Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Date:   Fri, 23 Nov 2018 18:35:10 +0000
From:   Ben Hutchings <ben.hutchings@codethink.co.uk>
To:     Alexei Starovoitov <ast@kernel.org>,
        Daniel Borkmann <daniel@iogearbox.net>
Cc:     netdev@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: [PATCH 3/3] selftests/bpf: Add test case for defence against SSB
 exploitation
Message-ID: <20181123183510.irdednmxibfal5mu@xylophone.i.decadent.org.uk>
References: <20181123183356.5q4bu47zpj5wdufb@xylophone.i.decadent.org.uk>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20181123183356.5q4bu47zpj5wdufb@xylophone.i.decadent.org.uk>
User-Agent: NeoMutt/20170113 (1.7.2)
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

Test that the defence added by commit af86ca4e3088 "bpf: Prevent
memory disambiguation attack" is actually being applied.

Signed-off-by: Ben Hutchings <ben.hutchings@codethink.co.uk>
---
 tools/testing/selftests/bpf/test_verifier.c | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/tools/testing/selftests/bpf/test_verifier.c b/tools/testing/selftests/bpf/test_verifier.c
index e71b7f2e5f17..ca21a63541b0 100644
--- a/tools/testing/selftests/bpf/test_verifier.c
+++ b/tools/testing/selftests/bpf/test_verifier.c
@@ -13927,6 +13927,21 @@ static struct bpf_test tests[] = {
 		.result = ACCEPT,
 	},
 	{
+		"reference tracking: defend against SSB exploitation",
+		.insns = {
+			BPF_MOV32_IMM(BPF_REG_2, 1),
+			/* stack[-1] = (integer) 1 */
+			BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -8),
+			/* stack[-1] = (pointer) context */
+			BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
+			BPF_MOV32_IMM(BPF_REG_0, 0),
+			BPF_EXIT_INSN(),
+		},
+		.infostr_unpriv = "patching in sanitization against SSB at 2",
+		.result_unpriv = ACCEPT,
+		.result = ACCEPT,
+	},
+	{
 		"calls: ctx read at start of subprog",
 		.insns = {
 			BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
-- 
Ben Hutchings, Software Developer                         Codethink Ltd
https://www.codethink.co.uk/                 Dale House, 35 Dale Street
                                     Manchester, M1 2HF, United Kingdom