Commit 20600f3e authored by Alexei Starovoitov's avatar Alexei Starovoitov
Browse files

Merge branch 'split-test_verifier' 



Jakub Kicinski says:

====================
The tools/testing/selftests/bpf/test_verifier.c file is
way too large, and since most people add their at the
end of the list it's very prone to conflicts.

Break it up in the simplest possible way - slice the
array up into smaller C files and include them in the
right spot.

Tested:
$ make -C tools/testing/selftests/bpf/
$ cd tools/testing/selftests/bpf/ ; make

v2:

The indentation is reduced further as discussed and lines folded.
The conversion was scripted, and double checked by hand.
====================

Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
parents ae575c8a 48729226

tools/testing/selftests/bpf/Makefile

+13 −0
Original line number Diff line number Diff line
@@ -212,4 +212,17 @@ ifeq ($(DWARF2BTF),y) 
	$(BTF_PAHOLE) -J $@

endif



$(OUTPUT)/test_verifier: $(OUTPUT)/verifier/tests.h

$(OUTPUT)/test_verifier: CFLAGS += -I$(OUTPUT)



VERIFIER_TEST_FILES := $(wildcard verifier/*.c)

$(OUTPUT)/verifier/tests.h: $(VERIFIER_TEST_FILES)

	$(shell ( cd verifier/

		  echo '/* Generated header, do not edit */'; \

		  echo '#ifdef FILL_ARRAY'; \

		  ls *.c 2> /dev/null | \

			sed -e 's@\(.*\)@#include \"\1\"@'; \

		  echo '#endif' \

		 ) > $(OUTPUT)/verifier/tests.h)



EXTRA_CLEAN := $(TEST_CUSTOM_PROGS) $(ALU32_BUILD_DIR)

tools/testing/selftests/bpf/test_verifier.c

+3 −16285

File changed.

Preview size limit exceeded, changes collapsed.

tools/testing/selftests/bpf/verifier/.gitignore

0 → 100644
+1 −0
Original line number Diff line number Diff line 
tests.h

tools/testing/selftests/bpf/verifier/and.c

0 → 100644
+50 −0
Original line number Diff line number Diff line 
{

	"invalid and of negative number",

	.insns = {

	BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),

	BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),

	BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),

	BPF_LD_MAP_FD(BPF_REG_1, 0),

	BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),

	BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),

	BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),

	BPF_ALU64_IMM(BPF_AND, BPF_REG_1, -4),

	BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 2),

	BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),

	BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, offsetof(struct test_val, foo)),

	BPF_EXIT_INSN(),

	},

	.fixup_map_hash_48b = { 3 },

	.errstr = "R0 max value is outside of the array range",

	.result = REJECT,

	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,

},

{

	"invalid range check",

	.insns = {

	BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),

	BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),

	BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),

	BPF_LD_MAP_FD(BPF_REG_1, 0),

	BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),

	BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 12),

	BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),

	BPF_MOV64_IMM(BPF_REG_9, 1),

	BPF_ALU32_IMM(BPF_MOD, BPF_REG_1, 2),

	BPF_ALU32_IMM(BPF_ADD, BPF_REG_1, 1),

	BPF_ALU32_REG(BPF_AND, BPF_REG_9, BPF_REG_1),

	BPF_ALU32_IMM(BPF_ADD, BPF_REG_9, 1),

	BPF_ALU32_IMM(BPF_RSH, BPF_REG_9, 1),

	BPF_MOV32_IMM(BPF_REG_3, 1),

	BPF_ALU32_REG(BPF_SUB, BPF_REG_3, BPF_REG_9),

	BPF_ALU32_IMM(BPF_MUL, BPF_REG_3, 0x10000000),

	BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_3),

	BPF_STX_MEM(BPF_W, BPF_REG_0, BPF_REG_3, 0),

	BPF_MOV64_REG(BPF_REG_0, 0),

	BPF_EXIT_INSN(),

	},

	.fixup_map_hash_48b = { 3 },

	.errstr = "R0 max value is outside of the array range",

	.result = REJECT,

	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,

},

tools/testing/selftests/bpf/verifier/array_access.c

0 → 100644
+219 −0
Original line number Diff line number Diff line 
{

	"valid map access into an array with a constant",

	.insns = {

	BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),

	BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),

	BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),

	BPF_LD_MAP_FD(BPF_REG_1, 0),

	BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),

	BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),

	BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, offsetof(struct test_val, foo)),

	BPF_EXIT_INSN(),

	},

	.fixup_map_hash_48b = { 3 },

	.errstr_unpriv = "R0 leaks addr",

	.result_unpriv = REJECT,

	.result = ACCEPT,

},

{

	"valid map access into an array with a register",

	.insns = {

	BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),

	BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),

	BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),

	BPF_LD_MAP_FD(BPF_REG_1, 0),

	BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),

	BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),

	BPF_MOV64_IMM(BPF_REG_1, 4),

	BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 2),

	BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),

	BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, offsetof(struct test_val, foo)),

	BPF_EXIT_INSN(),

	},

	.fixup_map_hash_48b = { 3 },

	.errstr_unpriv = "R0 leaks addr",

	.result_unpriv = REJECT,

	.result = ACCEPT,

	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,

},

{

	"valid map access into an array with a variable",

	.insns = {

	BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),

	BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),

	BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),

	BPF_LD_MAP_FD(BPF_REG_1, 0),

	BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),

	BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),

	BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),

	BPF_JMP_IMM(BPF_JGE, BPF_REG_1, MAX_ENTRIES, 3),

	BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 2),

	BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),

	BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, offsetof(struct test_val, foo)),

	BPF_EXIT_INSN(),

	},

	.fixup_map_hash_48b = { 3 },

	.errstr_unpriv = "R0 leaks addr",

	.result_unpriv = REJECT,

	.result = ACCEPT,

	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,

},

{

	"valid map access into an array with a signed variable",

	.insns = {

	BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),

	BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),

	BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),

	BPF_LD_MAP_FD(BPF_REG_1, 0),

	BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),

	BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),

	BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),

	BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 0xffffffff, 1),

	BPF_MOV32_IMM(BPF_REG_1, 0),

	BPF_MOV32_IMM(BPF_REG_2, MAX_ENTRIES),

	BPF_JMP_REG(BPF_JSGT, BPF_REG_2, BPF_REG_1, 1),

	BPF_MOV32_IMM(BPF_REG_1, 0),

	BPF_ALU32_IMM(BPF_LSH, BPF_REG_1, 2),

	BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),

	BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, offsetof(struct test_val, foo)),

	BPF_EXIT_INSN(),

	},

	.fixup_map_hash_48b = { 3 },

	.errstr_unpriv = "R0 leaks addr",

	.result_unpriv = REJECT,

	.result = ACCEPT,

	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,

},

{

	"invalid map access into an array with a constant",

	.insns = {

	BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),

	BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),

	BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),

	BPF_LD_MAP_FD(BPF_REG_1, 0),

	BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),

	BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),

	BPF_ST_MEM(BPF_DW, BPF_REG_0, (MAX_ENTRIES + 1) << 2,

		   offsetof(struct test_val, foo)),

	BPF_EXIT_INSN(),

	},

	.fixup_map_hash_48b = { 3 },

	.errstr = "invalid access to map value, value_size=48 off=48 size=8",

	.result = REJECT,

},

{

	"invalid map access into an array with a register",

	.insns = {

	BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),

	BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),

	BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),

	BPF_LD_MAP_FD(BPF_REG_1, 0),

	BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),

	BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),

	BPF_MOV64_IMM(BPF_REG_1, MAX_ENTRIES + 1),

	BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 2),

	BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),

	BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, offsetof(struct test_val, foo)),

	BPF_EXIT_INSN(),

	},

	.fixup_map_hash_48b = { 3 },

	.errstr = "R0 min value is outside of the array range",

	.result = REJECT,

	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,

},

{

	"invalid map access into an array with a variable",

	.insns = {

	BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),

	BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),

	BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),

	BPF_LD_MAP_FD(BPF_REG_1, 0),

	BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),

	BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),

	BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),

	BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 2),

	BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),

	BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, offsetof(struct test_val, foo)),

	BPF_EXIT_INSN(),

	},

	.fixup_map_hash_48b = { 3 },

	.errstr = "R0 unbounded memory access, make sure to bounds check any array access into a map",

	.result = REJECT,

	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,

},

{

	"invalid map access into an array with no floor check",

	.insns = {

	BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),

	BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),

	BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),

	BPF_LD_MAP_FD(BPF_REG_1, 0),

	BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),

	BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),

	BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, 0),

	BPF_MOV32_IMM(BPF_REG_2, MAX_ENTRIES),

	BPF_JMP_REG(BPF_JSGT, BPF_REG_2, BPF_REG_1, 1),

	BPF_MOV32_IMM(BPF_REG_1, 0),

	BPF_ALU32_IMM(BPF_LSH, BPF_REG_1, 2),

	BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),

	BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, offsetof(struct test_val, foo)),

	BPF_EXIT_INSN(),

	},

	.fixup_map_hash_48b = { 3 },

	.errstr_unpriv = "R0 leaks addr",

	.errstr = "R0 unbounded memory access",

	.result_unpriv = REJECT,

	.result = REJECT,

	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,

},

{

	"invalid map access into an array with a invalid max check",

	.insns = {

	BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),

	BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),

	BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),

	BPF_LD_MAP_FD(BPF_REG_1, 0),

	BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),

	BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),

	BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),

	BPF_MOV32_IMM(BPF_REG_2, MAX_ENTRIES + 1),

	BPF_JMP_REG(BPF_JGT, BPF_REG_2, BPF_REG_1, 1),

	BPF_MOV32_IMM(BPF_REG_1, 0),

	BPF_ALU32_IMM(BPF_LSH, BPF_REG_1, 2),

	BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),

	BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, offsetof(struct test_val, foo)),

	BPF_EXIT_INSN(),

	},

	.fixup_map_hash_48b = { 3 },

	.errstr_unpriv = "R0 leaks addr",

	.errstr = "invalid access to map value, value_size=48 off=44 size=8",

	.result_unpriv = REJECT,

	.result = REJECT,

	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,

},

{

	"invalid map access into an array with a invalid max check",

	.insns = {

	BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),

	BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),

	BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),

	BPF_LD_MAP_FD(BPF_REG_1, 0),

	BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),

	BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 10),

	BPF_MOV64_REG(BPF_REG_8, BPF_REG_0),

	BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),

	BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),

	BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),

	BPF_LD_MAP_FD(BPF_REG_1, 0),

	BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),

	BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),

	BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_8),

	BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_0,

		    offsetof(struct test_val, foo)),

	BPF_EXIT_INSN(),

	},

	.fixup_map_hash_48b = { 3, 11 },

	.errstr = "R0 pointer += pointer",

	.result = REJECT,

	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,

},

CRA Git | Maintained and supported by SUSTech CRA and CCSE