This is a note to let you know that I've just added the patch titled
selftests/bpf: check if max number of bpf_loop iterations is tracked
to the 6.6-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
selftests-bpf-check-if-max-number-of-bpf_loop-iterations-is-tracked.patch
and it can be found in the queue-6.6 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From 57e2a52deeb12ab84c15c6d0fb93638b5b94001b Mon Sep 17 00:00:00 2001
From: Eduard Zingerman <eddyz87@xxxxxxxxx>
Date: Tue, 21 Nov 2023 04:07:01 +0200
Subject: selftests/bpf: check if max number of bpf_loop iterations is tracked
From: Eduard Zingerman <eddyz87@xxxxxxxxx>
commit 57e2a52deeb12ab84c15c6d0fb93638b5b94001b upstream.
Check that even if bpf_loop() callback simulation does not converge to
a specific state, verification could proceed via "brute force"
simulation of maximal number of callback calls.
Signed-off-by: Eduard Zingerman <eddyz87@xxxxxxxxx>
Link: https://lore.kernel.org/r/20231121020701.26440-12-eddyz87@xxxxxxxxx
Signed-off-by: Alexei Starovoitov <ast@xxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
tools/testing/selftests/bpf/progs/verifier_iterating_callbacks.c | 75 ++++++++++
1 file changed, 75 insertions(+)
--- a/tools/testing/selftests/bpf/progs/verifier_iterating_callbacks.c
+++ b/tools/testing/selftests/bpf/progs/verifier_iterating_callbacks.c
@@ -164,4 +164,79 @@ int unsafe_find_vma(void *unused)
return choice_arr[loop_ctx.i];
}
+static int iter_limit_cb(__u32 idx, struct num_context *ctx)
+{
+ ctx->i++;
+ return 0;
+}
+
+SEC("?raw_tp")
+__success
+int bpf_loop_iter_limit_ok(void *unused)
+{
+ struct num_context ctx = { .i = 0 };
+
+ bpf_loop(1, iter_limit_cb, &ctx, 0);
+ return choice_arr[ctx.i];
+}
+
+SEC("?raw_tp")
+__failure __msg("invalid access to map value, value_size=2 off=2 size=1")
+int bpf_loop_iter_limit_overflow(void *unused)
+{
+ struct num_context ctx = { .i = 0 };
+
+ bpf_loop(2, iter_limit_cb, &ctx, 0);
+ return choice_arr[ctx.i];
+}
+
+static int iter_limit_level2a_cb(__u32 idx, struct num_context *ctx)
+{
+ ctx->i += 100;
+ return 0;
+}
+
+static int iter_limit_level2b_cb(__u32 idx, struct num_context *ctx)
+{
+ ctx->i += 10;
+ return 0;
+}
+
+static int iter_limit_level1_cb(__u32 idx, struct num_context *ctx)
+{
+ ctx->i += 1;
+ bpf_loop(1, iter_limit_level2a_cb, ctx, 0);
+ bpf_loop(1, iter_limit_level2b_cb, ctx, 0);
+ return 0;
+}
+
+/* Check that path visiting every callback function once had been
+ * reached by verifier. Variables 'ctx{1,2}i' below serve as flags,
+ * with each decimal digit corresponding to a callback visit marker.
+ */
+SEC("socket")
+__success __retval(111111)
+int bpf_loop_iter_limit_nested(void *unused)
+{
+ struct num_context ctx1 = { .i = 0 };
+ struct num_context ctx2 = { .i = 0 };
+ __u64 a, b, c;
+
+ bpf_loop(1, iter_limit_level1_cb, &ctx1, 0);
+ bpf_loop(1, iter_limit_level1_cb, &ctx2, 0);
+ a = ctx1.i;
+ b = ctx2.i;
+ /* Force 'ctx1.i' and 'ctx2.i' precise. */
+ c = choice_arr[(a + b) % 2];
+ /* This makes 'c' zero, but neither clang nor verifier know it. */
+ c /= 10;
+ /* Make sure that verifier does not visit 'impossible' states:
+ * enumerate all possible callback visit masks.
+ */
+ if (a != 0 && a != 1 && a != 11 && a != 101 && a != 111 &&
+ b != 0 && b != 1 && b != 11 && b != 101 && b != 111)
+ asm volatile ("r0 /= 0;" ::: "r0");
+ return 1000 * a + b + c;
+}
+
char _license[] SEC("license") = "GPL";
Patches currently in stable-queue which might be from eddyz87@xxxxxxxxx are
queue-6.6/bpf-move-explored_state-closer-to-the-beginning-of-verifier.c.patch
queue-6.6/bpf-verify-callbacks-as-if-they-are-called-unknown-number-of-times.patch
queue-6.6/selftests-bpf-test-widening-for-iterating-callbacks.patch
queue-6.6/bpf-keep-track-of-max-number-of-bpf_loop-callback-iterations.patch
queue-6.6/bpf-extract-setup_func_entry-utility-function.patch
queue-6.6/selftests-bpf-tests-with-delayed-read-precision-makrs-in-loop-body.patch
queue-6.6/selftests-bpf-track-string-payload-offset-as-scalar-in-strobemeta.patch
queue-6.6/bpf-print-full-verifier-states-on-infinite-loop-detection.patch
queue-6.6/selftests-bpf-track-tcp-payload-offset-as-scalar-in-xdp_synproxy.patch
queue-6.6/bpf-extract-__check_reg_arg-utility-function.patch
queue-6.6/bpf-extract-same_callsites-as-utility-function.patch
queue-6.6/bpf-widening-for-callback-iterators.patch
queue-6.6/selftests-bpf-test-if-state-loops-are-detected-in-a-tricky-case.patch
queue-6.6/bpf-correct-loop-detection-for-iterators-convergence.patch
queue-6.6/selftests-bpf-tests-for-iterating-callbacks.patch
queue-6.6/bpf-exact-states-comparison-for-iterator-convergence-checks.patch
queue-6.6/selftests-bpf-check-if-max-number-of-bpf_loop-iterations-is-tracked.patch
