- Linux-kselftest-mirror - lists.linaro.org

[PATCH v2 0/4] add tests to verify IFS (In Field Scan) driver functionality

by Pengfei Xu

To verify IFS (In Field Scan [1]) driver functionality, add the following 6 test cases: 1. Verify that IFS sysfs entries are created after loading the IFS module 2. Check if loading an invalid IFS test image fails and loading a valid one succeeds 3. Perform IFS scan test on each CPU using all the available image files 4. Perform IFS scan with first test image file on a random CPU for 3 rounds 5. Perform IFS ARRAY BIST(Board Integrated System Test) test on each CPU 6. Perform IFS ARRAY BIST test on a random CPU for 3 rounds These are not exhaustive, but some minimal test runs to check various parts of the driver. Some negative tests are also included. [1] https://docs.kernel.org/arch/x86/ifs.html Pengfei Xu (4): selftests: ifs: verify test interfaces are created by the driver selftests: ifs: verify test image loading functionality selftests: ifs: verify IFS scan test functionality selftests: ifs: verify IFS ARRAY BIST functionality MAINTAINERS | 1 + tools/testing/selftests/Makefile | 1 + .../drivers/platform/x86/intel/ifs/Makefile | 6 + .../platform/x86/intel/ifs/test_ifs.sh | 494 ++++++++++++++++++ 4 files changed, 502 insertions(+) create mode 100644 tools/testing/selftests/drivers/platform/x86/intel/ifs/Makefile create mode 100755 tools/testing/selftests/drivers/platform/x86/intel/ifs/test_ifs.sh --- Changes: v1 to v2: - Rebase to v6.10 cycle kernel and resolve some code conflicts - Improved checking of IFS ARRAY_BIST support by leveraging sysfs entry methods (suggested by Ashok) -- 2.43.0

6 months, 1 week

3
7
0 0

kselftest/next build: 6 builds: 0 failed, 6 passed, 1 warning (v6.10-rc7-29-gdf09b0bb09ea)

by kernelci.org bot

kselftest/next build: 6 builds: 0 failed, 6 passed, 1 warning (v6.10-rc7-29-gdf09b0bb09ea) Full Build Summary: https://kernelci.org/build/kselftest/branch/next/kernel/v6.10-rc7-29-gdf09b… Tree: kselftest Branch: next Git Describe: v6.10-rc7-29-gdf09b0bb09ea Git Commit: df09b0bb09ea9775b66a5d24dc0fe0f86855efb5 Git URL: https://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest.git Built: 4 unique architectures Warnings Detected: arm64: arm: i386: x86_64: x86_64_defconfig+kselftest (clang-16): 1 warning Warnings summary: 1 vmlinux.o: warning: objtool: set_ftrace_ops_ro+0x23: relocation to !ENDBR: .text+0x14d3e9 ================================================================================ Detailed per-defconfig build reports: -------------------------------------------------------------------------------- defconfig+kselftest (arm64, gcc-12) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- defconfig+kselftest+arm64-chromebook (arm64, gcc-12) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- i386_defconfig+kselftest (i386, gcc-12) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- multi_v7_defconfig+kselftest (arm, gcc-12) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- x86_64_defconfig+kselftest (x86_64, gcc-12) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- x86_64_defconfig+kselftest (x86_64, clang-16) — PASS, 0 errors, 1 warning, 0 section mismatches Warnings: vmlinux.o: warning: objtool: set_ftrace_ops_ro+0x23: relocation to !ENDBR: .text+0x14d3e9 --- For more info write to <info(a)kernelci.org>

