netdev - Re: [PATCH v4 bpf 2/2] selftests/bpf: extend map-in-map selftest to detect memory leaks

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 29 Jul 2020 10:48:01 -0700
From:   Andrii Nakryiko <andrii.nakryiko@...il.com>
To:     Jakub Sitnicki <jakub@...udflare.com>
Cc:     Andrii Nakryiko <andriin@...com>, bpf <bpf@...r.kernel.org>,
        Networking <netdev@...r.kernel.org>,
        Alexei Starovoitov <ast@...com>,
        Daniel Borkmann <daniel@...earbox.net>,
        Kernel Team <kernel-team@...com>,
        Song Liu <songliubraving@...com>,
        linux- stable <stable@...r.kernel.org>
Subject: Re: [PATCH v4 bpf 2/2] selftests/bpf: extend map-in-map selftest to
 detect memory leaks

On Wed, Jul 29, 2020 at 7:29 AM Jakub Sitnicki <jakub@...udflare.com> wrote:
>
> On Wed, Jul 29, 2020 at 06:09 AM CEST, Andrii Nakryiko wrote:
> > Add test validating that all inner maps are released properly after skeleton
> > is destroyed. To ensure determinism, trigger kernel-side synchronize_rcu()
> > before checking map existence by their IDs.
> >
> > Acked-by: Song Liu <songliubraving@...com>
> > Signed-off-by: Andrii Nakryiko <andriin@...com>
> > ---
> >  .../selftests/bpf/prog_tests/btf_map_in_map.c | 124 ++++++++++++++++--
> >  1 file changed, 110 insertions(+), 14 deletions(-)
> >
> > diff --git a/tools/testing/selftests/bpf/prog_tests/btf_map_in_map.c b/tools/testing/selftests/bpf/prog_tests/btf_map_in_map.c
> > index f7ee8fa377ad..f6eee3fb933c 100644
> > --- a/tools/testing/selftests/bpf/prog_tests/btf_map_in_map.c
> > +++ b/tools/testing/selftests/bpf/prog_tests/btf_map_in_map.c
> > @@ -5,10 +5,60 @@
> >
> >  #include "test_btf_map_in_map.skel.h"
> >
> > +static int duration;
> > +
> > +static __u32 bpf_map_id(struct bpf_map *map)
> > +{
> > +     struct bpf_map_info info;
> > +     __u32 info_len = sizeof(info);
> > +     int err;
> > +
> > +     memset(&info, 0, info_len);
> > +     err = bpf_obj_get_info_by_fd(bpf_map__fd(map), &info, &info_len);
> > +     if (err)
> > +             return 0;
> > +     return info.id;
> > +}
> > +
> > +/*
> > + * Trigger synchronize_cpu() in kernel.
>
> Nit: synchronize_*r*cu().

welp, yeah

>
> > + *
> > + * ARRAY_OF_MAPS/HASH_OF_MAPS lookup/update operations trigger
> > + * synchronize_rcu(), if looking up/updating non-NULL element. Use this fact
> > + * to trigger synchronize_cpu(): create map-in-map, create a trivial ARRAY
> > + * map, update map-in-map with ARRAY inner map. Then cleanup. At the end, at
> > + * least one synchronize_rcu() would be called.
> > + */
>
> That's a cool trick. I'm a bit confused by "looking up/updating non-NULL
> element". It looks like you're updating an element that is NULL/unset in
> the code below. What am I missing?

I was basically trying to say that it has to be a successful lookup or
update. For lookup that means looking up non-NULL (existing) entry.
For update -- setting valid inner map FD.

Not sure fixing this and typo above is worth it to post v5.

>
> > +static int kern_sync_rcu(void)
> > +{
> > +     int inner_map_fd, outer_map_fd, err, zero = 0;
> > +
> > +     inner_map_fd = bpf_create_map(BPF_MAP_TYPE_ARRAY, 4, 4, 1, 0);
> > +     if (CHECK(inner_map_fd < 0, "inner_map_create", "failed %d\n", -errno))
> > +             return -1;
> > +
> > +     outer_map_fd = bpf_create_map_in_map(BPF_MAP_TYPE_ARRAY_OF_MAPS, NULL,
> > +                                          sizeof(int), inner_map_fd, 1, 0);
> > +     if (CHECK(outer_map_fd < 0, "outer_map_create", "failed %d\n", -errno)) {
> > +             close(inner_map_fd);
> > +             return -1;
> > +     }
> > +
> > +     err = bpf_map_update_elem(outer_map_fd, &zero, &inner_map_fd, 0);
> > +     if (err)
> > +             err = -errno;
> > +     CHECK(err, "outer_map_update", "failed %d\n", err);
> > +     close(inner_map_fd);
> > +     close(outer_map_fd);
> > +     return err;
> > +}
> > +

[...]

trimming's good ;)