f1fc7249dd
Add 2 tests that check JIT code generation to jumps to 1st insn. 1st test is similar to syzbot reproducer. The backwards branch is never taken at runtime. 2nd test has branch to 1st insn that executes. The test is written as two bpf functions, since it's not possible to construct valid single bpf program that jumps to 1st insn. Signed-off-by: Alexei Starovoitov <ast@kernel.org> Acked-by: Song Liu <songliubraving@fb.com>
190 lines
4.5 KiB
C
190 lines
4.5 KiB
C
{
|
|
"bounded loop, count to 4",
|
|
.insns = {
|
|
BPF_MOV64_IMM(BPF_REG_0, 0),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 1),
|
|
BPF_JMP_IMM(BPF_JLT, BPF_REG_0, 4, -2),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.result = ACCEPT,
|
|
.prog_type = BPF_PROG_TYPE_TRACEPOINT,
|
|
.retval = 4,
|
|
},
|
|
{
|
|
"bounded loop, count to 20",
|
|
.insns = {
|
|
BPF_MOV64_IMM(BPF_REG_0, 0),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 3),
|
|
BPF_JMP_IMM(BPF_JLT, BPF_REG_0, 20, -2),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.result = ACCEPT,
|
|
.prog_type = BPF_PROG_TYPE_TRACEPOINT,
|
|
},
|
|
{
|
|
"bounded loop, count from positive unknown to 4",
|
|
.insns = {
|
|
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_get_prandom_u32),
|
|
BPF_JMP_IMM(BPF_JSLT, BPF_REG_0, 0, 2),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 1),
|
|
BPF_JMP_IMM(BPF_JLT, BPF_REG_0, 4, -2),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.result = ACCEPT,
|
|
.prog_type = BPF_PROG_TYPE_TRACEPOINT,
|
|
.retval = 4,
|
|
},
|
|
{
|
|
"bounded loop, count from totally unknown to 4",
|
|
.insns = {
|
|
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_get_prandom_u32),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 1),
|
|
BPF_JMP_IMM(BPF_JLT, BPF_REG_0, 4, -2),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.result = ACCEPT,
|
|
.prog_type = BPF_PROG_TYPE_TRACEPOINT,
|
|
},
|
|
{
|
|
"bounded loop, count to 4 with equality",
|
|
.insns = {
|
|
BPF_MOV64_IMM(BPF_REG_0, 0),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 1),
|
|
BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 4, -2),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.result = ACCEPT,
|
|
.prog_type = BPF_PROG_TYPE_TRACEPOINT,
|
|
},
|
|
{
|
|
"bounded loop, start in the middle",
|
|
.insns = {
|
|
BPF_MOV64_IMM(BPF_REG_0, 0),
|
|
BPF_JMP_A(1),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 1),
|
|
BPF_JMP_IMM(BPF_JLT, BPF_REG_0, 4, -2),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.result = REJECT,
|
|
.errstr = "back-edge",
|
|
.prog_type = BPF_PROG_TYPE_TRACEPOINT,
|
|
.retval = 4,
|
|
},
|
|
{
|
|
"bounded loop containing a forward jump",
|
|
.insns = {
|
|
BPF_MOV64_IMM(BPF_REG_0, 0),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 1),
|
|
BPF_JMP_REG(BPF_JEQ, BPF_REG_0, BPF_REG_0, 0),
|
|
BPF_JMP_IMM(BPF_JLT, BPF_REG_0, 4, -3),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.result = ACCEPT,
|
|
.prog_type = BPF_PROG_TYPE_TRACEPOINT,
|
|
.retval = 4,
|
|
},
|
|
{
|
|
"bounded loop that jumps out rather than in",
|
|
.insns = {
|
|
BPF_MOV64_IMM(BPF_REG_6, 0),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
|
|
BPF_JMP_IMM(BPF_JGT, BPF_REG_6, 10000, 2),
|
|
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_get_prandom_u32),
|
|
BPF_JMP_A(-4),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.result = ACCEPT,
|
|
.prog_type = BPF_PROG_TYPE_TRACEPOINT,
|
|
},
|
|
{
|
|
"infinite loop after a conditional jump",
|
|
.insns = {
|
|
BPF_MOV64_IMM(BPF_REG_0, 5),
|
|
BPF_JMP_IMM(BPF_JLT, BPF_REG_0, 4, 2),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 1),
|
|
BPF_JMP_A(-2),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.result = REJECT,
|
|
.errstr = "program is too large",
|
|
.prog_type = BPF_PROG_TYPE_TRACEPOINT,
|
|
},
|
|
{
|
|
"bounded recursion",
|
|
.insns = {
|
|
BPF_MOV64_IMM(BPF_REG_1, 0),
|
|
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
|
|
BPF_EXIT_INSN(),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 1),
|
|
BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
|
|
BPF_JMP_IMM(BPF_JLT, BPF_REG_1, 4, 1),
|
|
BPF_EXIT_INSN(),
|
|
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, -5),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.result = REJECT,
|
|
.errstr = "back-edge",
|
|
.prog_type = BPF_PROG_TYPE_TRACEPOINT,
|
|
},
|
|
{
|
|
"infinite loop in two jumps",
|
|
.insns = {
|
|
BPF_MOV64_IMM(BPF_REG_0, 0),
|
|
BPF_JMP_A(0),
|
|
BPF_JMP_IMM(BPF_JLT, BPF_REG_0, 4, -2),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.result = REJECT,
|
|
.errstr = "loop detected",
|
|
.prog_type = BPF_PROG_TYPE_TRACEPOINT,
|
|
},
|
|
{
|
|
"infinite loop: three-jump trick",
|
|
.insns = {
|
|
BPF_MOV64_IMM(BPF_REG_0, 0),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 1),
|
|
BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 1),
|
|
BPF_JMP_IMM(BPF_JLT, BPF_REG_0, 2, 1),
|
|
BPF_EXIT_INSN(),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 1),
|
|
BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 1),
|
|
BPF_JMP_IMM(BPF_JLT, BPF_REG_0, 2, 1),
|
|
BPF_EXIT_INSN(),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 1),
|
|
BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 1),
|
|
BPF_JMP_IMM(BPF_JLT, BPF_REG_0, 2, -11),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.result = REJECT,
|
|
.errstr = "loop detected",
|
|
.prog_type = BPF_PROG_TYPE_TRACEPOINT,
|
|
},
|
|
{
|
|
"not-taken loop with back jump to 1st insn",
|
|
.insns = {
|
|
BPF_MOV64_IMM(BPF_REG_0, 123),
|
|
BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 4, -2),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.result = ACCEPT,
|
|
.prog_type = BPF_PROG_TYPE_XDP,
|
|
.retval = 123,
|
|
},
|
|
{
|
|
"taken loop with back jump to 1st insn",
|
|
.insns = {
|
|
BPF_MOV64_IMM(BPF_REG_1, 10),
|
|
BPF_MOV64_IMM(BPF_REG_2, 0),
|
|
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
|
|
BPF_EXIT_INSN(),
|
|
BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_1),
|
|
BPF_ALU64_IMM(BPF_SUB, BPF_REG_1, 1),
|
|
BPF_JMP_IMM(BPF_JNE, BPF_REG_1, 0, -3),
|
|
BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.result = ACCEPT,
|
|
.prog_type = BPF_PROG_TYPE_XDP,
|
|
.retval = 55,
|
|
},
|