6 months, 1 week

1
0
0 0

[PATCH 1/2] selftests: arm64: tags_test: conform test to TAP output

by Muhammad Usama Anjum

Conform the layout, informational and status messages to TAP. No functional change is intended other than the layout of output messages. Signed-off-by: Muhammad Usama Anjum <usama.anjum(a)collabora.com> --- tools/testing/selftests/arm64/tags/tags_test.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/tools/testing/selftests/arm64/tags/tags_test.c b/tools/testing/selftests/arm64/tags/tags_test.c index 955f87c1170d7..8ae26e496c89c 100644 --- a/tools/testing/selftests/arm64/tags/tags_test.c +++ b/tools/testing/selftests/arm64/tags/tags_test.c @@ -17,19 +17,21 @@ int main(void) static int tbi_enabled = 0; unsigned long tag = 0; struct utsname *ptr; - int err; + + ksft_print_header(); + ksft_set_plan(1); if (prctl(PR_SET_TAGGED_ADDR_CTRL, PR_TAGGED_ADDR_ENABLE, 0, 0, 0) == 0) tbi_enabled = 1; ptr = (struct utsname *)malloc(sizeof(*ptr)); if (!ptr) - ksft_exit_fail_msg("Failed to allocate utsname buffer\n"); + ksft_exit_fail_perror("Failed to allocate utsname buffer"); if (tbi_enabled) tag = 0x42; ptr = (struct utsname *)SET_TAG(ptr, tag); - err = uname(ptr); + ksft_test_result(!uname(ptr), "Syscall successful with tagged address\n"); free(ptr); - return err; + ksft_finished(); } -- 2.39.2

6 months, 1 week

3
7
0 0

[PATCH] kunit: executor: Simplify string allocation handling

by Kees Cook

The alloc/copy code pattern is better consolidated to single kstrdup (and kstrndup) calls instead. This gets rid of deprecated[1] strncpy() uses as well. Replace one other strncpy() use with the more idiomatic strscpy(). Link: https://github.com/KSPP/linux/issues/90 [1] Signed-off-by: Kees Cook <kees(a)kernel.org> --- Cc: Brendan Higgins <brendan.higgins(a)linux.dev> Cc: David Gow <davidgow(a)google.com> Cc: Rae Moar <rmoar(a)google.com> Cc: linux-kselftest(a)vger.kernel.org Cc: kunit-dev(a)googlegroups.com --- lib/kunit/executor.c | 12 +++--------- lib/kunit/executor_test.c | 2 +- 2 files changed, 4 insertions(+), 10 deletions(-) diff --git a/lib/kunit/executor.c b/lib/kunit/executor.c index 70b9a43cd257..34b7b6833df3 100644 --- a/lib/kunit/executor.c +++ b/lib/kunit/executor.c @@ -70,32 +70,26 @@ struct kunit_glob_filter { static int kunit_parse_glob_filter(struct kunit_glob_filter *parsed, const char *filter_glob) { - const int len = strlen(filter_glob); const char *period = strchr(filter_glob, '.'); if (!period) { - parsed->suite_glob = kzalloc(len + 1, GFP_KERNEL); + parsed->suite_glob = kstrdup(filter_glob, GFP_KERNEL); if (!parsed->suite_glob) return -ENOMEM; - parsed->test_glob = NULL; - strcpy(parsed->suite_glob, filter_glob); return 0; } - parsed->suite_glob = kzalloc(period - filter_glob + 1, GFP_KERNEL); + parsed->suite_glob = kstrndup(filter_glob, period - filter_glob, GFP_KERNEL); if (!parsed->suite_glob) return -ENOMEM; - parsed->test_glob = kzalloc(len - (period - filter_glob) + 1, GFP_KERNEL); + parsed->test_glob = kstrdup(period + 1, GFP_KERNEL); if (!parsed->test_glob) { kfree(parsed->suite_glob); return -ENOMEM; } - strncpy(parsed->suite_glob, filter_glob, period - filter_glob); - strncpy(parsed->test_glob, period + 1, len - (period - filter_glob)); - return 0; } diff --git a/lib/kunit/executor_test.c b/lib/kunit/executor_test.c index 3f7f967e3688..7191be9c4f9b 100644 --- a/lib/kunit/executor_test.c +++ b/lib/kunit/executor_test.c @@ -286,7 +286,7 @@ static struct kunit_suite *alloc_fake_suite(struct kunit *test, /* We normally never expect to allocate suites, hence the non-const cast. */ suite = kunit_kzalloc(test, sizeof(*suite), GFP_KERNEL); - strncpy((char *)suite->name, suite_name, sizeof(suite->name) - 1); + strscpy((char *)suite->name, suite_name); suite->test_cases = test_cases; return suite; -- 2.34.1

