Commit 1fb31589 authored by Eduard Zingerman's avatar Eduard Zingerman Committed by Andrii Nakryiko
Browse files

selftests/bpf: Test with a very short loop 

The test added is a simplified reproducer from syzbot report [1].
If verifier does not insert checkpoint somewhere inside the loop,
verification of the program would take a very long time.

This would happen because mark_chain_precision() for register r7 would
constantly trace jump history of the loop back, processing many
iterations for each mark_chain_precision() call.

[1] https://lore.kernel.org/bpf/670429f6.050a0220.49194.0517.GAE@google.com/



Signed-off-by: default avatarEduard Zingerman <eddyz87@gmail.com>
Signed-off-by: default avatarAndrii Nakryiko <andrii@kernel.org>
Acked-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/bpf/20241029172641.1042523-2-eddyz87@gmail.com
parent aa30eb32

tools/testing/selftests/bpf/progs/verifier_search_pruning.c

+23 −0
Original line number Diff line number Diff line
@@ -2,6 +2,7 @@ 
/* Converted from tools/testing/selftests/bpf/verifier/search_pruning.c */



#include <linux/bpf.h>

#include <../../../include/linux/filter.h>

#include <bpf/bpf_helpers.h>

#include "bpf_misc.h"
@@ -336,4 +337,26 @@ l0_%=: r1 = 42; \ 
	: __clobber_all);

}



/* Without checkpoint forcibly inserted at the back-edge a loop this

 * test would take a very long time to verify.

 */

SEC("kprobe")

__failure __log_level(4)

__msg("BPF program is too large.")

__naked void short_loop1(void)

{

	asm volatile (

	"   r7 = *(u16 *)(r1 +0);"

	"1: r7 += 0x1ab064b9;"

	"   .8byte %[jset];" /* same as 'if r7 & 0x702000 goto 1b;' */

	"   r7 &= 0x1ee60e;"

	"   r7 += r1;"

	"   if r7 s> 0x37d2 goto +0;"

	"   r0 = 0;"

	"   exit;"

	:

	: __imm_insn(jset, BPF_JMP_IMM(BPF_JSET, BPF_REG_7, 0x702000, -2))

	: __clobber_all);

}



char _license[] SEC("license") = "GPL";

tools/testing/selftests/bpf/veristat.cfg

+1 −0
Original line number Diff line number Diff line
@@ -15,3 +15,4 @@ test_usdt* 
test_verif_scale*

test_xdp_noinline*

xdp_synproxy*

verifier_search_pruning*