diff options
author | Martin KaFai Lau <martin.lau@kernel.org> | 2024-02-15 13:12:18 -0800 |
---|---|---|
committer | Daniel Borkmann <daniel@iogearbox.net> | 2024-02-19 12:26:46 +0100 |
commit | 3f00e4a9c96f4488a924aff4e35b77c8eced897e (patch) | |
tree | f715138a7e72079c5e8608da6113196f1ac19f5d /tools/testing/selftests/bpf/progs/timer.c | |
parent | 0281b919e175bb9c3128bd3872ac2903e9436e3f (diff) | |
download | linux-stable-3f00e4a9c96f4488a924aff4e35b77c8eced897e.tar.gz linux-stable-3f00e4a9c96f4488a924aff4e35b77c8eced897e.tar.bz2 linux-stable-3f00e4a9c96f4488a924aff4e35b77c8eced897e.zip |
selftests/bpf: Test racing between bpf_timer_cancel_and_free and bpf_timer_cancel
This selftest is based on a Alexei's test adopted from an internal
user to troubleshoot another bug. During this exercise, a separate
racing bug was discovered between bpf_timer_cancel_and_free
and bpf_timer_cancel. The details can be found in the previous
patch.
This patch is to add a selftest that can trigger the bug.
I can trigger the UAF everytime in my qemu setup with KASAN. The idea
is to have multiple user space threads running in a tight loop to exercise
both bpf_map_update_elem (which calls into bpf_timer_cancel_and_free)
and bpf_timer_cancel.
Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Hou Tao <houtao1@huawei.com>
Link: https://lore.kernel.org/bpf/20240215211218.990808-2-martin.lau@linux.dev
Diffstat (limited to 'tools/testing/selftests/bpf/progs/timer.c')
-rw-r--r-- | tools/testing/selftests/bpf/progs/timer.c | 34 |
1 files changed, 33 insertions, 1 deletions
diff --git a/tools/testing/selftests/bpf/progs/timer.c b/tools/testing/selftests/bpf/progs/timer.c index 8b946c8188c6..f615da97df26 100644 --- a/tools/testing/selftests/bpf/progs/timer.c +++ b/tools/testing/selftests/bpf/progs/timer.c @@ -51,7 +51,8 @@ struct { __uint(max_entries, 1); __type(key, int); __type(value, struct elem); -} abs_timer SEC(".maps"), soft_timer_pinned SEC(".maps"), abs_timer_pinned SEC(".maps"); +} abs_timer SEC(".maps"), soft_timer_pinned SEC(".maps"), abs_timer_pinned SEC(".maps"), + race_array SEC(".maps"); __u64 bss_data; __u64 abs_data; @@ -390,3 +391,34 @@ int BPF_PROG2(test5, int, a) return 0; } + +static int race_timer_callback(void *race_array, int *race_key, struct bpf_timer *timer) +{ + bpf_timer_start(timer, 1000000, 0); + return 0; +} + +SEC("syscall") +int race(void *ctx) +{ + struct bpf_timer *timer; + int err, race_key = 0; + struct elem init; + + __builtin_memset(&init, 0, sizeof(struct elem)); + bpf_map_update_elem(&race_array, &race_key, &init, BPF_ANY); + + timer = bpf_map_lookup_elem(&race_array, &race_key); + if (!timer) + return 1; + + err = bpf_timer_init(timer, &race_array, CLOCK_MONOTONIC); + if (err && err != -EBUSY) + return 1; + + bpf_timer_set_callback(timer, race_timer_callback); + bpf_timer_start(timer, 0, 0); + bpf_timer_cancel(timer); + + return 0; +} |