From 33a154a96e71a34a1bcca9f40da343dbbf7b38b4 Mon Sep 17 00:00:00 2001 From: Alexei Starovoitov Date: Thu, 1 Oct 2026 14:52:55 +0000 Subject: selftests/bpf: Test packet range of pointers sharing an id Add tests where two packet pointers share an id and tightening one pointer's umax from its var_off would put it less than their constant distance from the other's umax: with an index & 0x38 capped at 50, the base pointer keeps umax 50, so the pointer 8 bytes further on must keep umax 58, even though its known bits allow at most 56. These refused a valid program or accepted an out-of-bounds access before the fix: - check the advanced copy, load through the base: valid, was refused; - check the base, load the byte at base + 1 through a copy advanced by 8: was accepted; - check base + 4, load 4 bytes at base + 2 through base + 8: reads two bytes past the checked range, was accepted; - the same as the second with data_meta pointers checked against data: was accepted. These pass with and without the fix and cover nearby paths: - subtract an unknown scalar from a checked pointer and load below it (the range is kept across a new id); - reach a load through two paths whose checks cover 8 and 7 bytes after the loaded pointer; the second path must not be pruned by the first; - spill a copy of a pointer, check the pointer, fill the copy and load one byte past the checked range: the load is refused, and the copy has the range of the check. Signed-off-by: Alexei Starovoitov Link: https://lore.kernel.org/bpf/20261001145255.855630-2-alexei.starovoitov@gmail.com Signed-off-by: Kumar Kartikeya Dwivedi --- include/trace/events/devlink.h | 234 +++++++++++++++++++++++++++++++++++++++++ 1 file changed, 234 insertions(+) create mode 100644 include/trace/events/devlink.h (limited to 'include/trace/events/devlink.h') diff --git a/include/trace/events/devlink.h b/include/trace/events/devlink.h new file mode 100644 index 000000000..4f8edf77d --- /dev/null +++ b/include/trace/events/devlink.h @@ -0,0 +1,234 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +#if IS_ENABLED(CONFIG_NET_DEVLINK) + +#undef TRACE_SYSTEM +#define TRACE_SYSTEM devlink + +#if !defined(_TRACE_DEVLINK_H) || defined(TRACE_HEADER_MULTI_READ) +#define _TRACE_DEVLINK_H + +#include +#include +#include + +/* + * Tracepoint for devlink hardware message: + */ +TRACE_EVENT(devlink_hwmsg, + TP_PROTO(const struct devlink *devlink, bool incoming, + unsigned long type, const u8 *buf, size_t len), + + TP_ARGS(devlink, incoming, type, buf, len), + + TP_STRUCT__entry( + __string(bus_name, devlink_bus_name(devlink)) + __string(dev_name, devlink_dev_name(devlink)) + __string(driver_name, devlink_dev_driver_name(devlink)) + __field(bool, incoming) + __field(unsigned long, type) + __dynamic_array(u8, buf, len) + __field(size_t, len) + ), + + TP_fast_assign( + __assign_str(bus_name); + __assign_str(dev_name); + __assign_str(driver_name); + __entry->incoming = incoming; + __entry->type = type; + memcpy(__get_dynamic_array(buf), buf, len); + __entry->len = len; + ), + + TP_printk("bus_name=%s dev_name=%s driver_name=%s incoming=%d type=%lu buf=0x[%*phD] len=%zu", + __get_str(bus_name), __get_str(dev_name), + __get_str(driver_name), __entry->incoming, __entry->type, + (int) __entry->len, __get_dynamic_array(buf), __entry->len) +); + +/* + * Tracepoint for devlink hardware error: + */ +TRACE_EVENT(devlink_hwerr, + TP_PROTO(const struct devlink *devlink, int err, const char *msg), + + TP_ARGS(devlink, err, msg), + + TP_STRUCT__entry( + __string(bus_name, devlink_bus_name(devlink)) + __string(dev_name, devlink_dev_name(devlink)) + __string(driver_name, devlink_dev_driver_name(devlink)) + __field(int, err) + __string(msg, msg) + ), + + TP_fast_assign( + __assign_str(bus_name); + __assign_str(dev_name); + __assign_str(driver_name); + __entry->err = err; + __assign_str(msg); + ), + + TP_printk("bus_name=%s dev_name=%s driver_name=%s err=%d %s", + __get_str(bus_name), __get_str(dev_name), + __get_str(driver_name), __entry->err, __get_str(msg)) +); + +/* + * Tracepoint for devlink health message: + */ +TRACE_EVENT(devlink_health_report, + TP_PROTO(const struct devlink *devlink, const char *reporter_name, + const char *msg), + + TP_ARGS(devlink, reporter_name, msg), + + TP_STRUCT__entry( + __string(bus_name, devlink_bus_name(devlink)) + __string(dev_name, devlink_dev_name(devlink)) + __string(driver_name, devlink_dev_driver_name(devlink)) + __string(reporter_name, reporter_name) + __string(msg, msg) + ), + + TP_fast_assign( + __assign_str(bus_name); + __assign_str(dev_name); + __assign_str(driver_name); + __assign_str(reporter_name); + __assign_str(msg); + ), + + TP_printk("bus_name=%s dev_name=%s driver_name=%s reporter_name=%s: %s", + __get_str(bus_name), __get_str(dev_name), + __get_str(driver_name), __get_str(reporter_name), + __get_str(msg)) +); + +/* + * Tracepoint for devlink health recover aborted message: + */ +TRACE_EVENT(devlink_health_recover_aborted, + TP_PROTO(const struct devlink *devlink, const char *reporter_name, + bool health_state, u64 time_since_last_recover), + + TP_ARGS(devlink, reporter_name, health_state, time_since_last_recover), + + TP_STRUCT__entry( + __string(bus_name, devlink_bus_name(devlink)) + __string(dev_name, devlink_dev_name(devlink)) + __string(driver_name, devlink_dev_driver_name(devlink)) + __string(reporter_name, reporter_name) + __field(bool, health_state) + __field(u64, time_since_last_recover) + ), + + TP_fast_assign( + __assign_str(bus_name); + __assign_str(dev_name); + __assign_str(driver_name); + __assign_str(reporter_name); + __entry->health_state = health_state; + __entry->time_since_last_recover = time_since_last_recover; + ), + + TP_printk("bus_name=%s dev_name=%s driver_name=%s reporter_name=%s: health_state=%d time_since_last_recover=%llu recover aborted", + __get_str(bus_name), __get_str(dev_name), + __get_str(driver_name), __get_str(reporter_name), + __entry->health_state, + __entry->time_since_last_recover) +); + +/* + * Tracepoint for devlink health reporter state update: + */ +TRACE_EVENT(devlink_health_reporter_state_update, + TP_PROTO(const struct devlink *devlink, const char *reporter_name, + bool new_state), + + TP_ARGS(devlink, reporter_name, new_state), + + TP_STRUCT__entry( + __string(bus_name, devlink_bus_name(devlink)) + __string(dev_name, devlink_dev_name(devlink)) + __string(driver_name, devlink_dev_driver_name(devlink)) + __string(reporter_name, reporter_name) + __field(u8, new_state) + ), + + TP_fast_assign( + __assign_str(bus_name); + __assign_str(dev_name); + __assign_str(driver_name); + __assign_str(reporter_name); + __entry->new_state = new_state; + ), + + TP_printk("bus_name=%s dev_name=%s driver_name=%s reporter_name=%s: new_state=%d", + __get_str(bus_name), __get_str(dev_name), + __get_str(driver_name), __get_str(reporter_name), + __entry->new_state) +); + +/* + * Tracepoint for devlink packet trap: + */ +TRACE_EVENT(devlink_trap_report, + TP_PROTO(const struct devlink *devlink, struct sk_buff *skb, + const struct devlink_trap_metadata *metadata), + + TP_ARGS(devlink, skb, metadata), + + TP_STRUCT__entry( + __string(bus_name, devlink_bus_name(devlink)) + __string(dev_name, devlink_dev_name(devlink)) + __string(driver_name, devlink_dev_driver_name(devlink)) + __string(trap_name, metadata->trap_name) + __string(trap_group_name, metadata->trap_group_name) + __array(char, input_dev_name, IFNAMSIZ) + ), + + TP_fast_assign( + struct net_device *input_dev = metadata->input_dev; + + __assign_str(bus_name); + __assign_str(dev_name); + __assign_str(driver_name); + __assign_str(trap_name); + __assign_str(trap_group_name); + strscpy(__entry->input_dev_name, input_dev ? input_dev->name : "NULL", IFNAMSIZ); + ), + + TP_printk("bus_name=%s dev_name=%s driver_name=%s trap_name=%s " + "trap_group_name=%s input_dev_name=%s", __get_str(bus_name), + __get_str(dev_name), __get_str(driver_name), + __get_str(trap_name), __get_str(trap_group_name), + __entry->input_dev_name) +); + +#endif /* _TRACE_DEVLINK_H */ + +/* This part must be outside protection */ +#include + +#else /* CONFIG_NET_DEVLINK */ + +#if !defined(_TRACE_DEVLINK_H) +#define _TRACE_DEVLINK_H + +#include + +static inline void trace_devlink_hwmsg(const struct devlink *devlink, + bool incoming, unsigned long type, + const u8 *buf, size_t len) +{ +} + +static inline void trace_devlink_hwerr(const struct devlink *devlink, + int err, const char *msg) +{ +} +#endif /* _TRACE_DEVLINK_H */ + +#endif -- cgit v1.3.1