On Mon, May 18, 2020 at 1:06 PM John Fastabend <john.fastabend@xxxxxxxxx> wrote:
>
> When we have pointer type that is known to be non-null we only follow
> the non-null branch. This adds tests to cover this case for reference
> tracking.
>
> Signed-off-by: John Fastabend <john.fastabend@xxxxxxxxx>
> ---
> .../testing/selftests/bpf/verifier/ref_tracking.c | 16 ++++++++++++++++
> 1 file changed, 16 insertions(+)
>
> diff --git a/tools/testing/selftests/bpf/verifier/ref_tracking.c b/tools/testing/selftests/bpf/verifier/ref_tracking.c
> index 604b461..d8f7c04 100644
> --- a/tools/testing/selftests/bpf/verifier/ref_tracking.c
> +++ b/tools/testing/selftests/bpf/verifier/ref_tracking.c
> @@ -821,3 +821,19 @@
> .result = REJECT,
> .errstr = "invalid mem access",
> },
> +{
> + "reference tracking: branch tracking valid pointer null comparison",
> + .insns = {
> + BPF_SK_LOOKUP(sk_lookup_tcp),
> + BPF_MOV64_REG(BPF_REG_6, BPF_REG_0),
> + BPF_MOV64_IMM(BPF_REG_3, 1),
> + BPF_JMP_IMM(BPF_JNE, BPF_REG_6, 0, 1),
> + BPF_MOV64_IMM(BPF_REG_3, 0),
> + BPF_JMP_IMM(BPF_JEQ, BPF_REG_6, 0, 2),
> + BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
> + BPF_EMIT_CALL(BPF_FUNC_sk_release),
> + BPF_EXIT_INSN(),
> + },
> + .prog_type = BPF_PROG_TYPE_SCHED_CLS,
> + .result = ACCEPT,
> +},
Can you please add another test where you test against non-zero value
to verify that both branches are considered to be taken and verifier
actually complaints that sk_release happens only in one of branches.
>
