Hangbin Liu wrote:
> On Wed, Jan 27, 2021 at 02:24:47PM -0800, John Fastabend wrote:
> > [...]
> >
> > > +{
> > > + "ARG_CONST_MAP_PTR_OR_NULL: null pointer for ex_map",
> > > + .insns = {
> > > + BPF_MOV64_IMM(BPF_REG_1, 0),
> > > + /* bpf_redirect_map_multi arg1 (in_map) */
> > > + BPF_LD_MAP_FD(BPF_REG_1, 0),
> > > + /* bpf_redirect_map_multi arg2 (ex_map) */
> > > + BPF_MOV64_IMM(BPF_REG_2, 0),
> > > + /* bpf_redirect_map_multi arg3 (flags) */
> > > + BPF_MOV64_IMM(BPF_REG_3, 0),
> > > + BPF_EMIT_CALL(BPF_FUNC_redirect_map_multi),
> > > + BPF_EXIT_INSN(),
> > > + },
> > > + .fixup_map_devmap = { 1 },
> > > + .result = ACCEPT,
> > > + .prog_type = BPF_PROG_TYPE_XDP,
> > > + .retval = 4,
> >
> > Do we need one more case where this is map_or_null? In above
> > ex_map will be scalar tnum_const=0 and be exactly a null. This
> > will push verifier here,
> >
> > meta->map_ptr = register_is_null(reg) ? NULL : reg->map_ptr;
> >
> > In the below case it is known to be not null.
> >
> > Is it also interesting to have a case where register_is_null(reg)
> > check fails and reg->map_ptr is set, but may be null.
>
> Hi John,
>
> I'm not familiar with the test_verifier syntax. Doesn't
> BPF_LD_MAP_FD(BPF_REG_1, 0) just assign the register with map NULL?
On second thought because we are only running the verifier here and
not actually calling the helper I guess both paths are in fact
covered here.
Acked-by: John Fastabend <john.fastabend@xxxxxxxxx>
