Commit 5c19e1d0 authored by Andrii Nakryiko's avatar Andrii Nakryiko Committed by Alexei Starovoitov
Browse files

selftests/bpf: adjust global_func15 test to validate prog exit precision 



Add one more subtest to  global_func15 selftest to validate that
verifier properly marks r0 as precise and avoids erroneous state pruning
of the branch that has return value outside of expected [0, 1] value.

Acked-by: default avatarEduard Zingerman <eddyz87@gmail.com>
Signed-off-by: default avatarAndrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/r/20231202175705.885270-11-andrii@kernel.org


Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
parent e02dea15

tools/testing/selftests/bpf/progs/test_global_func15.c

+32 −0
Original line number Diff line number Diff line
@@ -22,3 +22,35 @@ int global_func15(struct __sk_buff *skb) 


	return v;

}



SEC("cgroup_skb/ingress")

__log_level(2) __flag(BPF_F_TEST_STATE_FREQ)

__failure

/* check that fallthrough code path marks r0 as precise */

__msg("mark_precise: frame0: regs=r0 stack= before 2: (b7) r0 = 1")

/* check that branch code path marks r0 as precise */

__msg("mark_precise: frame0: regs=r0 stack= before 0: (85) call bpf_get_prandom_u32#7")

__msg("At program exit the register R0 has ")

__naked int global_func15_tricky_pruning(void)

{

	asm volatile (

		"call %[bpf_get_prandom_u32];"

		"if r0 s> 1000 goto 1f;"

		"r0 = 1;"

	"1:"

		"goto +0;" /* checkpoint */

		/* cgroup_skb/ingress program is expected to return [0, 1]

		 * values, so branch above makes sure that in a fallthrough

		 * case we have a valid 1 stored in R0 register, but in

		 * a branch case we assign some random value to R0.  So if

		 * there is something wrong with precision tracking for R0 at

		 * program exit, we might erronenously prune branch case,

		 * because R0 in fallthrough case is imprecise (and thus any

		 * value is valid from POV of verifier is_state_equal() logic)

		 */

		"exit;"

		:

		: __imm(bpf_get_prandom_u32)

		: __clobber_common

	);

}