Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit df20cb7e authored by Alexei Starovoitov's avatar Alexei Starovoitov Committed by David S. Miller
Browse files

selftests/bpf: add a test for a pruning bug in the verifier 



The test makes a read through a map value pointer, then considers pruning
 a branch where the register holds an adjusted map value pointer.  It
 should not prune, but currently it does.

Signed-off-by: default avatarAlexei Starovoitov <ast@fb.com>
[ecree@solarflare.com: added test-name and patch description]
Signed-off-by: default avatarEdward Cree <ecree@solarflare.com>
Acked-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 63f45f84

tools/testing/selftests/bpf/test_verifier.c

+28 −0
Original line number Diff line number Diff line
@@ -6503,6 +6503,34 @@ static struct bpf_test tests[] = { 
		.result = REJECT,

		.prog_type = BPF_PROG_TYPE_LWT_IN,

	},

	{

		"varlen_map_value_access pruning",

		.insns = {

			BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),

			BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),

			BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),

			BPF_LD_MAP_FD(BPF_REG_1, 0),

			BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,

				     BPF_FUNC_map_lookup_elem),

			BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 8),

			BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, 0),

			BPF_MOV32_IMM(BPF_REG_2, MAX_ENTRIES),

			BPF_JMP_REG(BPF_JSGT, BPF_REG_2, BPF_REG_1, 1),

			BPF_MOV32_IMM(BPF_REG_1, 0),

			BPF_ALU32_IMM(BPF_LSH, BPF_REG_1, 2),

			BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),

			BPF_JMP_IMM(BPF_JA, 0, 0, 0),

			BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,

				   offsetof(struct test_val, foo)),

			BPF_EXIT_INSN(),

		},

		.fixup_map2 = { 3 },

		.errstr_unpriv = "R0 leaks addr",

		.errstr = "R0 unbounded memory access",

		.result_unpriv = REJECT,

		.result = REJECT,

		.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,

	},

};



static int probe_filter_length(const struct bpf_insn *fp)