From: Tiezhu Yang <yangtiezhu@loongson.cn>
To: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
Sasha Levin <sashal@kernel.org>
Cc: stable@vger.kernel.org, bpf@vger.kernel.org,
"Björn Töpel" <bjorn.topel@gmail.com>,
"Andrii Nakryiko" <andrii@kernel.org>
Subject: [PATCH 4.19 9/9] selftests/bpf: Avoid running unprivileged tests with alignment requirements
Date: Wed, 2 Jun 2021 11:27:53 +0800 [thread overview]
Message-ID: <1622604473-781-10-git-send-email-yangtiezhu@loongson.cn> (raw)
In-Reply-To: <1622604473-781-1-git-send-email-yangtiezhu@loongson.cn>
From: Björn Töpel <bjorn.topel@gmail.com>
commit c77b0589ca29ad1859fe7d7c1ecd63c0632379fa upstream
Some architectures have strict alignment requirements. In that case,
the BPF verifier detects if a program has unaligned accesses and
rejects them. A user can pass BPF_F_ANY_ALIGNMENT to a program to
override this check. That, however, will only work when a privileged
user loads a program. An unprivileged user loading a program with this
flag will be rejected prior entering the verifier.
Hence, it does not make sense to load unprivileged programs without
strict alignment when testing the verifier. This patch avoids exactly
that.
Signed-off-by: Björn Töpel <bjorn.topel@gmail.com>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Acked-by: Luke Nelson <luke.r.nels@gmail.com>
Link: https://lore.kernel.org/bpf/20201118071640.83773-3-bjorn.topel@gmail.com
Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn>
---
tools/testing/selftests/bpf/test_verifier.c | 13 +++++++++++++
1 file changed, 13 insertions(+)
diff --git a/tools/testing/selftests/bpf/test_verifier.c b/tools/testing/selftests/bpf/test_verifier.c
index b0fd67c..b443245 100644
--- a/tools/testing/selftests/bpf/test_verifier.c
+++ b/tools/testing/selftests/bpf/test_verifier.c
@@ -13045,6 +13045,19 @@ static void get_unpriv_disabled()
static bool test_as_unpriv(struct bpf_test *test)
{
+#ifndef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS
+ /* Some architectures have strict alignment requirements. In
+ * that case, the BPF verifier detects if a program has
+ * unaligned accesses and rejects them. A user can pass
+ * BPF_F_ANY_ALIGNMENT to a program to override this
+ * check. That, however, will only work when a privileged user
+ * loads a program. An unprivileged user loading a program
+ * with this flag will be rejected prior entering the
+ * verifier.
+ */
+ if (test->flags & F_NEEDS_EFFICIENT_UNALIGNED_ACCESS)
+ return false;
+#endif
return !test->prog_type ||
test->prog_type == BPF_PROG_TYPE_SOCKET_FILTER ||
test->prog_type == BPF_PROG_TYPE_CGROUP_SKB;
--
2.1.0
next prev parent reply other threads:[~2021-06-02 3:28 UTC|newest]
Thread overview: 13+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-06-02 3:27 [PATCH 4.19 0/9] bpf: fix verifier selftests on inefficient unaligned access architectures Tiezhu Yang
2021-06-02 3:27 ` [PATCH 4.19 1/9] bpf: fix test suite to enable all unpriv program types Tiezhu Yang
2021-06-02 3:27 ` [PATCH 4.19 2/9] bpf: test make sure to run unpriv test cases in test_verifier Tiezhu Yang
2021-06-02 3:27 ` [PATCH 4.19 3/9] selftests/bpf: Generalize dummy program types Tiezhu Yang
2021-06-02 3:27 ` [PATCH 4.19 4/9] bpf: Add BPF_F_ANY_ALIGNMENT Tiezhu Yang
2021-06-02 3:27 ` [PATCH 4.19 5/9] bpf: Adjust F_NEEDS_EFFICIENT_UNALIGNED_ACCESS handling in test_verifier.c Tiezhu Yang
2021-06-02 3:27 ` [PATCH 4.19 6/9] bpf: Make more use of 'any' alignment " Tiezhu Yang
2021-06-02 3:27 ` [PATCH 4.19 7/9] bpf: Apply F_NEEDS_EFFICIENT_UNALIGNED_ACCESS to more ACCEPT test cases Tiezhu Yang
2021-06-02 3:27 ` [PATCH 4.19 8/9] selftests/bpf: add "any alignment" annotation for some tests Tiezhu Yang
2021-06-02 3:27 ` Tiezhu Yang [this message]
2021-06-05 7:16 ` [PATCH 4.19 0/9] bpf: fix verifier selftests on inefficient unaligned access architectures Tiezhu Yang
2021-06-08 14:40 ` Greg Kroah-Hartman
2021-06-08 14:45 ` Greg Kroah-Hartman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1622604473-781-10-git-send-email-yangtiezhu@loongson.cn \
--to=yangtiezhu@loongson.cn \
--cc=andrii@kernel.org \
--cc=bjorn.topel@gmail.com \
--cc=bpf@vger.kernel.org \
--cc=gregkh@linuxfoundation.org \
--cc=sashal@kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).