Commit 475244f5 authored by Youlin Li's avatar Youlin Li Committed by Daniel Borkmann
Browse files

selftests/bpf: Add verifier test for release_reference() 



Add a test case to ensure that released pointer registers will not be
leaked into the map.

Before fix:

  ./test_verifier 984
    984/u reference tracking: try to leak released ptr reg FAIL
    Unexpected success to load!
    verification time 67 usec
    stack depth 4
    processed 23 insns (limit 1000000) max_states_per_insn 0 total_states 2
    peak_states 2 mark_read 1
    984/p reference tracking: try to leak released ptr reg OK
    Summary: 1 PASSED, 0 SKIPPED, 1 FAILED

After fix:

  ./test_verifier 984
    984/u reference tracking: try to leak released ptr reg OK
    984/p reference tracking: try to leak released ptr reg OK
    Summary: 2 PASSED, 0 SKIPPED, 0 FAILED

Signed-off-by: default avatarYoulin Li <liulin063@gmail.com>
Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/bpf/20221103093440.3161-2-liulin063@gmail.com
parent f1db2081

tools/testing/selftests/bpf/verifier/ref_tracking.c

+36 −0
Original line number Diff line number Diff line
@@ -1044,3 +1044,39 @@ 
	.result_unpriv = REJECT,

	.errstr_unpriv = "unknown func",

},

{

	"reference tracking: try to leak released ptr reg",

	.insns = {

		BPF_MOV64_IMM(BPF_REG_0, 0),

		BPF_STX_MEM(BPF_W, BPF_REG_10, BPF_REG_0, -4),

		BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),

		BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4),

		BPF_LD_MAP_FD(BPF_REG_1, 0),

		BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),

		BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),

		BPF_EXIT_INSN(),

		BPF_MOV64_REG(BPF_REG_9, BPF_REG_0),



		BPF_MOV64_IMM(BPF_REG_0, 0),

		BPF_LD_MAP_FD(BPF_REG_1, 0),

		BPF_MOV64_IMM(BPF_REG_2, 8),

		BPF_MOV64_IMM(BPF_REG_3, 0),

		BPF_EMIT_CALL(BPF_FUNC_ringbuf_reserve),

		BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),

		BPF_EXIT_INSN(),

		BPF_MOV64_REG(BPF_REG_8, BPF_REG_0),



		BPF_MOV64_REG(BPF_REG_1, BPF_REG_8),

		BPF_MOV64_IMM(BPF_REG_2, 0),

		BPF_EMIT_CALL(BPF_FUNC_ringbuf_discard),

		BPF_MOV64_IMM(BPF_REG_0, 0),



		BPF_STX_MEM(BPF_DW, BPF_REG_9, BPF_REG_8, 0),

		BPF_EXIT_INSN()

	},

	.fixup_map_array_48b = { 4 },

	.fixup_map_ringbuf = { 11 },

	.result = ACCEPT,

	.result_unpriv = REJECT,

	.errstr_unpriv = "R8 !read_ok"

},