6 months, 1 week

2
2
0 0

[PATCH v2] kunit: executor: Simplify string allocation handling

by Kees Cook

The alloc/copy code pattern is better consolidated to single kstrdup (and kstrndup) calls instead. This gets rid of deprecated[1] strncpy() uses as well. Replace one other strncpy() use with the more idiomatic strscpy(). Link: https://github.com/KSPP/linux/issues/90 [1] Reviewed-by: David Gow <davidgow(a)google.com> Signed-off-by: Kees Cook <kees(a)kernel.org> --- Cc: Brendan Higgins <brendan.higgins(a)linux.dev> Cc: David Gow <davidgow(a)google.com> Cc: Rae Moar <rmoar(a)google.com> Cc: linux-kselftest(a)vger.kernel.org Cc: kunit-dev(a)googlegroups.com --- lib/kunit/executor.c | 12 +++--------- lib/kunit/executor_test.c | 2 +- 2 files changed, 4 insertions(+), 10 deletions(-) diff --git a/lib/kunit/executor.c b/lib/kunit/executor.c index 70b9a43cd257..34b7b6833df3 100644 --- a/lib/kunit/executor.c +++ b/lib/kunit/executor.c @@ -70,32 +70,26 @@ struct kunit_glob_filter { static int kunit_parse_glob_filter(struct kunit_glob_filter *parsed, const char *filter_glob) { - const int len = strlen(filter_glob); const char *period = strchr(filter_glob, '.'); if (!period) { - parsed->suite_glob = kzalloc(len + 1, GFP_KERNEL); + parsed->suite_glob = kstrdup(filter_glob, GFP_KERNEL); if (!parsed->suite_glob) return -ENOMEM; - parsed->test_glob = NULL; - strcpy(parsed->suite_glob, filter_glob); return 0; } - parsed->suite_glob = kzalloc(period - filter_glob + 1, GFP_KERNEL); + parsed->suite_glob = kstrndup(filter_glob, period - filter_glob, GFP_KERNEL); if (!parsed->suite_glob) return -ENOMEM; - parsed->test_glob = kzalloc(len - (period - filter_glob) + 1, GFP_KERNEL); + parsed->test_glob = kstrdup(period + 1, GFP_KERNEL); if (!parsed->test_glob) { kfree(parsed->suite_glob); return -ENOMEM; } - strncpy(parsed->suite_glob, filter_glob, period - filter_glob); - strncpy(parsed->test_glob, period + 1, len - (period - filter_glob)); - return 0; } diff --git a/lib/kunit/executor_test.c b/lib/kunit/executor_test.c index 3f7f967e3688..f0090c2729cd 100644 --- a/lib/kunit/executor_test.c +++ b/lib/kunit/executor_test.c @@ -286,7 +286,7 @@ static struct kunit_suite *alloc_fake_suite(struct kunit *test, /* We normally never expect to allocate suites, hence the non-const cast. */ suite = kunit_kzalloc(test, sizeof(*suite), GFP_KERNEL); - strncpy((char *)suite->name, suite_name, sizeof(suite->name) - 1); + strscpy((char *)suite->name, suite_name, sizeof(suite->name)); suite->test_cases = test_cases; return suite; -- 2.34.1

