adjust two tests, since verifier got smarter and add new one to test stack_zero logic
Unified · Split
| @@ -5649,7 +5649,7 @@ static struct bpf_test tests[] = { · 5648 unmodified lines | |||
| 5649 | "helper access to variable memory: size > 0 not allowed on NULL (ARG_PTR_TO_MEM_OR_NULL)", | 5649 | "helper access to variable memory: size > 0 not allowed on NULL (ARG_PTR_TO_MEM_OR_NULL)", |
| 5650 | .insns = { | 5650 | .insns = { |
| 5651 | BPF_MOV64_IMM(BPF_REG_1, 0), | 5651 | BPF_MOV64_IMM(BPF_REG_1, 0), |
| 5652 | BPF_MOV64_IMM(BPF_REG_2, 0), | 5652 | BPF_MOV64_IMM(BPF_REG_2, 1), |
| 5653 | BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -128), | 5653 | BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -128), |
| 5654 | BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, -128), | 5654 | BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, -128), |
| 5655 | BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 64), | 5655 | BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 64), |
| @@ -5884,7 +5884,7 @@ static struct bpf_test tests[] = { · 228 unmodified lines | |||
| 5884 | BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -24), | 5884 | BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -24), |
| 5885 | BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -16), | 5885 | BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -16), |
| 5886 | BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8), | 5886 | BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8), |
| 5887 | BPF_MOV64_IMM(BPF_REG_2, 0), | 5887 | BPF_MOV64_IMM(BPF_REG_2, 1), |
| 5888 | BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -128), | 5888 | BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -128), |
| 5889 | BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, -128), | 5889 | BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, -128), |
| 5890 | BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 63), | 5890 | BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 63), |
| @@ -9056,6 +9056,68 @@ static struct bpf_test tests[] = { · 3165 unmodified lines | |||
| 9056 | .result = ACCEPT, | 9056 | .result = ACCEPT, |
| 9057 | .prog_type = BPF_PROG_TYPE_SCHED_CLS, | 9057 | .prog_type = BPF_PROG_TYPE_SCHED_CLS, |
| 9058 | }, | 9058 | }, |
| 9059 | { | ||
| 9060 | "calls: caller stack init to zero or map_value_or_null", | ||
| 9061 | .insns = { | ||
| 9062 | BPF_MOV64_IMM(BPF_REG_0, 0), | ||
| 9063 | BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8), | ||
| 9064 | BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), | ||
| 9065 | BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8), | ||
| 9066 | BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 4), | ||
| 9067 | /* fetch map_value_or_null or const_zero from stack */ | ||
| 9068 | BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -8), | ||
| 9069 | BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1), | ||
| 9070 | /* store into map_value */ | ||
| 9071 | BPF_ST_MEM(BPF_W, BPF_REG_0, 0, 0), | ||
| 9072 | BPF_EXIT_INSN(), | ||
| 9073 | |||
| 9074 | /* subprog 1 */ | ||
| 9075 | /* if (ctx == 0) return; */ | ||
| 9076 | BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 8), | ||
| 9077 | /* else bpf_map_lookup() and *(fp - 8) = r0 */ | ||
| 9078 | BPF_MOV64_REG(BPF_REG_6, BPF_REG_2), | ||
| 9079 | BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), | ||
| 9080 | BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8), | ||
| 9081 | BPF_LD_MAP_FD(BPF_REG_1, 0), | ||
| 9082 | BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0), | ||
| 9083 | BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, | ||
| 9084 | BPF_FUNC_map_lookup_elem), | ||
| 9085 | /* write map_value_ptr_or_null into stack frame of main prog at fp-8 */ | ||
| 9086 | BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_0, 0), | ||
| 9087 | BPF_EXIT_INSN(), | ||
| 9088 | }, | ||
| 9089 | .fixup_map1 = { 13 }, | ||
| 9090 | .result = ACCEPT, | ||
| 9091 | .prog_type = BPF_PROG_TYPE_XDP, | ||
| 9092 | }, | ||
| 9093 | { | ||
| 9094 | "calls: stack init to zero and pruning", | ||
| 9095 | .insns = { | ||
| 9096 | /* first make allocated_stack 16 byte */ | ||
| 9097 | BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, 0), | ||
| 9098 | /* now fork the execution such that the false branch | ||
| 9099 | * of JGT insn will be verified second and it skisp zero | ||
| 9100 | * init of fp-8 stack slot. If stack liveness marking | ||
| 9101 | * is missing live_read marks from call map_lookup | ||
| 9102 | * processing then pruning will incorrectly assume | ||
| 9103 | * that fp-8 stack slot was unused in the fall-through | ||
| 9104 | * branch and will accept the program incorrectly | ||
| 9105 | */ | ||
| 9106 | BPF_JMP_IMM(BPF_JGT, BPF_REG_1, 2, 2), | ||
| 9107 | BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0), | ||
| 9108 | BPF_JMP_IMM(BPF_JA, 0, 0, 0), | ||
| 9109 | BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), | ||
| 9110 | BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8), | ||
| 9111 | BPF_LD_MAP_FD(BPF_REG_1, 0), | ||
| 9112 | BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, | ||
| 9113 | BPF_FUNC_map_lookup_elem), | ||
| 9114 | BPF_EXIT_INSN(), | ||
| 9115 | }, | ||
| 9116 | .fixup_map2 = { 6 }, | ||
| 9117 | .errstr = "invalid indirect read from stack off -8+0 size 8", | ||
| 9118 | .result = REJECT, | ||
| 9119 | .prog_type = BPF_PROG_TYPE_XDP, | ||
| 9120 | }, | ||
| 9059 | }; | 9121 | }; |
| 9060 | 9122 | ||
| 9061 | static int probe_filter_length(const struct bpf_insn *fp) | 9123 | static int probe_filter_length(const struct bpf_insn *fp) |