Commit b712296a authored by Edward Cree's avatar Edward Cree Committed by David S. Miller
Browse files

bpf: add test for mixed signed and unsigned bounds checks 



These failed due to a bug in verifier bounds handling.

Signed-off-by: default avatarEdward Cree <ecree@solarflare.com>
Acked-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
Acked-by: default avatarAlexei Starovoitov <ast@kernel.org>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent a1502132

tools/testing/selftests/bpf/test_verifier.c

+52 −0
Original line number Diff line number Diff line
@@ -5510,6 +5510,58 @@ static struct bpf_test tests[] = { 
		.errstr = "invalid bpf_context access",

		.prog_type = BPF_PROG_TYPE_LWT_IN,

	},

	{

		"bounds checks mixing signed and unsigned, positive bounds",

		.insns = {

			BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),

			BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),

			BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),

			BPF_LD_MAP_FD(BPF_REG_1, 0),

			BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,

				     BPF_FUNC_map_lookup_elem),

			BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),

			BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),

			BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),

			BPF_MOV64_IMM(BPF_REG_2, 2),

			BPF_JMP_REG(BPF_JGE, BPF_REG_2, BPF_REG_1, 3),

			BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 4, 2),

			BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),

			BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),

			BPF_MOV64_IMM(BPF_REG_0, 0),

			BPF_EXIT_INSN(),

		},

		.fixup_map1 = { 3 },

		.errstr_unpriv = "R0 pointer arithmetic prohibited",

		.errstr = "R0 min value is negative",

		.result = REJECT,

		.result_unpriv = REJECT,

	},

	{

		"bounds checks mixing signed and unsigned",

		.insns = {

			BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),

			BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),

			BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),

			BPF_LD_MAP_FD(BPF_REG_1, 0),

			BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,

				     BPF_FUNC_map_lookup_elem),

			BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),

			BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),

			BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),

			BPF_MOV64_IMM(BPF_REG_2, -1),

			BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_2, 3),

			BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),

			BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),

			BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),

			BPF_MOV64_IMM(BPF_REG_0, 0),

			BPF_EXIT_INSN(),

		},

		.fixup_map1 = { 3 },

		.errstr_unpriv = "R0 pointer arithmetic prohibited",

		.errstr = "R0 min value is negative",

		.result = REJECT,

		.result_unpriv = REJECT,

	},

};



static int probe_filter_length(const struct bpf_insn *fp)