Re: [PATCH bpf v2 02/11] selftests/bpf: Test dynptr slices past end of skb

Add a selftest to ensure dynptr slices cannot include
past the end of the linear area of an skb.

Signed-off-by: Emil Tsalapatis <emil@etsalapatis.com>
---
 .../testing/selftests/bpf/prog_tests/dynptr.c | 10 ++++++++++
 .../selftests/bpf/progs/dynptr_success.c      | 20 +++++++++++++++++++
 2 files changed, 30 insertions(+)

diff --git a/tools/testing/selftests/bpf/prog_tests/dynptr.c b/tools/testing/selftests/bpf/prog_tests/dynptr.c
index 5fda11590..439656036 100644
--- a/tools/testing/selftests/bpf/prog_tests/dynptr.c
+++ b/tools/testing/selftests/bpf/prog_tests/dynptr.c

@@ -9,6 +9,7 @@
 enum test_setup_type {
        SETUP_SYSCALL_SLEEP,
        SETUP_SKB_PROG,
+       SETUP_SKB_PROG_NONLINEAR,
        SETUP_SKB_PROG_TP,
        SETUP_XDP_PROG,
 };

@@ -32,6 +33,7 @@ static struct {
        {"test_ringbuf", SETUP_SYSCALL_SLEEP},
        {"test_skb_readonly", SETUP_SKB_PROG},
        {"test_dynptr_skb_data", SETUP_SKB_PROG},
+       {"test_dynptr_skb_slice_non_linear", SETUP_SKB_PROG_NONLINEAR},
        {"test_dynptr_skb_meta_data", SETUP_SKB_PROG},
        {"test_dynptr_skb_meta_flags", SETUP_SKB_PROG},
        {"test_adjust", SETUP_SYSCALL_SLEEP},

@@ -94,7 +96,9 @@ static void verify_success(const char *prog_name, enum test_setup_type setup_typ
                bpf_link__destroy(link);
                break;
        case SETUP_SKB_PROG:
+       case SETUP_SKB_PROG_NONLINEAR:
        {
+               struct __sk_buff ctx = {};
                int prog_fd;
                char buf[64];

@@ -106,6 +110,12 @@ static void verify_success(const char *prog_name, enum test_setup_type setup_typ
                            .repeat = 1,
                );

+               if (setup_type == SETUP_SKB_PROG_NONLINEAR) {
+                       ctx.data_end = ETH_HLEN + sizeof(struct iphdr);
+                       topts.ctx_in = &ctx;
+                       topts.ctx_size_in = sizeof(ctx);
+               }
+
                prog_fd = bpf_program__fd(prog);
                if (!ASSERT_GE(prog_fd, 0, "prog_fd"))
                        goto cleanup;

diff --git a/tools/testing/selftests/bpf/progs/dynptr_success.c b/tools/testing/selftests/bpf/progs/dynptr_success.c
index e0745b6e4..b668ebd61 100644
--- a/tools/testing/selftests/bpf/progs/dynptr_success.c
+++ b/tools/testing/selftests/bpf/progs/dynptr_success.c

@@ -10,6 +10,7 @@
 #include "errno.h"

 #define PAGE_SIZE_64K 65536
+#define TEST_SKB_LINEAR_SIZE (sizeof(struct ethhdr) + sizeof(struct iphdr))

 char _license[] SEC("license") = "GPL";

@@ -211,6 +212,25 @@ int test_dynptr_skb_data(struct __sk_buff *skb)
        return 1;
 }

+SEC("?tc")
+int test_dynptr_skb_slice_non_linear(struct __sk_buff *skb)
+{
+       struct bpf_dynptr ptr;
+       void *data;
+
+       if (bpf_dynptr_from_skb(skb, 0, &ptr)) {
+               err = 1;
+               return 1;
+       }
+
+       /* Ensure we cannot read past the end of the buffer. */