                   tail_lb_ipv6                      7249        3908   -3341 (-46.09%)
pyperf600_bpf_loop.bpf.o    on_event                           287         145    -142 (-49.48%)
strobemeta.bpf.o            on_event                         15915        4772  -11143 (-70.02%)
strobemeta_nounroll2.bpf.o  on_event                         17087        3820  -13267 (-77.64%)
xdp_synproxy_kern.bpf.o     syncookie_tc                     21271        6635  -14636 (-68.81%)
xdp_synproxy_kern.bpf.o     syncookie_xdp                    23122        6024  -17098 (-73.95%)
--------------------------  --------------------------  ----------  ----------  ----------------

Note: I limited selection by states_pct<-30%.

Inspection of differences in pyperf600_bpf_loop behavior shows that
the following patch for the test removes almost all differences:

    - a/tools/testing/selftests/bpf/progs/pyperf.h
    + b/tools/testing/selftests/bpf/progs/pyperf.h
    @ -266,8 +266,8 @ int __on_event(struct bpf_raw_tracepoint_args *ctx)
            }

            if (event->pthread_match || !pidData->use_tls) {
    -               void* frame_ptr;
    -               FrameData frame;
    +               void* frame_ptr = 0;
    +               FrameData frame = {};
                    Symbol sym = {};
                    int cur_cpu = bpf_get_smp_processor_id();

W/o this patch the difference comes from the following pattern
(for different variables):

    static bool get_frame_data(... FrameData *frame ...)
    {
        ...
        bpf_probe_read_user(&frame->f_code, ...);
        if (!frame->f_code)
            return false;
        ...
        bpf_probe_read_user(&frame->co_name, ...);
        if (frame->co_name)
            ...;
    }

    int __on_event(struct bpf_raw_tracepoint_args *ctx)
    {
        FrameData frame;
        ...
        get_frame_data(... &frame ...) // indirectly via a bpf_loop & callback
        ...
    }

    SEC("raw_tracepoint/kfree_skb")
    int on_event(struct bpf_raw_tracepoint_args* ctx)
    {
        ...
        ret |= __on_event(ctx);
        ret |= __on_event(ctx);
        ...
    }

With regards to value `frame->co_name` the following is important:
- Because of the conditional `if (!frame->f_code)` each call to
  __on_event() produces two states, one with `frame->co_name` marked
  as STACK_MISC, another with it as is (and marked STACK_INVALID on a
  first call).
- The call to bpf_probe_read_user() does not mark stack slots
  corresponding to `&frame->co_name` as REG_LIVE_WRITTEN but it marks
  these slots as BPF_MISC, this happens because of the following loop
  in the check_helper_call():

	for (i = 0; i < meta.access_size; i++) {
		err = check_mem_access(env, insn_idx, meta.regno, i, BPF_B,
				       BPF_WRITE, -1, false);
		if (err)
			return err;
	}

  Note the size of the write, it is a one byte write for each byte
  touched by a helper. The BPF_B write does not lead to write marks
  for the target stack slot.
- Which means that w/o this patch when second __on_event() call is
  verified `if (frame->co_name)` will propagate read marks first to a
  stack slot with STACK_MISC marks and second to a stack slot with
  STACK_INVALID marks and these states would be considered different.

[1] https://lore.kernel.org/bpf/CAEf4BzY3e+ZuC6HUa8dCiUovQRg2SzEk7M-dSkqNZyn=xEmnPA@mail.gmail.com/
[2] https://lore.kernel.org/bpf/CAADnVQKs2i1iuZ5SUGuJtxWVfGYR9kDgYKhq3rNV+kBLQCu7rA@mail.gmail.com/
[3] git@github.com:anakryiko/cilium.git

Suggested-by: Andrii Nakryiko <andrii@kernel.org>
Co-developed-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
Acked-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/r/20230219200427.606541-2-eddyz87@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Maxim Mikityanskiy <maxim@isovalent.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2024-11-19 14:19:46 +01:00
..
benchs Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
gnu Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
map_tests Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
prog_tests selftests/bpf: Fix flaky test btf_map_in_map/lookup_update 2024-11-19 14:19:06 +01:00
progs bpf: Allow reads from uninit stack 2024-11-19 14:19:46 +01:00
verifier bpf: Allow reads from uninit stack 2024-11-19 14:19:46 +01:00
bench.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
bench.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
bpf_legacy.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
bpf_rand.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
bpf_rlimit.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
bpf_tcp_helpers.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
bpf_util.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
cgroup_helpers.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
cgroup_helpers.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
config Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
flow_dissector_load.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
flow_dissector_load.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
get_cgroup_id_user.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
Makefile Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
netcnt_common.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
network_helpers.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
network_helpers.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
README.rst Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
settings Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
tcp_client.py Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
tcp_server.py Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
test_bpftool.py Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
test_bpftool.sh Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
test_bpftool_build.sh Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
test_bpftool_metadata.sh Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
test_btf.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
test_cgroup_storage.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
test_cpp.cpp Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
test_current_pid_tgid_new_ns.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
test_dev_cgroup.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
test_flow_dissector.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
test_flow_dissector.sh Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
test_ftrace.sh Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
test_iptunnel_common.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
test_kmod.sh Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
test_lirc_mode2.sh Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
test_lirc_mode2_user.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
test_lpm_map.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
test_lru_map.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
test_lwt_ip_encap.sh Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
test_lwt_seg6local.sh Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
test_maps.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
test_maps.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
test_netcnt.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
test_offload.py Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
test_progs.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
test_progs.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
test_select_reuseport_common.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
test_skb_cgroup_id.sh Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
test_skb_cgroup_id_user.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
test_sock.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
test_sock_addr.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
test_sock_addr.sh Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
test_socket_cookie.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
test_sockmap.c selftests/bpf: Fix umount cgroup2 error in test_sockmap 2024-11-19 12:26:54 +01:00
test_stub.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
test_sysctl.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
test_tag.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
test_tc_edt.sh Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
test_tc_redirect.sh Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
test_tc_tunnel.sh selftests/bpf: Prevent client connect before server bind in test_tc_tunnel.sh 2024-11-19 14:19:06 +01:00
test_tcp_check_syncookie.sh Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
test_tcp_check_syncookie_user.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
test_tcp_hdr_options.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
test_tcpbpf.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
test_tcpbpf_user.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
test_tcpnotify.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
test_tcpnotify_user.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
test_tunnel.sh Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
test_verifier.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
test_verifier_log.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
test_xdp_meta.sh Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
test_xdp_redirect.sh Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
test_xdp_veth.sh Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
test_xdp_vlan.sh Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
test_xdp_vlan_mode_generic.sh Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
test_xdp_vlan_mode_native.sh Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
test_xdping.sh Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
testing_helpers.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
testing_helpers.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
trace_helpers.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
trace_helpers.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
urandom_read.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
with_addr.sh Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
with_tunnels.sh Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
xdping.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
xdping.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00