6 months, 1 week

1
0
0 0

[PATCH 0/4] selftest: x86: conform tests to TAP format output

by Muhammad Usama Anjum

In this series, 4 tests are being conformed to TAP. Muhammad Usama Anjum (4): selftests: x86: check_initial_reg_state: conform test to TAP format output selftests: x86: corrupt_xstate_header: conform test to TAP format output selftests: fsgsbase_restore: conform test to TAP format output selftests: entry_from_vm86: conform test to TAP format output .../selftests/x86/check_initial_reg_state.c | 24 ++-- .../selftests/x86/corrupt_xstate_header.c | 30 +++-- tools/testing/selftests/x86/entry_from_vm86.c | 109 ++++++++-------- .../testing/selftests/x86/fsgsbase_restore.c | 117 +++++++++--------- 4 files changed, 139 insertions(+), 141 deletions(-) -- 2.39.2

6 months, 1 week

2
13
0 0

[PATCH] kselftest: cpufreq: Add RTC wakeup alarm

by Shreeya Patel

Add RTC wakeup alarm for devices to resume after specific time interval. This improvement in the test will help in enabling this test in the CI systems and will eliminate the need of manual intervention for resuming back the devices after suspend/hibernation. Signed-off-by: Shreeya Patel <shreeya.patel(a)collabora.com> --- tools/testing/selftests/cpufreq/cpufreq.sh | 24 ++++++++++++++++++++++ tools/testing/selftests/cpufreq/main.sh | 13 +++++++++++- 2 files changed, 36 insertions(+), 1 deletion(-) diff --git a/tools/testing/selftests/cpufreq/cpufreq.sh b/tools/testing/selftests/cpufreq/cpufreq.sh index a8b1dbc0a3a5..a0f5b944a8fe 100755 --- a/tools/testing/selftests/cpufreq/cpufreq.sh +++ b/tools/testing/selftests/cpufreq/cpufreq.sh @@ -231,6 +231,30 @@ do_suspend() for i in `seq 1 $2`; do printf "Starting $1\n" + + if [ "$3" = "rtc" ]; then + now=$(date +%s) + wakeup_time=$((now + 15)) # Wake up after 15 seconds + + echo $wakeup_time > /sys/class/rtc/rtc0/wakealarm + + if [ $? -ne 0 ]; then + printf "Failed to set RTC wake alarm\n" + return 1 + fi + + # Enable the RTC as a wakeup source + echo enabled > /sys/class/rtc/rtc0/device/power/wakeup + + if [ $? -ne 0 ]; then + printf "Failed to set RTC wake alarm\n" + return 1 + fi + + # Reset the wakeup alarm + echo 0 > /sys/class/rtc/rtc0/wakealarm + fi + echo $filename > $SYSFS/power/state printf "Came out of $1\n" diff --git a/tools/testing/selftests/cpufreq/main.sh b/tools/testing/selftests/cpufreq/main.sh index a0eb84cf7167..f12ff7416e41 100755 --- a/tools/testing/selftests/cpufreq/main.sh +++ b/tools/testing/selftests/cpufreq/main.sh @@ -24,6 +24,8 @@ helpme() [-t <basic: Basic cpufreq testing suspend: suspend/resume, hibernate: hibernate/resume, + suspend_rtc: suspend/resume back using the RTC wakeup alarm, + hibernate_rtc: hibernate/resume back using the RTC wakeup alarm, modtest: test driver or governor modules. Only to be used with -d or -g options, sptest1: Simple governor switch to produce lockdep. sptest2: Concurrent governor switch to produce lockdep. @@ -76,7 +78,8 @@ parse_arguments() helpme ;; - t) # --func_type (Function to perform: basic, suspend, hibernate, modtest, sptest1/2/3/4 (default: basic)) + t) # --func_type (Function to perform: basic, suspend, hibernate, + # suspend_rtc, hibernate_rtc, modtest, sptest1/2/3/4 (default: basic)) FUNC=$OPTARG ;; @@ -121,6 +124,14 @@ do_test() do_suspend "hibernate" 1 ;; + "suspend_rtc") + do_suspend "suspend" 1 rtc + ;; + + "hibernate_rtc") + do_suspend "hibernate" 1 rtc + ;; + "modtest") # Do we have modules in place? if [ -z $DRIVER_MOD ] && [ -z $GOVERNOR_MOD ]; then -- 2.39.2

