mirrors/linux
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-01-21 14:03:24 -05:00
Code Issues Packages Projects Releases Wiki Activity

selftests/bpf: adjust global_func15 test to validate prog exit precision

Browse Source 
Add one more subtest to  global_func15 selftest to validate that
verifier properly marks r0 as precise and avoids erroneous state pruning
of the branch that has return value outside of expected [0, 1] value.

Acked-by: Eduard Zingerman <eddyz87@gmail.com>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/r/20231202175705.885270-11-andrii@kernel.org
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
This commit is contained in:
Andrii Nakryiko
2023-12-02 09:57:04 -08:00
committed by Alexei Starovoitov
parent e02dea158d
commit 5c19e1d05e
1 changed files with 32 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

32
tools/testing/selftests/bpf/progs/test_global_func15.c
View File

@@ -22,3 +22,35 @@ int global_func15(struct __sk_buff *skb)
return v;
}
SEC("cgroup_skb/ingress")
__log_level(2) __flag(BPF_F_TEST_STATE_FREQ)
__failure
/* check that fallthrough code path marks r0 as precise */
__msg("mark_precise: frame0: regs=r0 stack= before 2: (b7) r0 = 1")
/* check that branch code path marks r0 as precise */
__msg("mark_precise: frame0: regs=r0 stack= before 0: (85) call bpf_get_prandom_u32#7")
__msg("At program exit the register R0 has ")
__naked int global_func15_tricky_pruning(void)
{
asm volatile (
"call %[bpf_get_prandom_u32];"
"if r0 s> 1000 goto 1f;"
"r0 = 1;"
"1:"
"goto +0;" /* checkpoint */
/* cgroup_skb/ingress program is expected to return [0, 1]
* values, so branch above makes sure that in a fallthrough
* case we have a valid 1 stored in R0 register, but in
* a branch case we assign some random value to R0. So if
* there is something wrong with precision tracking for R0 at
* program exit, we might erronenously prune branch case,
* because R0 in fallthrough case is imprecise (and thus any
* value is valid from POV of verifier is_state_equal() logic)
*/
"exit;"
:
: __imm(bpf_get_prandom_u32)
: __clobber_common
);
}