selftests/bpf: Add tests for raw_tp null handling

Ensure that trusted PTR_TO_BTF_ID accesses perform PROBE_MEM handling in
raw_tp program. Without the previous fix, this selftest crashes the
kernel due to a NULL-pointer dereference. Also ensure that dead code
elimination does not kick in for checks on the pointer.

Reviewed-by: Jiri Olsa <jolsa@kernel.org>
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Link: https://lore.kernel.org/r/20241104171959.2938862-4-memxor@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>

diff --git a/tools/testing/selftests/bpf/bpf_testmod/bpf_testmod-events.h b/tools/testing/selftests/bpf/bpf_testmod/bpf_testmod-events.h
index 6c3b4d4f173ac62783db42894c20b9d9655bd5c8..aeef86b3da747a5011d76ee52589ea5231f23239 100644 (file)
--- a/tools/testing/selftests/bpf/bpf_testmod/bpf_testmod-events.h
+++ b/tools/testing/selftests/bpf/bpf_testmod/bpf_testmod-events.h
@@ -40,6 +40,14 @@ DECLARE_TRACE(bpf_testmod_test_nullable_bare,
        TP_ARGS(ctx__nullable)
 );
 
+struct sk_buff;
+
+DECLARE_TRACE(bpf_testmod_test_raw_tp_null,
+       TP_PROTO(struct sk_buff *skb),
+       TP_ARGS(skb)
+);
+
+
 #undef BPF_TESTMOD_DECLARE_TRACE
 #ifdef DECLARE_TRACE_WRITABLE
 #define BPF_TESTMOD_DECLARE_TRACE(call, proto, args, size) \

diff --git a/tools/testing/selftests/bpf/bpf_testmod/bpf_testmod.c b/tools/testing/selftests/bpf/bpf_testmod/bpf_testmod.c
index 8835761d9a126ad7a2e13c57e70fae96dcf8aa6f..4e6a9e9c036873396b3581ead8ff7dc4acf46494 100644 (file)
--- a/tools/testing/selftests/bpf/bpf_testmod/bpf_testmod.c
+++ b/tools/testing/selftests/bpf/bpf_testmod/bpf_testmod.c
@@ -380,6 +380,8 @@ bpf_testmod_test_read(struct file *file, struct kobject *kobj,
 
        (void)bpf_testmod_test_arg_ptr_to_struct(&struct_arg1_2);
 
+       (void)trace_bpf_testmod_test_raw_tp_null(NULL);
+
        struct_arg3 = kmalloc((sizeof(struct bpf_testmod_struct_arg_3) +
                                sizeof(int)), GFP_KERNEL);
        if (struct_arg3 != NULL) {

diff --git a/tools/testing/selftests/bpf/prog_tests/raw_tp_null.c b/tools/testing/selftests/bpf/prog_tests/raw_tp_null.c
new file mode 100644 (file)
index 0000000..6fa1944
--- /dev/null
+++ b/tools/testing/selftests/bpf/prog_tests/raw_tp_null.c
@@ -0,0 +1,25 @@
+// SPDX-License-Identifier: GPL-2.0
+/* Copyright (c) 2024 Meta Platforms, Inc. and affiliates. */
+
+#include <test_progs.h>
+#include "raw_tp_null.skel.h"
+
+void test_raw_tp_null(void)
+{
+       struct raw_tp_null *skel;
+
+       skel = raw_tp_null__open_and_load();
+       if (!ASSERT_OK_PTR(skel, "raw_tp_null__open_and_load"))
+               return;
+
+       skel->bss->tid = sys_gettid();
+
+       if (!ASSERT_OK(raw_tp_null__attach(skel), "raw_tp_null__attach"))
+               goto end;
+
+       ASSERT_OK(trigger_module_test_read(2), "trigger testmod read");
+       ASSERT_EQ(skel->bss->i, 3, "invocations");
+
+end:
+       raw_tp_null__destroy(skel);
+}

diff --git a/tools/testing/selftests/bpf/progs/raw_tp_null.c b/tools/testing/selftests/bpf/progs/raw_tp_null.c
new file mode 100644 (file)
index 0000000..457f34c
--- /dev/null
+++ b/tools/testing/selftests/bpf/progs/raw_tp_null.c
@@ -0,0 +1,32 @@
+// SPDX-License-Identifier: GPL-2.0
+/* Copyright (c) 2024 Meta Platforms, Inc. and affiliates. */
+
+#include <vmlinux.h>
+#include <bpf/bpf_tracing.h>
+
+char _license[] SEC("license") = "GPL";
+
+int tid;
+int i;
+
+SEC("tp_btf/bpf_testmod_test_raw_tp_null")
+int BPF_PROG(test_raw_tp_null, struct sk_buff *skb)
+{
+       struct task_struct *task = bpf_get_current_task_btf();
+
+       if (task->pid != tid)
+               return 0;
+
+       i = i + skb->mark + 1;
+       /* The compiler may move the NULL check before this deref, which causes
+        * the load to fail as deref of scalar. Prevent that by using a barrier.
+        */
+       barrier();
+       /* If dead code elimination kicks in, the increment below will
+        * be removed. For raw_tp programs, we mark input arguments as
+        * PTR_MAYBE_NULL, so branch prediction should never kick in.
+        */
+       if (!skb)
+               i += 2;
+       return 0;
+}