6 months, 1 week

2
2
0 0

[PATCH v1 0/9] selftests: kvm: s390: Add s390x ucontrol selftests

by Christoph Schlameuss

This patch series adds a selftest suite to validate the s390x architecture specific ucontrol KVM interface. When creating a VM on s390x it is possible to create it as userspace controlled VM or in short ucontrol VM. These VMs delegates the management of the VM to userspace instead of handling most events within the kernel. Consequently the userspace has to manage interrupts, memory allocation etc. Before this patch set this functionality lacks any public test cases. It is desirable to add test cases for this interface to be able to reduce the risk of breaking changes in the future. In order to provision a ucontrol VM the kernel needs to be compiled with the CONFIG_KVM_S390_UCONTROL enabled. The users with sys_admin capability can then create a new ucontrol VM providing the KVM_VM_S390_UCONTROL parameter to the KVM_CREATE_VM ioctl. The kernels existing selftest helper functions can only be partially be reused for these tests. The test cases cover existing special handling of ucontrol VMs within the implementation and basic VM creation and handling cases: * Reject setting HPAGE when VM is ucontrol * Assert KVM_GET_DIRTY_LOG is rejected * Assert KVM_S390_VM_MEM_LIMIT_SIZE is rejected * Assert state of initial SIE flags setup by the kernel * Run simple program in VM with and without DAT * Assert KVM_EXIT_S390_UCONTROL exit on not mapped memory access * Assert functionality of storage keys in ucontrol VM Running the test cases requires sys_admin capabilities to start the ucontrol VM. This can be achieved by running as root or with a command like: sudo setpriv --reuid nobody --inh-caps -all,+sys_admin \ --ambient-caps -all,+sys_admin --bounding-set -all,+sys_admin \ ./ucontrol_test The patch set does also contain some code cleanup / consolidation of architecture specific defines that are now used in multiple test cases. Christoph Schlameuss (9): selftests: kvm: s390: Define page sizes in shared header selftests: kvm: s390: Add kvm_s390_sie_block definition for userspace tests selftests: kvm: s390: Add s390x ucontrol test suite with hpage test selftests: kvm: s390: Add test fixture and simple VM setup tests selftests: kvm: s390: Add debug print functions selftests: kvm: s390: Add VM run test case selftests: kvm: s390: Add uc_map_unmap VM test case selftests: kvm: s390: Add uc_skey VM test case selftests: kvm: s390: Verify reject memory region operations for ucontrol VMs tools/testing/selftests/kvm/.gitignore | 1 + tools/testing/selftests/kvm/Makefile | 1 + .../selftests/kvm/include/s390x/debug_print.h | 78 +++ .../selftests/kvm/include/s390x/processor.h | 5 + .../testing/selftests/kvm/include/s390x/sie.h | 240 +++++++ .../selftests/kvm/lib/s390x/processor.c | 10 +- tools/testing/selftests/kvm/s390x/cmma_test.c | 7 +- tools/testing/selftests/kvm/s390x/config | 2 + .../testing/selftests/kvm/s390x/debug_test.c | 4 +- tools/testing/selftests/kvm/s390x/memop.c | 4 +- tools/testing/selftests/kvm/s390x/tprot.c | 5 +- .../selftests/kvm/s390x/ucontrol_test.c | 612 ++++++++++++++++++ 12 files changed, 953 insertions(+), 16 deletions(-) create mode 100644 tools/testing/selftests/kvm/include/s390x/debug_print.h create mode 100644 tools/testing/selftests/kvm/include/s390x/sie.h create mode 100644 tools/testing/selftests/kvm/s390x/config create mode 100644 tools/testing/selftests/kvm/s390x/ucontrol_test.c base-commit: 256abd8e550ce977b728be79a74e1729438b4948 -- 2.45.2

