Commit 57e2a52d authored by Eduard Zingerman's avatar Eduard Zingerman Committed by Alexei Starovoitov
Browse files

selftests/bpf: check if max number of bpf_loop iterations is tracked 



Check that even if bpf_loop() callback simulation does not converge to
a specific state, verification could proceed via "brute force"
simulation of maximal number of callback calls.

Signed-off-by: default avatarEduard Zingerman <eddyz87@gmail.com>
Link: https://lore.kernel.org/r/20231121020701.26440-12-eddyz87@gmail.com


Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
parent bb124da6

tools/testing/selftests/bpf/progs/verifier_iterating_callbacks.c

+75 −0
Original line number Diff line number Diff line
@@ -164,4 +164,79 @@ int unsafe_find_vma(void *unused) 
	return choice_arr[loop_ctx.i];

}



static int iter_limit_cb(__u32 idx, struct num_context *ctx)

{

	ctx->i++;

	return 0;

}



SEC("?raw_tp")

__success

int bpf_loop_iter_limit_ok(void *unused)

{

	struct num_context ctx = { .i = 0 };



	bpf_loop(1, iter_limit_cb, &ctx, 0);

	return choice_arr[ctx.i];

}



SEC("?raw_tp")

__failure __msg("invalid access to map value, value_size=2 off=2 size=1")

int bpf_loop_iter_limit_overflow(void *unused)

{

	struct num_context ctx = { .i = 0 };



	bpf_loop(2, iter_limit_cb, &ctx, 0);

	return choice_arr[ctx.i];

}



static int iter_limit_level2a_cb(__u32 idx, struct num_context *ctx)

{

	ctx->i += 100;

	return 0;

}



static int iter_limit_level2b_cb(__u32 idx, struct num_context *ctx)

{

	ctx->i += 10;

	return 0;

}



static int iter_limit_level1_cb(__u32 idx, struct num_context *ctx)

{

	ctx->i += 1;

	bpf_loop(1, iter_limit_level2a_cb, ctx, 0);

	bpf_loop(1, iter_limit_level2b_cb, ctx, 0);

	return 0;

}



/* Check that path visiting every callback function once had been

 * reached by verifier. Variables 'ctx{1,2}i' below serve as flags,

 * with each decimal digit corresponding to a callback visit marker.

 */

SEC("socket")

__success __retval(111111)

int bpf_loop_iter_limit_nested(void *unused)

{

	struct num_context ctx1 = { .i = 0 };

	struct num_context ctx2 = { .i = 0 };

	__u64 a, b, c;



	bpf_loop(1, iter_limit_level1_cb, &ctx1, 0);

	bpf_loop(1, iter_limit_level1_cb, &ctx2, 0);

	a = ctx1.i;

	b = ctx2.i;

	/* Force 'ctx1.i' and 'ctx2.i' precise. */

	c = choice_arr[(a + b) % 2];

	/* This makes 'c' zero, but neither clang nor verifier know it. */

	c /= 10;

	/* Make sure that verifier does not visit 'impossible' states:

	 * enumerate all possible callback visit masks.

	 */

	if (a != 0 && a != 1 && a != 11 && a != 101 && a != 111 &&

	    b != 0 && b != 1 && b != 11 && b != 101 && b != 111)

		asm volatile ("r0 /= 0;" ::: "r0");

	return 1000 * a + b + c;

}



char _license[] SEC("license") = "GPL";