Commit 72187506 authored by Andrei Matei's avatar Andrei Matei Committed by Andrii Nakryiko
Browse files

bpf: Add a possibly-zero-sized read test 



This patch adds a test for the condition that the previous patch mucked
with - illegal zero-sized helper memory access. As opposed to existing
tests, this new one uses a size whose lower bound is zero, as opposed to
a known-zero one.

Signed-off-by: default avatarAndrei Matei <andreimatei1@gmail.com>
Signed-off-by: default avatarAndrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/bpf/20231221232225.568730-3-andreimatei1@gmail.com
parent 8a021e7f

tools/testing/selftests/bpf/progs/verifier_helper_value_access.c

+38 −1
Original line number Diff line number Diff line
@@ -89,9 +89,14 @@ l0_%=: exit; \ 
	: __clobber_all);

}



/* Call a function taking a pointer and a size which doesn't allow the size to

 * be zero (i.e. bpf_trace_printk() declares the second argument to be

 * ARG_CONST_SIZE, not ARG_CONST_SIZE_OR_ZERO). We attempt to pass zero for the

 * size and expect to fail.

 */

SEC("tracepoint")

__description("helper access to map: empty range")

__failure __msg("R2 invalid zero-sized read")

__failure __msg("R2 invalid zero-sized read: u64=[0,0]")

__naked void access_to_map_empty_range(void)

{

	asm volatile ("					\
@@ -113,6 +118,38 @@ l0_%=: exit; \ 
	: __clobber_all);

}



/* Like the test above, but this time the size register is not known to be zero;

 * its lower-bound is zero though, which is still unacceptable.

 */

SEC("tracepoint")

__description("helper access to map: possibly-empty ange")

__failure __msg("R2 invalid zero-sized read: u64=[0,4]")

__naked void access_to_map_possibly_empty_range(void)

{

	asm volatile ("                                         \

	r2 = r10;                                               \

	r2 += -8;                                               \

	r1 = 0;                                                 \

	*(u64*)(r2 + 0) = r1;                                   \

	r1 = %[map_hash_48b] ll;                                \

	call %[bpf_map_lookup_elem];                            \

	if r0 == 0 goto l0_%=;                                  \

	r1 = r0;                                                \

	/* Read an unknown value */                             \

	r7 = *(u64*)(r0 + 0);                                   \

	/* Make it small and positive, to avoid other errors */ \

	r7 &= 4;                                                \

	r2 = 0;                                                 \

	r2 += r7;                                               \

	call %[bpf_trace_printk];                               \

l0_%=:	exit;                                               \

"	:

	: __imm(bpf_map_lookup_elem),

	  __imm(bpf_trace_printk),

	  __imm_addr(map_hash_48b)

	: __clobber_all);

}



SEC("tracepoint")

__description("helper access to map: out-of-bound range")

__failure __msg("invalid access to map value, value_size=48 off=0 size=56")