6 months, 1 week

2
20
0 0

[PATCH bpf-next v4 13/20] bpf, lsm: Add check for BPF LSM return value

by Xu Kuohai

From: Xu Kuohai <xukuohai(a)huawei.com> A bpf prog returning a positive number attached to file_alloc_security hook makes kernel panic. This happens because file system can not filter out the positive number returned by the LSM prog using IS_ERR, and misinterprets this positive number as a file pointer. Given that hook file_alloc_security never returned positive number before the introduction of BPF LSM, and other BPF LSM hooks may encounter similar issues, this patch adds LSM return value check in verifier, to ensure no unexpected value is returned. Fixes: 520b7aa00d8c ("bpf: lsm: Initialize the BPF LSM hooks") Reported-by: Xin Liu <liuxin350(a)huawei.com> Signed-off-by: Xu Kuohai <xukuohai(a)huawei.com> Acked-by: Eduard Zingerman <eddyz87(a)gmail.com> --- include/linux/bpf.h | 1 + include/linux/bpf_lsm.h | 9 +++++++ kernel/bpf/bpf_lsm.c | 30 ++++++++++++++++++++- kernel/bpf/btf.c | 5 +++- kernel/bpf/verifier.c | 60 ++++++++++++++++++++++++++++++++++------- 5 files changed, 94 insertions(+), 11 deletions(-) diff --git a/include/linux/bpf.h b/include/linux/bpf.h index 4f1d4a97b9d1..d255201035c4 100644 --- a/include/linux/bpf.h +++ b/include/linux/bpf.h @@ -927,6 +927,7 @@ struct bpf_insn_access_aux { }; }; struct bpf_verifier_log *log; /* for verbose logs */ + bool is_retval; /* is accessing function return value ? */ }; static inline void diff --git a/include/linux/bpf_lsm.h b/include/linux/bpf_lsm.h index 73e1f6dbec4a..ca5f2176c940 100644 --- a/include/linux/bpf_lsm.h +++ b/include/linux/bpf_lsm.h @@ -9,6 +9,7 @@ #include <linux/sched.h> #include <linux/bpf.h> +#include <linux/bpf_verifier.h> #include <linux/lsm_hooks.h> #ifdef CONFIG_BPF_LSM @@ -47,6 +48,8 @@ void bpf_lsm_find_cgroup_shim(const struct bpf_prog *prog, bpf_func_t *bpf_func) bool bpf_lsm_has_retval_param(const struct bpf_prog *prog); +int bpf_lsm_get_retval_range(const struct bpf_prog *prog, + struct bpf_retval_range *range); #else /* !CONFIG_BPF_LSM */ static inline bool bpf_lsm_is_sleepable_hook(u32 btf_id) @@ -84,6 +87,12 @@ static inline bool bpf_lsm_has_retval_param(const struct bpf_prog *prog) { return false; } + +static inline int bpf_lsm_get_retval_range(const struct bpf_prog *prog, + struct bpf_retval_range *range) +{ + return -EOPNOTSUPP; +} #endif /* CONFIG_BPF_LSM */ #endif /* _LINUX_BPF_LSM_H */ diff --git a/kernel/bpf/bpf_lsm.c b/kernel/bpf/bpf_lsm.c index a8f8358c77e3..9dd338099d4a 100644 --- a/kernel/bpf/bpf_lsm.c +++ b/kernel/bpf/bpf_lsm.c @@ -11,7 +11,6 @@ #include <linux/lsm_hooks.h> #include <linux/bpf_lsm.h> #include <linux/kallsyms.h> -#include <linux/bpf_verifier.h> #include <net/bpf_sk_storage.h> #include <linux/bpf_local_storage.h> #include <linux/btf_ids.h> @@ -420,3 +419,32 @@ bool bpf_lsm_has_retval_param(const struct bpf_prog *prog) return btf_id_set_contains(&retval_param_lsm_hooks, prog->aux->attach_btf_id); } + +/* hooks return 0 or 1 */ +BTF_SET_START(bool_lsm_hooks) +BTF_ID(func, bpf_lsm_xfrm_state_pol_flow_match) +BTF_ID(func, bpf_lsm_audit_rule_known) +BTF_ID(func, bpf_lsm_inode_xattr_skipcap) +BTF_SET_END(bool_lsm_hooks) + +int bpf_lsm_get_retval_range(const struct bpf_prog *prog, + struct