Commit e2e57d63 authored by Andrii Nakryiko's avatar Andrii Nakryiko Committed by Alexei Starovoitov
Browse files

selftests/bpf: add more test cases for check_cfg() 



Add a few more simple cases to validate proper privileged vs unprivileged
loop detection behavior. conditional_loop2 is the one reported by Hao
Sun that triggered this set of fixes.

Acked-by: default avatarEduard Zingerman <eddyz87@gmail.com>
Suggested-by: default avatarHao Sun <sunhao.th@gmail.com>
Signed-off-by: default avatarAndrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/r/20231110061412.2995786-2-andrii@kernel.org


Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
parent 10e14e96

tools/testing/selftests/bpf/progs/verifier_cfg.c

+62 −0
Original line number Diff line number Diff line
@@ -97,4 +97,66 @@ l0_%=: r2 = r0; \ 
"	::: __clobber_all);

}



SEC("socket")

__description("conditional loop (2)")

__success

__failure_unpriv __msg_unpriv("back-edge from insn 10 to 11")

__naked void conditional_loop2(void)

{

	asm volatile ("					\

	r9 = 2 ll;					\

	r3 = 0x20 ll;					\

	r4 = 0x35 ll;					\

	r8 = r4;					\

	goto l1_%=;					\

l0_%=:	r9 -= r3;					\

	r9 -= r4;					\

	r9 -= r8;					\

l1_%=:	r8 += r4;					\

	if r8 < 0x64 goto l0_%=;			\

	r0 = r9;					\

	exit;						\

"	::: __clobber_all);

}



SEC("socket")

__description("unconditional loop after conditional jump")

__failure __msg("infinite loop detected")

__failure_unpriv __msg_unpriv("back-edge from insn 3 to 2")

__naked void uncond_loop_after_cond_jmp(void)

{

	asm volatile ("					\

	r0 = 0;						\

	if r0 > 0 goto l1_%=;				\

l0_%=:	r0 = 1;						\

	goto l0_%=;					\

l1_%=:	exit;						\

"	::: __clobber_all);

}





__naked __noinline __used

static unsigned long never_ending_subprog()

{

	asm volatile ("					\

	r0 = r1;					\

	goto -1;					\

"	::: __clobber_all);

}



SEC("socket")

__description("unconditional loop after conditional jump")

/* infinite loop is detected *after* check_cfg() */

__failure __msg("infinite loop detected")

__naked void uncond_loop_in_subprog_after_cond_jmp(void)

{

	asm volatile ("					\

	r0 = 0;						\

	if r0 > 0 goto l1_%=;				\

l0_%=:	r0 += 1;					\

	call never_ending_subprog;			\

l1_%=:	exit;						\

"	::: __clobber_all);

}



char _license[] SEC("license") = "GPL";