diff mbox series

[RFC,v2,6/7] selftests/bpf: Prevent positive ret values in test_lsm and verify_pkcs7_sig

Message ID 20221207172434.435893-7-roberto.sassu@huaweicloud.com (mailing list archive)
State RFC
Delegated to: BPF
Headers show
Series bpf-lsm: Check return values of security modules | expand

Checks

Context Check Description
netdev/tree_selection success Guessing tree name failed - patch did not apply, async
bpf/vmtest-bpf-PR success PR summary
bpf/vmtest-bpf-VM_Test-1 success Logs for ${{ matrix.test }} on ${{ matrix.arch }} with ${{ matrix.toolchain }}
bpf/vmtest-bpf-VM_Test-2 success Logs for ShellCheck
bpf/vmtest-bpf-VM_Test-3 success Logs for build for aarch64 with gcc
bpf/vmtest-bpf-VM_Test-4 success Logs for build for aarch64 with llvm-16
bpf/vmtest-bpf-VM_Test-5 fail Logs for build for s390x with gcc
bpf/vmtest-bpf-VM_Test-6 success Logs for build for x86_64 with gcc
bpf/vmtest-bpf-VM_Test-7 success Logs for build for x86_64 with llvm-16
bpf/vmtest-bpf-VM_Test-8 success Logs for llvm-toolchain
bpf/vmtest-bpf-VM_Test-9 success Logs for set-matrix

Commit Message

Roberto Sassu Dec. 7, 2022, 5:24 p.m. UTC 
From: Roberto Sassu <roberto.sassu@huawei.com>

Modify test_lsm and verify_pkcs7_sig to ensure that they don't return
positive values.

Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
---
 tools/testing/selftests/bpf/progs/lsm.c               |  4 ++++
 .../selftests/bpf/progs/test_verify_pkcs7_sig.c       | 11 +++++++++--
 2 files changed, 13 insertions(+), 2 deletions(-)
diff mbox series

Patch

diff --git a/tools/testing/selftests/bpf/progs/lsm.c b/tools/testing/selftests/bpf/progs/lsm.c
index d8d8af623bc2..42252750d866 100644
--- a/tools/testing/selftests/bpf/progs/lsm.c
+++ b/tools/testing/selftests/bpf/progs/lsm.c
@@ -88,6 +88,10 @@  SEC("lsm/file_mprotect")
 int BPF_PROG(test_int_hook, struct vm_area_struct *vma,
 	     unsigned long reqprot, unsigned long prot, int ret)
 {
+	/* file_mprotect hook must return zero or negative values. */
+	if (ret > 0)
+		ret = -EINVAL;
+
 	if (ret != 0)
 		return ret;
 
diff --git a/tools/testing/selftests/bpf/progs/test_verify_pkcs7_sig.c b/tools/testing/selftests/bpf/progs/test_verify_pkcs7_sig.c
index ce419304ff1f..d3cab4370f29 100644
--- a/tools/testing/selftests/bpf/progs/test_verify_pkcs7_sig.c
+++ b/tools/testing/selftests/bpf/progs/test_verify_pkcs7_sig.c
@@ -42,14 +42,14 @@  struct {
 char _license[] SEC("license") = "GPL";
 
 SEC("lsm.s/bpf")
-int BPF_PROG(bpf, int cmd, union bpf_attr *attr, unsigned int size)
+s64 BPF_PROG(bpf, int cmd, union bpf_attr *attr, unsigned int size)
 {
 	struct bpf_dynptr data_ptr, sig_ptr;
 	struct data *data_val;
 	struct bpf_key *trusted_keyring;
 	__u32 pid;
 	__u64 value;
-	int ret, zero = 0;
+	s64 ret, zero = 0;
 
 	pid = bpf_get_current_pid_tgid() >> 32;
 	if (pid != monitored_pid)
@@ -86,5 +86,12 @@  int BPF_PROG(bpf, int cmd, union bpf_attr *attr, unsigned int size)
 
 	bpf_key_put(trusted_keyring);
 
+	/*
+	 * bpf hook must return zero or negative values, use s64 to propagate
+	 * the bounds to R0.
+	 */
+	if (ret > 0)
+		return -EINVAL;
+
 	return ret;
 }