iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
linux/tools/testing/selftests/bpf/verifier/loops1.c

207 lines
4.9 KiB
C
Raw Normal View History

selftests/bpf: add basic verifier tests for loops This set of tests is a rewrite of Edward's earlier tests: https://patchwork.ozlabs.org/patch/877221/ Signed-off-by: Alexei Starovoitov <ast@kernel.org> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
2019-06-15 12:12:23 -07:00
{
"bounded loop, count to 4",
.insns = {
BPF_MOV64_IMM(BPF_REG_0, 0),
BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 1),
BPF_JMP_IMM(BPF_JLT, BPF_REG_0, 4, -2),
BPF_EXIT_INSN(),
},
.result = ACCEPT,
.prog_type = BPF_PROG_TYPE_TRACEPOINT,
.retval = 4,
},
{
"bounded loop, count to 20",
.insns = {
BPF_MOV64_IMM(BPF_REG_0, 0),
BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 3),
BPF_JMP_IMM(BPF_JLT, BPF_REG_0, 20, -2),
BPF_EXIT_INSN(),
},
.result = ACCEPT,
.prog_type = BPF_PROG_TYPE_TRACEPOINT,
},
{
"bounded loop, count from positive unknown to 4",
.insns = {
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_get_prandom_u32),
BPF_JMP_IMM(BPF_JSLT, BPF_REG_0, 0, 2),
BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 1),
BPF_JMP_IMM(BPF_JLT, BPF_REG_0, 4, -2),
BPF_EXIT_INSN(),
},
.result = ACCEPT,
.prog_type = BPF_PROG_TYPE_TRACEPOINT,
.retval = 4,
},
{
"bounded loop, count from totally unknown to 4",
.insns = {
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_get_prandom_u32),
BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 1),
BPF_JMP_IMM(BPF_JLT, BPF_REG_0, 4, -2),
BPF_EXIT_INSN(),
},
.result = ACCEPT,
.prog_type = BPF_PROG_TYPE_TRACEPOINT,
},
{
"bounded loop, count to 4 with equality",
.insns = {
BPF_MOV64_IMM(BPF_REG_0, 0),
BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 1),
BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 4, -2),
BPF_EXIT_INSN(),
},
.result = ACCEPT,
.prog_type = BPF_PROG_TYPE_TRACEPOINT,
},
{
"bounded loop, start in the middle",
.insns = {
BPF_MOV64_IMM(BPF_REG_0, 0),
BPF_JMP_A(1),
BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 1),
BPF_JMP_IMM(BPF_JLT, BPF_REG_0, 4, -2),
BPF_EXIT_INSN(),
},
.result = REJECT,
.errstr = "back-edge",
.prog_type = BPF_PROG_TYPE_TRACEPOINT,
.retval = 4,
},
{
"bounded loop containing a forward jump",
.insns = {
BPF_MOV64_IMM(BPF_REG_0, 0),
BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 1),
BPF_JMP_REG(BPF_JEQ, BPF_REG_0, BPF_REG_0, 0),
BPF_JMP_IMM(BPF_JLT, BPF_REG_0, 4, -3),
BPF_EXIT_INSN(),
},
.result = ACCEPT,
.prog_type = BPF_PROG_TYPE_TRACEPOINT,
.retval = 4,
},
{
"bounded loop that jumps out rather than in",
.insns = {
BPF_MOV64_IMM(BPF_REG_6, 0),
BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
BPF_JMP_IMM(BPF_JGT, BPF_REG_6, 10000, 2),
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_get_prandom_u32),
BPF_JMP_A(-4),
BPF_EXIT_INSN(),
},
.result = ACCEPT,
.prog_type = BPF_PROG_TYPE_TRACEPOINT,
},
{
"infinite loop after a conditional jump",
.insns = {
BPF_MOV64_IMM(BPF_REG_0, 5),
BPF_JMP_IMM(BPF_JLT, BPF_REG_0, 4, 2),
BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 1),
BPF_JMP_A(-2),
BPF_EXIT_INSN(),
},
.result = REJECT,
.errstr = "program is too large",
.prog_type = BPF_PROG_TYPE_TRACEPOINT,
},
{
"bounded recursion",
.insns = {
BPF_MOV64_IMM(BPF_REG_1, 0),
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
BPF_EXIT_INSN(),
BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 1),
BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
BPF_JMP_IMM(BPF_JLT, BPF_REG_1, 4, 1),
BPF_EXIT_INSN(),
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, -5),
BPF_EXIT_INSN(),
},
.result = REJECT,
.errstr = "back-edge",
.prog_type = BPF_PROG_TYPE_TRACEPOINT,
},
{
"infinite loop in two jumps",
.insns = {
BPF_MOV64_IMM(BPF_REG_0, 0),
BPF_JMP_A(0),
BPF_JMP_IMM(BPF_JLT, BPF_REG_0, 4, -2),
BPF_EXIT_INSN(),
},
.result = REJECT,
.errstr = "loop detected",
.prog_type = BPF_PROG_TYPE_TRACEPOINT,
},
{
"infinite loop: three-jump trick",
.insns = {
BPF_MOV64_IMM(BPF_REG_0, 0),
BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 1),
BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 1),
BPF_JMP_IMM(BPF_JLT, BPF_REG_0, 2, 1),
BPF_EXIT_INSN(),
BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 1),
BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 1),
BPF_JMP_IMM(BPF_JLT, BPF_REG_0, 2, 1),
BPF_EXIT_INSN(),
BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 1),
BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 1),
BPF_JMP_IMM(BPF_JLT, BPF_REG_0, 2, -11),
BPF_EXIT_INSN(),
},
.result = REJECT,
.errstr = "loop detected",
.prog_type = BPF_PROG_TYPE_TRACEPOINT,
},
selftests/bpf: tests for jmp to 1st insn Add 2 tests that check JIT code generation to jumps to 1st insn. 1st test is similar to syzbot reproducer. The backwards branch is never taken at runtime. 2nd test has branch to 1st insn that executes. The test is written as two bpf functions, since it's not possible to construct valid single bpf program that jumps to 1st insn. Signed-off-by: Alexei Starovoitov <ast@kernel.org> Acked-by: Song Liu <songliubraving@fb.com>
2019-07-30 18:38:27 -07:00
{
"not-taken loop with back jump to 1st insn",
.insns = {
BPF_MOV64_IMM(BPF_REG_0, 123),
BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 4, -2),
BPF_EXIT_INSN(),
},
.result = ACCEPT,
.prog_type = BPF_PROG_TYPE_XDP,
.retval = 123,
},
{
"taken loop with back jump to 1st insn",
.insns = {
BPF_MOV64_IMM(BPF_REG_1, 10),
BPF_MOV64_IMM(BPF_REG_2, 0),
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
BPF_EXIT_INSN(),
BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_1),
BPF_ALU64_IMM(BPF_SUB, BPF_REG_1, 1),
BPF_JMP_IMM(BPF_JNE, BPF_REG_1, 0, -3),
BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
BPF_EXIT_INSN(),
},
.result = ACCEPT,
.prog_type = BPF_PROG_TYPE_XDP,
.retval = 55,
},
bpf: Add loop test case with 32 bit reg comparison against 0 Add a loop test with 32 bit register against 0 immediate: # ./test_verifier 631 #631/p taken loop with back jump to 1st insn, 2 OK Disassembly: [...] 1b: test %edi,%edi 1d: jne 0x0000000000000014 [...] Pretty much similar to prior "taken loop with back jump to 1st insn" test case just as jmp32 variant. Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Acked-by: Song Liu <songliubraving@fb.com>
2019-10-03 01:45:12 +02:00
{
"taken loop with back jump to 1st insn, 2",
.insns = {
BPF_MOV64_IMM(BPF_REG_1, 10),
BPF_MOV64_IMM(BPF_REG_2, 0),
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
BPF_EXIT_INSN(),
BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_1),
BPF_ALU64_IMM(BPF_SUB, BPF_REG_1, 1),
BPF_JMP32_IMM(BPF_JNE, BPF_REG_1, 0, -3),
BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
BPF_EXIT_INSN(),
},
.result = ACCEPT,
.prog_type = BPF_PROG_TYPE_XDP,
.retval = 55,
},
Reference in New Issue Copy Permalink