bpf: add tests for direct packet access from CGROUP_SKB

Tests are added to make sure CGROUP_SKB cannot access:
  tc_classid, data_meta, flow_keys

and can read and write:
  mark, prority, and cb[0-4]

and can read other fields.

To make selftest with skb->sk work, a dummy sk is added in
bpf_prog_test_run_skb().

Signed-off-by: Song Liu <songliubraving@fb.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>

1 files changed, 15 insertions, 0 deletions

diff --git a/net/bpf/test_run.c b/net/bpf/test_run.c
index 0c423b8cd75c..c89c22c49015 100644
--- a/net/bpf/test_run.c
+++ b/net/bpf/test_run.c
@@ -10,6 +10,8 @@
 #include <linux/etherdevice.h>
 #include <linux/filter.h>
 #include <linux/sched/signal.h>
+#include <net/sock.h>
+#include <net/tcp.h>
 
 static __always_inline u32 bpf_test_run_one(struct bpf_prog *prog, void *ctx,
                 struct bpf_cgroup_storage *storage[MAX_BPF_CGROUP_STORAGE_TYPE])
@@ -115,6 +117,7 @@ int bpf_prog_test_run_skb(struct bpf_prog *prog, const union bpf_attr *kattr,
         u32 retval, duration;
         int hh_len = ETH_HLEN;
         struct sk_buff *skb;
+        struct sock *sk;
         void *data;
         int ret;
 
@@ -137,11 +140,21 @@ int bpf_prog_test_run_skb(struct bpf_prog *prog, const union bpf_attr *kattr,
                 break;
         }
 
+        sk = kzalloc(sizeof(struct sock), GFP_USER);
+        if (!sk) {
+                kfree(data);
+                return -ENOMEM;
+        }
+        sock_net_set(sk, current->nsproxy->net_ns);
+        sock_init_data(NULL, sk);
+
         skb = build_skb(data, 0);
         if (!skb) {
                 kfree(data);
+                kfree(sk);
                 return -ENOMEM;
         }
+        skb->sk = sk;
 
         skb_reserve(skb, NET_SKB_PAD + NET_IP_ALIGN);
         __skb_put(skb, size);
@@ -159,6 +172,7 @@ int bpf_prog_test_run_skb(struct bpf_prog *prog, const union bpf_attr *kattr,
 
                         if (pskb_expand_head(skb, nhead, 0, GFP_USER)) {
                                 kfree_skb(skb);
+                                kfree(sk);
                                 return -ENOMEM;
                         }
                 }
@@ -171,6 +185,7 @@ int bpf_prog_test_run_skb(struct bpf_prog *prog, const union bpf_attr *kattr,
                 size = skb_headlen(skb);
         ret = bpf_test_finish(kattr, uattr, skb->data, size, retval, duration);
         kfree_skb(skb);
+        kfree(sk);
         return ret;
 }