bpf_retval_range *retval_range) +{ + /* no return value range for void hooks */ + if (!prog->aux->attach_func_proto->type) + return -EINVAL; + + if (btf_id_set_contains(&bool_lsm_hooks, prog->aux->attach_btf_id)) { + retval_range->minval = 0; + retval_range->maxval = 1; + } else { + /* All other LSM hooks, except task_prctl, return 0 on success + * and negative error code on failure. + * To keep things simple, we only allow bpf progs to return 0 + * or negative errno for task_prctl. + */ + retval_range->minval = -MAX_ERRNO; + retval_range->maxval = 0; + } + return 0; +} diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c index df299d600b10..ce892565367d 100644 --- a/kernel/bpf/btf.c +++ b/kernel/bpf/btf.c @@ -6416,8 +6416,11 @@ bool btf_ctx_access(int off, int size, enum bpf_access_type type, if (arg == nr_args) { switch (prog->expected_attach_type) { - case BPF_LSM_CGROUP: case BPF_LSM_MAC: + /* mark we are accessing the return value */ + info->is_retval = true; + fallthrough; + case BPF_LSM_CGROUP: case BPF_TRACE_FEXIT: /* When LSM programs are attached to void LSM hooks * they use FEXIT trampolines and when attached to diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index a0bbef2d14e4..6f5d8ca995d6 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -2334,6 +2334,25 @@ static void mark_reg_unknown(struct bpf_verifier_env *env, __mark_reg_unknown(env, regs + regno); } +static int __mark_reg_s32_range(struct bpf_verifier_env *env, + struct bpf_reg_state *regs, + u32 regno, + s32 s32_min, + s32 s32_max) +{ + struct bpf_reg_state *reg = regs + regno; + + reg->s32_min_value = max_t(s32, reg->s32_min_value, s32_min); + reg->s32_max_value = min_t(s32, reg->s32_max_value, s32_max); + + reg->smin_value = max_t(s64, reg->smin_value, s32_min); + reg->smax_value = min_t(s64, reg->smax_value, s32_max); + + reg_bounds_sync(reg); + + return reg_bounds_sanity_check(env, reg, "s32_range"); +} + static void __mark_reg_not_init(const struct bpf_verifier_env *env, struct bpf_reg_state *reg) { @@ -5587,11 +5606,12 @@ static int check_packet_access(struct bpf_verifier_env *env, u32 regno, int off, /* check access to 'struct bpf_context' fields. Supports fixed offsets only */ static int check_ctx_access(struct bpf_verifier_env *env, int insn_idx, int off, int size, enum bpf_access_type t, enum bpf_reg_type *reg_type, - struct btf **btf, u32 *btf_id) + struct btf **btf, u32 *btf_id, bool *is_retval) { struct bpf_insn_access_aux info = { .reg_type = *reg_type, .log = &env->log, + .is_retval = false, }; if (env->ops->is_valid_access && @@ -5604,6 +5624,7 @@ static int check_ctx_access(struct bpf_verifier_env *env, int insn_idx, int off, * type of narrower access. */ *reg_type = info.reg_type; + *is_retval = info.is_retval; if (base_type(*reg_type) == PTR_TO_BTF_ID) { *btf = info.btf; @@ -6803,6 +6824,17 @@ static int check_stack_access_within_bounds( return grow_stack_state(env, state, -min_off /* size */); } +static bool get_func_retval_range(struct bpf_prog *prog, + struct bpf_retval_range *range) +{ + if (prog->type == BPF_PROG_TYPE_LSM && + prog->expected_attach_type == BPF_LSM_MAC && + !bpf_lsm_get_retval_range(prog, range)) { + return true; + } + return false; +} + /* check whether memory at (regno + off) is accessible