From: Andrii Nakryiko <andrii@kernel.org>
To: <bpf@vger.kernel.org>, <ast@kernel.org>, <daniel@iogearbox.net>,
<martin.lau@kernel.org>
Cc: <andrii@kernel.org>, <kernel-team@meta.com>,
Eduard Zingerman <eddyz87@gmail.com>
Subject: [PATCH v3 bpf-next 09/10] selftests/bpf: adjust global_func15 test to validate prog exit precision
Date: Wed, 29 Nov 2023 16:04:05 -0800 [thread overview]
Message-ID: <20231130000406.480870-10-andrii@kernel.org> (raw)
In-Reply-To: <20231130000406.480870-1-andrii@kernel.org>
Add one more subtest to global_func15 selftest to validate that
verifier properly marks r0 as precise and avoids erroneous state pruning
of the branch that has return value outside of expected [0, 1] value.
Acked-by: Eduard Zingerman <eddyz87@gmail.com>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
---
.../selftests/bpf/progs/test_global_func15.c | 32 +++++++++++++++++++
1 file changed, 32 insertions(+)
diff --git a/tools/testing/selftests/bpf/progs/test_global_func15.c b/tools/testing/selftests/bpf/progs/test_global_func15.c
index f80207480e8a..b4e089d6981d 100644
--- a/tools/testing/selftests/bpf/progs/test_global_func15.c
+++ b/tools/testing/selftests/bpf/progs/test_global_func15.c
@@ -22,3 +22,35 @@ int global_func15(struct __sk_buff *skb)
return v;
}
+
+SEC("cgroup_skb/ingress")
+__log_level(2) __flag(BPF_F_TEST_STATE_FREQ)
+__failure
+/* check that fallthrough code path marks r0 as precise */
+__msg("mark_precise: frame0: regs=r0 stack= before 2: (b7) r0 = 1")
+/* check that branch code path marks r0 as precise */
+__msg("mark_precise: frame0: regs=r0 stack= before 0: (85) call bpf_get_prandom_u32#7")
+__msg("At program exit the register R0 has ")
+__naked int global_func15_tricky_pruning(void)
+{
+ asm volatile (
+ "call %[bpf_get_prandom_u32];"
+ "if r0 s> 1000 goto 1f;"
+ "r0 = 1;"
+ "1:"
+ "goto +0;" /* checkpoint */
+ /* cgroup_skb/ingress program is expected to return [0, 1]
+ * values, so branch above makes sure that in a fallthrough
+ * case we have a valid 1 stored in R0 register, but in
+ * a branch case we assign some random value to R0. So if
+ * there is something wrong with precision tracking for R0 at
+ * program exit, we might erronenously prune branch case,
+ * because R0 in fallthrough case is imprecise (and thus any
+ * value is valid from POV of verifier is_state_equal() logic)
+ */
+ "exit;"
+ :
+ : __imm(bpf_get_prandom_u32)
+ : __clobber_common
+ );
+}
--
2.34.1
next prev parent reply other threads:[~2023-11-30 0:05 UTC|newest]
Thread overview: 20+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-11-30 0:03 [PATCH v3 bpf-next 00/10] BPF verifier retval logic fixes Andrii Nakryiko
2023-11-30 0:03 ` [PATCH v3 bpf-next 01/10] bpf: provide correct register name for exception callback retval check Andrii Nakryiko
2023-11-30 5:41 ` Shung-Hsi Yu
2023-11-30 0:03 ` [PATCH v3 bpf-next 02/10] bpf: enforce precision of R0 on callback return Andrii Nakryiko
2023-11-30 5:43 ` Shung-Hsi Yu
2023-11-30 0:03 ` [PATCH v3 bpf-next 03/10] bpf: enforce exact retval range on subprog/callback exit Andrii Nakryiko
2023-11-30 5:49 ` Shung-Hsi Yu
2023-11-30 0:04 ` [PATCH v3 bpf-next 04/10] selftests/bpf: add selftest validating callback result is enforced Andrii Nakryiko
2023-11-30 5:52 ` Shung-Hsi Yu
2023-11-30 0:04 ` [PATCH v3 bpf-next 05/10] bpf: enforce precise retval range on program exit Andrii Nakryiko
2023-11-30 5:54 ` Shung-Hsi Yu
2023-11-30 0:04 ` [PATCH v3 bpf-next 06/10] bpf: unify async callback and program retval checks Andrii Nakryiko
2023-11-30 5:56 ` Shung-Hsi Yu
2023-11-30 0:04 ` [PATCH v3 bpf-next 07/10] bpf: enforce precision of R0 on program/async callback return Andrii Nakryiko
2023-11-30 6:33 ` Shung-Hsi Yu
2023-11-30 6:41 ` Andrii Nakryiko
2023-11-30 0:04 ` [PATCH v3 bpf-next 08/10] selftests/bpf: validate async callback return value check correctness Andrii Nakryiko
2023-11-30 0:04 ` Andrii Nakryiko [this message]
2023-11-30 0:04 ` [PATCH v3 bpf-next 10/10] bpf: simplify tnum output if a fully known constant Andrii Nakryiko
2023-11-30 6:34 ` Shung-Hsi Yu
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20231130000406.480870-10-andrii@kernel.org \
--to=andrii@kernel.org \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=eddyz87@gmail.com \
--cc=kernel-team@meta.com \
--cc=martin.lau@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox