Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 0d3679e9 authored by Alexei Starovoitov's avatar Alexei Starovoitov Committed by Daniel Borkmann
Browse files

selftests/bpf: add basic verifier tests for loops 

This set of tests is a rewrite of Edward's earlier tests:
https://patchwork.ozlabs.org/patch/877221/



Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
parent aeee380c

tools/testing/selftests/bpf/verifier/loops1.c

0 → 100644
+161 −0
Original line number Diff line number Diff line 
{

	"bounded loop, count to 4",

	.insns = {

	BPF_MOV64_IMM(BPF_REG_0, 0),

	BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 1),

	BPF_JMP_IMM(BPF_JLT, BPF_REG_0, 4, -2),

	BPF_EXIT_INSN(),

	},

	.result = ACCEPT,

	.prog_type = BPF_PROG_TYPE_TRACEPOINT,

	.retval = 4,

},

{

	"bounded loop, count to 20",

	.insns = {

	BPF_MOV64_IMM(BPF_REG_0, 0),

	BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 3),

	BPF_JMP_IMM(BPF_JLT, BPF_REG_0, 20, -2),

	BPF_EXIT_INSN(),

	},

	.result = ACCEPT,

	.prog_type = BPF_PROG_TYPE_TRACEPOINT,

},

{

	"bounded loop, count from positive unknown to 4",

	.insns = {

	BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_get_prandom_u32),

	BPF_JMP_IMM(BPF_JSLT, BPF_REG_0, 0, 2),

	BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 1),

	BPF_JMP_IMM(BPF_JLT, BPF_REG_0, 4, -2),

	BPF_EXIT_INSN(),

	},

	.result = ACCEPT,

	.prog_type = BPF_PROG_TYPE_TRACEPOINT,

	.retval = 4,

},

{

	"bounded loop, count from totally unknown to 4",

	.insns = {

	BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_get_prandom_u32),

	BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 1),

	BPF_JMP_IMM(BPF_JLT, BPF_REG_0, 4, -2),

	BPF_EXIT_INSN(),

	},

	.result = ACCEPT,

	.prog_type = BPF_PROG_TYPE_TRACEPOINT,

},

{

	"bounded loop, count to 4 with equality",

	.insns = {

		BPF_MOV64_IMM(BPF_REG_0, 0),

		BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 1),

		BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 4, -2),

		BPF_EXIT_INSN(),

	},

	.result = ACCEPT,

	.prog_type = BPF_PROG_TYPE_TRACEPOINT,

},

{

	"bounded loop, start in the middle",

	.insns = {

		BPF_MOV64_IMM(BPF_REG_0, 0),

		BPF_JMP_A(1),

		BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 1),

		BPF_JMP_IMM(BPF_JLT, BPF_REG_0, 4, -2),

		BPF_EXIT_INSN(),

	},

	.result = REJECT,

	.errstr = "back-edge",

	.prog_type = BPF_PROG_TYPE_TRACEPOINT,

	.retval = 4,

},

{

	"bounded loop containing a forward jump",

	.insns = {

		BPF_MOV64_IMM(BPF_REG_0, 0),

		BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 1),

		BPF_JMP_REG(BPF_JEQ, BPF_REG_0, BPF_REG_0, 0),

		BPF_JMP_IMM(BPF_JLT, BPF_REG_0, 4, -3),

		BPF_EXIT_INSN(),

	},

	.result = ACCEPT,

	.prog_type = BPF_PROG_TYPE_TRACEPOINT,

	.retval = 4,

},

{

	"bounded loop that jumps out rather than in",

	.insns = {

	BPF_MOV64_IMM(BPF_REG_6, 0),

	BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),

	BPF_JMP_IMM(BPF_JGT, BPF_REG_6, 10000, 2),

	BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_get_prandom_u32),

	BPF_JMP_A(-4),

	BPF_EXIT_INSN(),

	},

	.result = ACCEPT,

	.prog_type = BPF_PROG_TYPE_TRACEPOINT,

},

{

	"infinite loop after a conditional jump",

	.insns = {

	BPF_MOV64_IMM(BPF_REG_0, 5),

	BPF_JMP_IMM(BPF_JLT, BPF_REG_0, 4, 2),

	BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 1),

	BPF_JMP_A(-2),

	BPF_EXIT_INSN(),

	},

	.result = REJECT,

	.errstr = "program is too large",

	.prog_type = BPF_PROG_TYPE_TRACEPOINT,

},

{

	"bounded recursion",

	.insns = {

	BPF_MOV64_IMM(BPF_REG_1, 0),

	BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),

	BPF_EXIT_INSN(),

	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 1),

	BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),

	BPF_JMP_IMM(BPF_JLT, BPF_REG_1, 4, 1),

	BPF_EXIT_INSN(),

	BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, -5),

	BPF_EXIT_INSN(),

	},

	.result = REJECT,

	.errstr = "back-edge",

	.prog_type = BPF_PROG_TYPE_TRACEPOINT,

},

{

	"infinite loop in two jumps",

	.insns = {

	BPF_MOV64_IMM(BPF_REG_0, 0),

	BPF_JMP_A(0),

	BPF_JMP_IMM(BPF_JLT, BPF_REG_0, 4, -2),

	BPF_EXIT_INSN(),

	},

	.result = REJECT,

	.errstr = "loop detected",

	.prog_type = BPF_PROG_TYPE_TRACEPOINT,

},

{

	"infinite loop: three-jump trick",

	.insns = {

	BPF_MOV64_IMM(BPF_REG_0, 0),

	BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 1),

	BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 1),

	BPF_JMP_IMM(BPF_JLT, BPF_REG_0, 2, 1),

	BPF_EXIT_INSN(),

	BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 1),

	BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 1),

	BPF_JMP_IMM(BPF_JLT, BPF_REG_0, 2, 1),

	BPF_EXIT_INSN(),

	BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 1),

	BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 1),

	BPF_JMP_IMM(BPF_JLT, BPF_REG_0, 2, -11),

	BPF_EXIT_INSN(),

	},

	.result = REJECT,

	.errstr = "loop detected",

	.prog_type = BPF_PROG_TYPE_TRACEPOINT,

},