Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit fc559a70 authored by Alexei Starovoitov's avatar Alexei Starovoitov Committed by Daniel Borkmann
Browse files

selftests/bpf: fix tests due to const spill/fill 



fix tests that incorrectly assumed that the verifier
cannot track constants through stack.

Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
Acked-by: default avatarAndrii Nakryiko <andriin@fb.com>
Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
parent f7cf25b2

tools/testing/selftests/bpf/verifier/direct_packet_access.c

+2 −1
Original line number Diff line number Diff line
@@ -511,7 +511,8 @@ 
		    offsetof(struct __sk_buff, data)),

	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,

		    offsetof(struct __sk_buff, data_end)),

	BPF_MOV64_IMM(BPF_REG_0, 0xffffffff),

	BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,

		    offsetof(struct __sk_buff, mark)),

	BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),

	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -8),

	BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 0xffff),

tools/testing/selftests/bpf/verifier/helper_access_var_len.c

+15 −13
Original line number Diff line number Diff line
@@ -29,9 +29,9 @@ 
{

	"helper access to variable memory: stack, bitwise AND, zero included",

	.insns = {

	BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, 8),

	BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),

	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),

	BPF_MOV64_IMM(BPF_REG_2, 16),

	BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),

	BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),

	BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 64),
@@ -46,9 +46,9 @@ 
{

	"helper access to variable memory: stack, bitwise AND + JMP, wrong max",

	.insns = {

	BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, 8),

	BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),

	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),

	BPF_MOV64_IMM(BPF_REG_2, 16),

	BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),

	BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),

	BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 65),
@@ -122,9 +122,9 @@ 
{

	"helper access to variable memory: stack, JMP, bounds + offset",

	.insns = {

	BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, 8),

	BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),

	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),

	BPF_MOV64_IMM(BPF_REG_2, 16),

	BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),

	BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),

	BPF_JMP_IMM(BPF_JGT, BPF_REG_2, 64, 5),
@@ -143,9 +143,9 @@ 
{

	"helper access to variable memory: stack, JMP, wrong max",

	.insns = {

	BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, 8),

	BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),

	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),

	BPF_MOV64_IMM(BPF_REG_2, 16),

	BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),

	BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),

	BPF_JMP_IMM(BPF_JGT, BPF_REG_2, 65, 4),
@@ -163,9 +163,9 @@ 
{

	"helper access to variable memory: stack, JMP, no max check",

	.insns = {

	BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, 8),

	BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),

	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),

	BPF_MOV64_IMM(BPF_REG_2, 16),

	BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),

	BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),

	BPF_MOV64_IMM(BPF_REG_4, 0),
@@ -183,9 +183,9 @@ 
{

	"helper access to variable memory: stack, JMP, no min check",

	.insns = {

	BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, 8),

	BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),

	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),

	BPF_MOV64_IMM(BPF_REG_2, 16),

	BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),

	BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),

	BPF_JMP_IMM(BPF_JGT, BPF_REG_2, 64, 3),
@@ -201,9 +201,9 @@ 
{

	"helper access to variable memory: stack, JMP (signed), no min check",

	.insns = {

	BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, 8),

	BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),

	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),

	BPF_MOV64_IMM(BPF_REG_2, 16),

	BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),

	BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),

	BPF_JMP_IMM(BPF_JSGT, BPF_REG_2, 64, 3),
@@ -244,6 +244,7 @@ 
{

	"helper access to variable memory: map, JMP, wrong max",

	.insns = {

	BPF_LDX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 8),

	BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),

	BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),

	BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
@@ -251,7 +252,7 @@ 
	BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),

	BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 10),

	BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),

	BPF_MOV64_IMM(BPF_REG_2, sizeof(struct test_val)),

	BPF_MOV64_REG(BPF_REG_2, BPF_REG_6),

	BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -128),

	BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, -128),

	BPF_JMP_IMM(BPF_JSGT, BPF_REG_2, sizeof(struct test_val) + 1, 4),
@@ -262,7 +263,7 @@ 
	BPF_MOV64_IMM(BPF_REG_0, 0),

	BPF_EXIT_INSN(),

	},

	.fixup_map_hash_48b = { 3 },

	.fixup_map_hash_48b = { 4 },

	.errstr = "invalid access to map value, value_size=48 off=0 size=49",

	.result = REJECT,

	.prog_type = BPF_PROG_TYPE_TRACEPOINT,
@@ -296,6 +297,7 @@ 
{

	"helper access to variable memory: map adjusted, JMP, wrong max",

	.insns = {

	BPF_LDX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 8),

	BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),

	BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),

	BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
@@ -304,7 +306,7 @@ 
	BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 11),

	BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),

	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 20),

	BPF_MOV64_IMM(BPF_REG_2, sizeof(struct test_val)),

	BPF_MOV64_REG(BPF_REG_2, BPF_REG_6),

	BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -128),

	BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, -128),

	BPF_JMP_IMM(BPF_JSGT, BPF_REG_2, sizeof(struct test_val) - 19, 4),
@@ -315,7 +317,7 @@ 
	BPF_MOV64_IMM(BPF_REG_0, 0),

	BPF_EXIT_INSN(),

	},

	.fixup_map_hash_48b = { 3 },

	.fixup_map_hash_48b = { 4 },

	.errstr = "R1 min value is outside of the array range",

	.result = REJECT,

	.prog_type = BPF_PROG_TYPE_TRACEPOINT,
@@ -337,8 +339,8 @@ 
{

	"helper access to variable memory: size > 0 not allowed on NULL (ARG_PTR_TO_MEM_OR_NULL)",

	.insns = {

	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 0),

	BPF_MOV64_IMM(BPF_REG_1, 0),

	BPF_MOV64_IMM(BPF_REG_2, 1),

	BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -128),

	BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, -128),

	BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 64),
@@ -562,6 +564,7 @@ 
{

	"helper access to variable memory: 8 bytes leak",

	.insns = {

	BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, 8),

	BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),

	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),

	BPF_MOV64_IMM(BPF_REG_0, 0),
@@ -572,7 +575,6 @@ 
	BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -24),

	BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -16),

	BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),

	BPF_MOV64_IMM(BPF_REG_2, 1),

	BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -128),

	BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, -128),

	BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 63),