for t = (read | write) * if t==write, value_regno is a register which value is stored into memory * if t==read, value_regno is a register which will receive the value from memory @@ -6907,6 +6939,8 @@ static int check_mem_access(struct bpf_verifier_env *env, int insn_idx, u32 regn if (!err && value_regno >= 0 && (t == BPF_READ || rdonly_mem)) mark_reg_unknown(env, regs, value_regno); } else if (reg->type == PTR_TO_CTX) { + bool is_retval = false; + struct bpf_retval_range range; enum bpf_reg_type reg_type = SCALAR_VALUE; struct btf *btf = NULL; u32 btf_id = 0; @@ -6922,7 +6956,7 @@ static int check_mem_access(struct bpf_verifier_env *env, int insn_idx, u32 regn return err; err = check_ctx_access(env, insn_idx, off, size, t, &reg_type, &btf, - &btf_id); + &btf_id, &is_retval); if (err) verbose_linfo(env, insn_idx, "; "); if (!err && t == BPF_READ && value_regno >= 0) { @@ -6931,7 +6965,14 @@ static int check_mem_access(struct bpf_verifier_env *env, int insn_idx, u32 regn * case, we know the offset is zero. */ if (reg_type == SCALAR_VALUE) { - mark_reg_unknown(env, regs, value_regno); + if (is_retval && get_func_retval_range(env->prog, &range)) { + err = __mark_reg_s32_range(env, regs, value_regno, + range.minval, range.maxval); + if (err) + return err; + } else { + mark_reg_unknown(env, regs, value_regno); + } } else { mark_reg_known_zero(env, regs, value_regno); @@ -15782,12 +15823,13 @@ static int check_return_code(struct bpf_verifier_env *env, int regno, const char case BPF_PROG_TYPE_LSM: if (env->prog->expected_attach_type != BPF_LSM_CGROUP) { - /* Regular BPF_PROG_TYPE_LSM programs can return - * any value. - */ - return 0; - } - if (!env->prog->aux->attach_func_proto->type) { + /* no range found, any return value is allowed */ + if (!get_func_retval_range(env->prog, &range)) + return 0; + /* no restricted range, any return value is allowed */ + if (range.minval == S32_MIN && range.maxval == S32_MAX) + return 0; + } else if (!env->prog->aux->attach_func_proto->type) { /* Make sure programs that attach to void * hooks don't try to modify return value. */ -- 2.30.2

6 months, 1 week

1
7
0 0

Re: [syzbot] [mm?] INFO: rcu detected stall in sys_wait4 (4)

by syzbot

syzbot suspects this issue was fixed by commit: commit fb66df20a7201e60f2b13d7f95d031b31a8831d3 Author: Vladimir Oltean <vladimir.oltean(a)nxp.com> Date: Mon May 27 15:39:55 2024 +0000 net/sched: taprio: extend minimum interval restriction to entire cycle too bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=10593441980000 start commit: fe46a7dd189e Merge tag 'sound-6.9-rc1' of git://git.kernel.. git tree: upstream kernel config: https://syzkaller.appspot.com/x/.config?x=fe78468a74fdc3b7 dashboard link: https://syzkaller.appspot.com/bug?extid=6969434de600a6ba9f07 syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1091a5f6180000 C reproducer: https://syzkaller.appspot.com/x/repro.c?x=17a22c13180000 If the result looks correct, please mark the issue as fixed by replying with: #syz fix: net/sched: taprio: extend minimum interval restriction to entire cycle too For information about bisection process see: https://goo.gl/tpsmEJ#bisection

6 months, 1 week

1
0
0 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

Linux-kselftest-mirror