From mboxrd@z Thu Jan 1 00:00:00 1970 From: Alexei Starovoitov Subject: [PATCH bpf-next 2/2] selftests/bpf: additional stack depth tests Date: Fri, 22 Dec 2017 13:33:28 -0800 Message-ID: <20171222213328.993019-3-ast@kernel.org> References: <20171222213328.993019-1-ast@kernel.org> Mime-Version: 1.0 Content-Type: text/plain Cc: Daniel Borkmann , Jann Horn , , To: "David S . Miller" Return-path: Received: from mx0a-00082601.pphosted.com ([67.231.145.42]:52356 "EHLO mx0a-00082601.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1756764AbdLVVdb (ORCPT ); Fri, 22 Dec 2017 16:33:31 -0500 Received: from pps.filterd (m0044012.ppops.net [127.0.0.1]) by mx0a-00082601.pphosted.com (8.16.0.21/8.16.0.21) with SMTP id vBMLVmZY020059 for ; Fri, 22 Dec 2017 13:33:30 -0800 Received: from mail.thefacebook.com ([199.201.64.23]) by mx0a-00082601.pphosted.com with ESMTP id 2f17uj8d4x-3 (version=TLSv1 cipher=ECDHE-RSA-AES256-SHA bits=256 verify=NOT) for ; Fri, 22 Dec 2017 13:33:30 -0800 In-Reply-To: <20171222213328.993019-1-ast@kernel.org> Sender: netdev-owner@vger.kernel.org List-ID: to test inner logic of stack depth tracking Signed-off-by: Alexei Starovoitov --- tools/testing/selftests/bpf/test_verifier.c | 50 +++++++++++++++++++++++++++++ 1 file changed, 50 insertions(+) diff --git a/tools/testing/selftests/bpf/test_verifier.c b/tools/testing/selftests/bpf/test_verifier.c index 71fb0be81b78..e0b21c95c3bc 100644 --- a/tools/testing/selftests/bpf/test_verifier.c +++ b/tools/testing/selftests/bpf/test_verifier.c @@ -8764,6 +8764,56 @@ static struct bpf_test tests[] = { .result = REJECT, }, { + "calls: stack depth check using three frames. test1", + .insns = { + /* main */ + BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 4), /* call A */ + BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 5), /* call B */ + BPF_ST_MEM(BPF_B, BPF_REG_10, -32, 0), + BPF_MOV64_IMM(BPF_REG_0, 0), + BPF_EXIT_INSN(), + /* A */ + BPF_ST_MEM(BPF_B, BPF_REG_10, -256, 0), + BPF_EXIT_INSN(), + /* B */ + BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, -3), /* call A */ + BPF_ST_MEM(BPF_B, BPF_REG_10, -64, 0), + BPF_EXIT_INSN(), + }, + .prog_type = BPF_PROG_TYPE_XDP, + /* though stack_main=32, stack_A=256, stack_B=64 + * and max(main+A, main+A+B) < 512 the program is rejected + * since stack tracking is conservative + * frame[0]=32, frame[1]=256, frame[2]=256 + */ + .errstr = "combined stack size", + .result = REJECT, + }, + { + "calls: stack depth check using three frames. test2", + .insns = { + /* main */ + BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 4), /* call A */ + BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 5), /* call B */ + BPF_ST_MEM(BPF_B, BPF_REG_10, -32, 0), + BPF_MOV64_IMM(BPF_REG_0, 0), + BPF_EXIT_INSN(), + /* A */ + BPF_ST_MEM(BPF_B, BPF_REG_10, -64, 0), + BPF_EXIT_INSN(), + /* B */ + BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, -3), /* call A */ + BPF_ST_MEM(BPF_B, BPF_REG_10, -256, 0), + BPF_EXIT_INSN(), + }, + .prog_type = BPF_PROG_TYPE_XDP, + /* though stack_main=32, stack_A=64, stack_B=256 + * and max(main+A, main+A+B) < 512 the program is accepted + * since frame[0]=32, frame[1]=256, frame[2]=64 + */ + .result = ACCEPT, + }, + { "calls: spill into caller stack frame", .insns = { BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0), -- 2.9.5