[PATCH bpf-next 2/2] selftests/bpf: Check bpf_skb_output() tracing restrictions

[Feng Yang]

From: Feng Yang <yangfeng@xxxxxxxxxx>

Add verifier coverage for the bpf_skb_output() tracing policy. Verify
that an fentry program can still use the helper, while the equivalent
fexit program is rejected at load time.

Signed-off-by: Yun Lu <luyun_611@xxxxxxx>
Signed-off-by: Feng Yang<yangfeng@xxxxxxxxxx>
---
 .../bpf/progs/verifier_helper_restricted.c    | 32 +++++++++++++++++++
 1 file changed, 32 insertions(+)

diff --git a/tools/testing/selftests/bpf/progs/verifier_helper_restricted.c b/tools/testing/selftests/bpf/progs/verifier_helper_restricted.c
index 889c9b78b912..058e71927cd5 100644
--- a/tools/testing/selftests/bpf/progs/verifier_helper_restricted.c
+++ b/tools/testing/selftests/bpf/progs/verifier_helper_restricted.c
@@ -3,6 +3,7 @@
 
 #include <linux/bpf.h>
 #include <bpf/bpf_helpers.h>
+#include <bpf/bpf_tracing.h>
 #include "bpf_misc.h"
 
 struct val {
@@ -17,6 +18,13 @@ struct {
 	__type(value, struct val);
 } map_spin_lock SEC(".maps");
 
+struct {
+	__uint(type, BPF_MAP_TYPE_PERF_EVENT_ARRAY);
+	__uint(max_entries, 1);
+	__type(key, __u32);
+	__type(value, __u32);
+} perf_event_map SEC(".maps");
+
 SEC("kprobe")
 __description("bpf_ktime_get_coarse_ns is forbidden in BPF_PROG_TYPE_KPROBE")
 __failure __msg("program of this type cannot use helper bpf_ktime_get_coarse_ns")
@@ -165,4 +173,28 @@ l0_%=:	exit;						\
 	: __clobber_all);
 }
 
+SEC("fentry/skb_tx_error")
+__description("bpf_skb_output is allowed in BPF_TRACE_FENTRY")
+__success
+int BPF_PROG(skb_output_fentry, void *skb)
+{
+	__u64 meta = 0;
+
+	bpf_skb_output(skb, &perf_event_map, BPF_F_CURRENT_CPU,
+		       &meta, sizeof(meta));
+	return 0;
+}
+
+SEC("fexit/skb_tx_error")
+__description("bpf_skb_output is forbidden in BPF_TRACE_FEXIT")
+__failure __msg("program of this type cannot use helper bpf_skb_output")
+int BPF_PROG(skb_output_fexit, void *skb)
+{
+	__u64 meta = 0;
+
+	bpf_skb_output(skb, &perf_event_map, BPF_F_CURRENT_CPU,
+		       &meta, sizeof(meta));
+	return 0;
+}
+
 char _license[] SEC("license") = "GPL";
-- 
2.43.0