Re: [PATCH bpf-next 2/9] selftests/bpf: fix tests due to const spill/fill

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Thu, Jun 13, 2019 at 9:50 AM Alexei Starovoitov <ast@xxxxxxxxxx> wrote:
>
> fix tests that incorrectly assumed that the verifier
> cannot track constants through stack.
>
> Signed-off-by: Alexei Starovoitov <ast@xxxxxxxxxx>
> ---

Acked-by: Andrii Nakryiko <andriin@xxxxxx>


>  .../bpf/verifier/direct_packet_access.c       |  3 +-
>  .../bpf/verifier/helper_access_var_len.c      | 28 ++++++++++---------
>  2 files changed, 17 insertions(+), 14 deletions(-)
>
> diff --git a/tools/testing/selftests/bpf/verifier/direct_packet_access.c b/tools/testing/selftests/bpf/verifier/direct_packet_access.c
> index d5c596fdc4b9..2c5fbe7bcd27 100644
> --- a/tools/testing/selftests/bpf/verifier/direct_packet_access.c
> +++ b/tools/testing/selftests/bpf/verifier/direct_packet_access.c
> @@ -511,7 +511,8 @@
>                     offsetof(struct __sk_buff, data)),
>         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
>                     offsetof(struct __sk_buff, data_end)),
> -       BPF_MOV64_IMM(BPF_REG_0, 0xffffffff),
> +       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
> +                   offsetof(struct __sk_buff, mark)),
>         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
>         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -8),
>         BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 0xffff),
> diff --git a/tools/testing/selftests/bpf/verifier/helper_access_var_len.c b/tools/testing/selftests/bpf/verifier/helper_access_var_len.c
> index 1f39d845c64f..67ab12410050 100644
> --- a/tools/testing/selftests/bpf/verifier/helper_access_var_len.c
> +++ b/tools/testing/selftests/bpf/verifier/helper_access_var_len.c
> @@ -29,9 +29,9 @@
>  {
>         "helper access to variable memory: stack, bitwise AND, zero included",
>         .insns = {
> +       BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, 8),
>         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
>         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
> -       BPF_MOV64_IMM(BPF_REG_2, 16),
>         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
>         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
>         BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 64),
> @@ -46,9 +46,9 @@
>  {
>         "helper access to variable memory: stack, bitwise AND + JMP, wrong max",
>         .insns = {
> +       BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, 8),
>         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
>         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
> -       BPF_MOV64_IMM(BPF_REG_2, 16),
>         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
>         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
>         BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 65),
> @@ -122,9 +122,9 @@
>  {
>         "helper access to variable memory: stack, JMP, bounds + offset",
>         .insns = {
> +       BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, 8),
>         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
>         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
> -       BPF_MOV64_IMM(BPF_REG_2, 16),
>         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
>         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
>         BPF_JMP_IMM(BPF_JGT, BPF_REG_2, 64, 5),
> @@ -143,9 +143,9 @@
>  {
>         "helper access to variable memory: stack, JMP, wrong max",
>         .insns = {
> +       BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, 8),
>         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
>         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
> -       BPF_MOV64_IMM(BPF_REG_2, 16),
>         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
>         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
>         BPF_JMP_IMM(BPF_JGT, BPF_REG_2, 65, 4),
> @@ -163,9 +163,9 @@
>  {
>         "helper access to variable memory: stack, JMP, no max check",
>         .insns = {
> +       BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, 8),
>         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
>         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
> -       BPF_MOV64_IMM(BPF_REG_2, 16),
>         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
>         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
>         BPF_MOV64_IMM(BPF_REG_4, 0),
> @@ -183,9 +183,9 @@
>  {
>         "helper access to variable memory: stack, JMP, no min check",
>         .insns = {
> +       BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, 8),
>         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
>         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
> -       BPF_MOV64_IMM(BPF_REG_2, 16),
>         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
>         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
>         BPF_JMP_IMM(BPF_JGT, BPF_REG_2, 64, 3),
> @@ -201,9 +201,9 @@
>  {
>         "helper access to variable memory: stack, JMP (signed), no min check",
>         .insns = {
> +       BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, 8),
>         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
>         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
> -       BPF_MOV64_IMM(BPF_REG_2, 16),
>         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
>         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
>         BPF_JMP_IMM(BPF_JSGT, BPF_REG_2, 64, 3),
> @@ -244,6 +244,7 @@
>  {
>         "helper access to variable memory: map, JMP, wrong max",
>         .insns = {
> +       BPF_LDX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 8),
>         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
>         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
>         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
> @@ -251,7 +252,7 @@
>         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
>         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 10),
>         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
> -       BPF_MOV64_IMM(BPF_REG_2, sizeof(struct test_val)),
> +       BPF_MOV64_REG(BPF_REG_2, BPF_REG_6),
>         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -128),
>         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, -128),
>         BPF_JMP_IMM(BPF_JSGT, BPF_REG_2, sizeof(struct test_val) + 1, 4),
> @@ -262,7 +263,7 @@
>         BPF_MOV64_IMM(BPF_REG_0, 0),
>         BPF_EXIT_INSN(),
>         },
> -       .fixup_map_hash_48b = { 3 },
> +       .fixup_map_hash_48b = { 4 },
>         .errstr = "invalid access to map value, value_size=48 off=0 size=49",
>         .result = REJECT,
>         .prog_type = BPF_PROG_TYPE_TRACEPOINT,
> @@ -296,6 +297,7 @@
>  {
>         "helper access to variable memory: map adjusted, JMP, wrong max",
>         .insns = {
> +       BPF_LDX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 8),
>         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
>         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
>         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
> @@ -304,7 +306,7 @@
>         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 11),
>         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
>         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 20),
> -       BPF_MOV64_IMM(BPF_REG_2, sizeof(struct test_val)),
> +       BPF_MOV64_REG(BPF_REG_2, BPF_REG_6),
>         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -128),
>         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, -128),
>         BPF_JMP_IMM(BPF_JSGT, BPF_REG_2, sizeof(struct test_val) - 19, 4),
> @@ -315,7 +317,7 @@
>         BPF_MOV64_IMM(BPF_REG_0, 0),
>         BPF_EXIT_INSN(),
>         },
> -       .fixup_map_hash_48b = { 3 },
> +       .fixup_map_hash_48b = { 4 },
>         .errstr = "R1 min value is outside of the array range",
>         .result = REJECT,
>         .prog_type = BPF_PROG_TYPE_TRACEPOINT,
> @@ -337,8 +339,8 @@
>  {
>         "helper access to variable memory: size > 0 not allowed on NULL (ARG_PTR_TO_MEM_OR_NULL)",
>         .insns = {
> +       BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 0),
>         BPF_MOV64_IMM(BPF_REG_1, 0),
> -       BPF_MOV64_IMM(BPF_REG_2, 1),
>         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -128),
>         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, -128),
>         BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 64),
> @@ -562,6 +564,7 @@
>  {
>         "helper access to variable memory: 8 bytes leak",
>         .insns = {
> +       BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, 8),
>         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
>         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
>         BPF_MOV64_IMM(BPF_REG_0, 0),
> @@ -572,7 +575,6 @@
>         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -24),
>         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -16),
>         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
> -       BPF_MOV64_IMM(BPF_REG_2, 1),
>         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -128),
>         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, -128),
>         BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 63),
> --
> 2.20.0
>



[Index of Archives]     [Linux Samsung SoC]     [Linux Rockchip SoC]     [Linux Actions SoC]     [Linux for Synopsys ARC Processors]     [Linux NFS]     [Linux NILFS]     [Linux USB Devel]     [Video for Linux]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]


  Powered by Linux