==================
BPF Selftest Notes
==================
General instructions on running selftests can be found in
`Documentation/bpf/bpf_devel_QA.rst`_.

Additional information about selftest failures are
documented here.

profiler[23] test failures with clang/llvm <12.0.0
==================================================

With clang/llvm <12.0.0, the profiler[23] test may fail.
The symptom looks like

.. code-block:: c

  // r9 is a pointer to map_value
  // r7 is a scalar
  17:       bf 96 00 00 00 00 00 00 r6 = r9
  18:       0f 76 00 00 00 00 00 00 r6 += r7
  math between map_value pointer and register with unbounded min value is not allowed

  // the instructions below will not be seen in the verifier log
  19:       a5 07 01 00 01 01 00 00 if r7 < 257 goto +1
  20:       bf 96 00 00 00 00 00 00 r6 = r9
  // r6 is used here

The verifier will reject such code with above error.
At insn 18 the r7 is indeed unbounded. The later insn 19 checks the bounds and
the insn 20 undoes map_value addition. It is currently impossible for the
verifier to understand such speculative pointer arithmetic.
Hence
    https://reviews.llvm.org/D85570
addresses it on the compiler side. It was committed on llvm 12.

The corresponding C code
.. code-block:: c

  for (int i = 0; i < MAX_CGROUPS_PATH_DEPTH; i++) {
          filepart_length = bpf_probe_read_str(payload, ...);
          if (filepart_length <= MAX_PATH) {
                  barrier_var(filepart_length); // workaround
                  payload += filepart_length;
          }
  }

bpf_iter test failures with clang/llvm 10.0.0
=============================================

With clang/llvm 10.0.0, the following two bpf_iter tests failed:
  * ``bpf_iter/ipv6_route``
  * ``bpf_iter/netlink``

The symptom for ``bpf_iter/ipv6_route`` looks like

.. code-block:: c

  2: (79) r8 = *(u64 *)(r1 +8)
  ...
  14: (bf) r2 = r8
  15: (0f) r2 += r1
  ; BPF_SEQ_PRINTF(seq, "%pi6 %02x ", &rt->fib6_dst.addr, rt->fib6_dst.plen);
  16: (7b) *(u64 *)(r8 +64) = r2
  only read is supported

The symptom for ``bpf_iter/netlink`` looks like

.. code-block:: c

  ; struct netlink_sock *nlk = ctx->sk;
  2: (79) r7 = *(u64 *)(r1 +8)
  ...
  15: (bf) r2 = r7
  16: (0f) r2 += r1
  ; BPF_SEQ_PRINTF(seq, "%pK %-3d ", s, s->sk_protocol);
  17: (7b) *(u64 *)(r7 +0) = r2
  only read is supported

This is due to a llvm BPF backend bug. The fix 
  https://reviews.llvm.org/D78466
has been pushed to llvm 10.x release branch and will be
available in 10.0.1. The fix is available in llvm 11.0.0 trunk.

BPF CO-RE-based tests and Clang version
=======================================

A set of selftests use BPF target-specific built-ins, which might require
bleeding-edge Clang versions (Clang 12 nightly at this time).

Few sub-tests of core_reloc test suit (part of test_progs test runner) require
the following built-ins, listed with corresponding Clang diffs introducing
them to Clang/LLVM. These sub-tests are going to be skipped if Clang is too
old to support them, they shouldn't cause build failures or runtime test
failures:

  - __builtin_btf_type_id() ([0], [1], [2]);
  - __builtin_preserve_type_info(), __builtin_preserve_enum_value() ([3], [4]).

  [0] https://reviews.llvm.org/D74572
  [1] https://reviews.llvm.org/D74668
  [2] https://reviews.llvm.org/D85174
  [3] https://reviews.llvm.org/D83878
  [4] https://reviews.llvm.org/D83242