selftests/bpf: Migrate LOAD_REJECT test cases to prog_tests

Move LOAD_REJECT test cases from test_sock.c to an equivalent set of
verifier tests in progs/verifier_sock.c.

Signed-off-by: Jordan Rife <jrife@google.com>
Link: https://lore.kernel.org/r/20241022152913.574836-3-jrife@google.com
Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>

diff --git a/tools/testing/selftests/bpf/progs/verifier_sock.c b/tools/testing/selftests/bpf/progs/verifier_sock.c
index ee76b51005abe71a07cc190f1c477736e72221fb..d3e70e38e4420a539739e51176cf8d246de41796 100644 (file)
--- a/tools/testing/selftests/bpf/progs/verifier_sock.c
+++ b/tools/testing/selftests/bpf/progs/verifier_sock.c
@@ -977,4 +977,64 @@ l1_%=:     r0 = *(u8*)(r7 + 0);                            \
        : __clobber_all);
 }
 
+SEC("cgroup/post_bind4")
+__description("sk->src_ip6[0] [load 1st byte]")
+__failure __msg("invalid bpf_context access off=28 size=2")
+__naked void post_bind4_read_src_ip6(void)
+{
+       asm volatile ("                                 \
+       r6 = r1;                                        \
+       r7 = *(u16*)(r6 + %[bpf_sock_src_ip6_0]);       \
+       r0 = 1;                                         \
+       exit;                                           \
+"      :
+       : __imm_const(bpf_sock_src_ip6_0, offsetof(struct bpf_sock, src_ip6[0]))
+       : __clobber_all);
+}
+
+SEC("cgroup/post_bind4")
+__description("sk->mark [load mark]")
+__failure __msg("invalid bpf_context access off=16 size=2")
+__naked void post_bind4_read_mark(void)
+{
+       asm volatile ("                                 \
+       r6 = r1;                                        \
+       r7 = *(u16*)(r6 + %[bpf_sock_mark]);            \
+       r0 = 1;                                         \
+       exit;                                           \
+"      :
+       : __imm_const(bpf_sock_mark, offsetof(struct bpf_sock, mark))
+       : __clobber_all);
+}
+
+SEC("cgroup/post_bind6")
+__description("sk->src_ip4 [load src_ip4]")
+__failure __msg("invalid bpf_context access off=24 size=2")
+__naked void post_bind6_read_src_ip4(void)
+{
+       asm volatile ("                                 \
+       r6 = r1;                                        \
+       r7 = *(u16*)(r6 + %[bpf_sock_src_ip4]);         \
+       r0 = 1;                                         \
+       exit;                                           \
+"      :
+       : __imm_const(bpf_sock_src_ip4, offsetof(struct bpf_sock, src_ip4))
+       : __clobber_all);
+}
+
+SEC("cgroup/sock_create")
+__description("sk->src_port [word load]")
+__failure __msg("invalid bpf_context access off=44 size=2")
+__naked void sock_create_read_src_port(void)
+{
+       asm volatile ("                                 \
+       r6 = r1;                                        \
+       r7 = *(u16*)(r6 + %[bpf_sock_src_port]);        \
+       r0 = 1;                                         \
+       exit;                                           \
+"      :
+       : __imm_const(bpf_sock_src_port, offsetof(struct bpf_sock, src_port))
+       : __clobber_all);
+}
+
 char _license[] SEC("license") = "GPL";

diff --git a/tools/testing/selftests/bpf/test_sock.c b/tools/testing/selftests/bpf/test_sock.c
index 9ed908163d984d754327c52e6bc29d1f2839f43f..26dff88abbaab88319f2fcadb0493df466e6f5c5 100644 (file)
--- a/tools/testing/selftests/bpf/test_sock.c
+++ b/tools/testing/selftests/bpf/test_sock.c
@@ -47,58 +47,6 @@ struct sock_test {
 };
 
 static struct sock_test tests[] = {
-       {
-               .descr = "bind4 load with invalid access: src_ip6",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_6,
-                                   offsetof(struct bpf_sock, src_ip6[0])),
-                       BPF_MOV64_IMM(BPF_REG_0, 1),
-                       BPF_EXIT_INSN(),
-               },
-               .expected_attach_type = BPF_CGROUP_INET4_POST_BIND,
-               .attach_type = BPF_CGROUP_INET4_POST_BIND,
-               .result = LOAD_REJECT,
-       },
-       {
-               .descr = "bind4 load with invalid access: mark",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_6,
-                                   offsetof(struct bpf_sock, mark)),
-                       BPF_MOV64_IMM(BPF_REG_0, 1),
-                       BPF_EXIT_INSN(),
-               },
-               .expected_attach_type = BPF_CGROUP_INET4_POST_BIND,
-               .attach_type = BPF_CGROUP_INET4_POST_BIND,
-               .result = LOAD_REJECT,
-       },
-       {
-               .descr = "bind6 load with invalid access: src_ip4",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_6,
-                                   offsetof(struct bpf_sock, src_ip4)),
-                       BPF_MOV64_IMM(BPF_REG_0, 1),
-                       BPF_EXIT_INSN(),
-               },
-               .expected_attach_type = BPF_CGROUP_INET6_POST_BIND,
-               .attach_type = BPF_CGROUP_INET6_POST_BIND,
-               .result = LOAD_REJECT,
-       },
-       {
-               .descr = "sock_create load with invalid access: src_port",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_6,
-                                   offsetof(struct bpf_sock, src_port)),
-                       BPF_MOV64_IMM(BPF_REG_0, 1),
-                       BPF_EXIT_INSN(),
-               },
-               .expected_attach_type = BPF_CGROUP_INET_SOCK_CREATE,
-               .attach_type = BPF_CGROUP_INET_SOCK_CREATE,
-               .result = LOAD_REJECT,
-       },
        {
                .descr = "sock_create load w/o expected_attach_type (compat mode)",
                .insns = {