diff options
| author | Alexei Starovoitov <ast@kernel.org> | 2024-05-06 17:09:12 -0700 |
|---|---|---|
| committer | Alexei Starovoitov <ast@kernel.org> | 2024-05-06 17:09:20 -0700 |
| commit | 329a6720a3ebbc041983b267981ab2cac102de93 (patch) | |
| tree | d5c433c0d9cf68d1e208cc06512d49f00d9e3a33 /tools/testing | |
| parent | 41b307ad756e1b7b618bf9d9c1cce3595705ede4 (diff) | |
| parent | 92956786b4e26ea22e5b3c1c86cc71f5c9b3b9d8 (diff) | |
Merge branch 'bpf-verifier-range-computation-improvements'
Cupertino Miranda says:
====================
bpf/verifier: range computation improvements
Hi everyone,
This is what I hope to be the last version. :)
Regards,
Cupertino
Changes from v1:
- Reordered patches in the series.
- Fix refactor to be acurate with original code.
- Fixed other mentioned small problems.
Changes from v2:
- Added a patch to replace mark_reg_unknowon for __mark_reg_unknown in
the context of range computation.
- Reverted implementation of refactor to v1 which used a simpler
boolean return value in check function.
- Further relaxed MUL to allow it to still compute a range when neither
of its registers is a known value.
- Simplified tests based on Eduards example.
- Added messages in selftest commits.
Changes from v3:
- Improved commit message of patch nr 1.
- Coding style fixes.
- Improve XOR and OR tests.
- Made function calls to pass struct bpf_reg_state pointer instead.
- Improved final code as a last patch.
Changes from v4:
- Merged patch nr 7 in 2.
====================
Link: https://lore.kernel.org/r/20240506141849.185293-1-cupertino.miranda@oracle.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Diffstat (limited to 'tools/testing')
| -rw-r--r-- | tools/testing/selftests/bpf/progs/verifier_bounds.c | 63 |
1 files changed, 63 insertions, 0 deletions
diff --git a/tools/testing/selftests/bpf/progs/verifier_bounds.c b/tools/testing/selftests/bpf/progs/verifier_bounds.c index 960998f16306..a0bb7fb40ea5 100644 --- a/tools/testing/selftests/bpf/progs/verifier_bounds.c +++ b/tools/testing/selftests/bpf/progs/verifier_bounds.c @@ -886,6 +886,69 @@ l1_%=: r0 = 0; \ } SEC("socket") +__description("bounds check for non const xor src dst") +__success __log_level(2) +__msg("5: (af) r0 ^= r6 ; R0_w=scalar(smin=smin32=0,smax=umax=smax32=umax32=431,var_off=(0x0; 0x1af))") +__naked void non_const_xor_src_dst(void) +{ + asm volatile (" \ + call %[bpf_get_prandom_u32]; \ + r6 = r0; \ + call %[bpf_get_prandom_u32]; \ + r6 &= 0xaf; \ + r0 &= 0x1a0; \ + r0 ^= r6; \ + exit; \ +" : + : __imm(bpf_map_lookup_elem), + __imm_addr(map_hash_8b), + __imm(bpf_get_prandom_u32) + : __clobber_all); +} + +SEC("socket") +__description("bounds check for non const or src dst") +__success __log_level(2) +__msg("5: (4f) r0 |= r6 ; R0_w=scalar(smin=smin32=0,smax=umax=smax32=umax32=431,var_off=(0x0; 0x1af))") +__naked void non_const_or_src_dst(void) +{ + asm volatile (" \ + call %[bpf_get_prandom_u32]; \ + r6 = r0; \ + call %[bpf_get_prandom_u32]; \ + r6 &= 0xaf; \ + r0 &= 0x1a0; \ + r0 |= r6; \ + exit; \ +" : + : __imm(bpf_map_lookup_elem), + __imm_addr(map_hash_8b), + __imm(bpf_get_prandom_u32) + : __clobber_all); +} + +SEC("socket") +__description("bounds check for non const mul regs") +__success __log_level(2) +__msg("5: (2f) r0 *= r6 ; R0_w=scalar(smin=smin32=0,smax=umax=smax32=umax32=3825,var_off=(0x0; 0xfff))") +__naked void non_const_mul_regs(void) +{ + asm volatile (" \ + call %[bpf_get_prandom_u32]; \ + r6 = r0; \ + call %[bpf_get_prandom_u32]; \ + r6 &= 0xff; \ + r0 &= 0x0f; \ + r0 *= r6; \ + exit; \ +" : + : __imm(bpf_map_lookup_elem), + __imm_addr(map_hash_8b), + __imm(bpf_get_prandom_u32) + : __clobber_all); +} + +SEC("socket") __description("bounds checks after 32-bit truncation. test 1") __success __failure_unpriv __msg_unpriv("R0 leaks addr") __retval(0) |