Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 14507e35 authored by Jakub Kicinski's avatar Jakub Kicinski Committed by Daniel Borkmann
Browse files

selftests: bpf: verifier: add tests for JSET interpretation 



Validate that the verifier reasons correctly about the bounds
and removes dead code based on results of JSET instruction.

Signed-off-by: default avatarJakub Kicinski <jakub.kicinski@netronome.com>
Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
parent 960ea056

tools/testing/selftests/bpf/test_verifier.c

+96 −0
Original line number Diff line number Diff line
@@ -14265,6 +14265,102 @@ static struct bpf_test tests[] = { 
		.retval = 2,

		.data = { 1, 0, 0, 0, 0, 0, 0, 1, },

	},

	{

		"jset: known const compare",

		.insns = {

			BPF_MOV64_IMM(BPF_REG_0, 1),

			BPF_JMP_IMM(BPF_JSET, BPF_REG_0, 1, 1),

			BPF_LDX_MEM(BPF_B, BPF_REG_8, BPF_REG_9, 0),

			BPF_EXIT_INSN(),

		},

		.prog_type = BPF_PROG_TYPE_SOCKET_FILTER,

		.retval_unpriv = 1,

		.result_unpriv = ACCEPT,

		.retval = 1,

		.result = ACCEPT,

	},

	{

		"jset: known const compare bad",

		.insns = {

			BPF_MOV64_IMM(BPF_REG_0, 0),

			BPF_JMP_IMM(BPF_JSET, BPF_REG_0, 1, 1),

			BPF_LDX_MEM(BPF_B, BPF_REG_8, BPF_REG_9, 0),

			BPF_EXIT_INSN(),

		},

		.prog_type = BPF_PROG_TYPE_SOCKET_FILTER,

		.errstr_unpriv = "!read_ok",

		.result_unpriv = REJECT,

		.errstr = "!read_ok",

		.result = REJECT,

	},

	{

		"jset: unknown const compare taken",

		.insns = {

			BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,

				     BPF_FUNC_get_prandom_u32),

			BPF_JMP_IMM(BPF_JSET, BPF_REG_0, 1, 1),

			BPF_JMP_IMM(BPF_JA, 0, 0, 1),

			BPF_LDX_MEM(BPF_B, BPF_REG_8, BPF_REG_9, 0),

			BPF_EXIT_INSN(),

		},

		.prog_type = BPF_PROG_TYPE_SOCKET_FILTER,

		.errstr_unpriv = "!read_ok",

		.result_unpriv = REJECT,

		.errstr = "!read_ok",

		.result = REJECT,

	},

	{

		"jset: unknown const compare not taken",

		.insns = {

			BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,

				     BPF_FUNC_get_prandom_u32),

			BPF_JMP_IMM(BPF_JSET, BPF_REG_0, 1, 1),

			BPF_LDX_MEM(BPF_B, BPF_REG_8, BPF_REG_9, 0),

			BPF_EXIT_INSN(),

		},

		.prog_type = BPF_PROG_TYPE_SOCKET_FILTER,

		.errstr_unpriv = "!read_ok",

		.result_unpriv = REJECT,

		.errstr = "!read_ok",

		.result = REJECT,

	},

	{

		"jset: half-known const compare",

		.insns = {

			BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,

				     BPF_FUNC_get_prandom_u32),

			BPF_ALU64_IMM(BPF_OR, BPF_REG_0, 2),

			BPF_JMP_IMM(BPF_JSET, BPF_REG_0, 3, 1),

			BPF_LDX_MEM(BPF_B, BPF_REG_8, BPF_REG_9, 0),

			BPF_MOV64_IMM(BPF_REG_0, 0),

			BPF_EXIT_INSN(),

		},

		.prog_type = BPF_PROG_TYPE_SOCKET_FILTER,

		.result_unpriv = ACCEPT,

		.result = ACCEPT,

	},

	{

		"jset: range",

		.insns = {

			BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,

				     BPF_FUNC_get_prandom_u32),

			BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),

			BPF_MOV64_IMM(BPF_REG_0, 0),

			BPF_ALU64_IMM(BPF_AND, BPF_REG_1, 0xff),

			BPF_JMP_IMM(BPF_JSET, BPF_REG_1, 0xf0, 3),

			BPF_JMP_IMM(BPF_JLT, BPF_REG_1, 0x10, 1),

			BPF_LDX_MEM(BPF_B, BPF_REG_8, BPF_REG_9, 0),

			BPF_EXIT_INSN(),

			BPF_JMP_IMM(BPF_JSET, BPF_REG_1, 0x10, 1),

			BPF_EXIT_INSN(),

			BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0x10, 1),

			BPF_LDX_MEM(BPF_B, BPF_REG_8, BPF_REG_9, 0),

			BPF_EXIT_INSN(),

		},

		.prog_type = BPF_PROG_TYPE_SOCKET_FILTER,

		.result_unpriv = ACCEPT,

		.result = ACCEPT,

	},

};



static int probe_filter_length(const struct bpf_insn *fp)