Commit 2683f412 authored by Daniel Borkmann's avatar Daniel Borkmann Committed by Alexei Starovoitov
Browse files

bpf: add various test cases to test_verifier 



Add some more map related test cases to test_verifier kselftest
to improve test coverage. Summary: 1012 PASSED, 0 SKIPPED, 0 FAILED

Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
Acked-by: default avatarAlexei Starovoitov <ast@kernel.org>
Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
parent 4d31f301

tools/testing/selftests/bpf/test_verifier.c

+250 −0
Original line number Diff line number Diff line
@@ -6454,6 +6454,256 @@ static struct bpf_test tests[] = { 
		.errstr = "R1 min value is negative",

		.prog_type = BPF_PROG_TYPE_TRACEPOINT,

	},

	{

		"map access: known scalar += value_ptr",

		.insns = {

			BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),

			BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),

			BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),

			BPF_LD_MAP_FD(BPF_REG_1, 0),

			BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,

				     BPF_FUNC_map_lookup_elem),

			BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3),

			BPF_MOV64_IMM(BPF_REG_1, 4),

			BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_0),

			BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1, 0),

			BPF_MOV64_IMM(BPF_REG_0, 1),

			BPF_EXIT_INSN(),

		},

		.fixup_map_array_48b = { 3 },

		.result = ACCEPT,

		.retval = 1,

	},

	{

		"map access: value_ptr += known scalar",

		.insns = {

			BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),

			BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),

			BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),

			BPF_LD_MAP_FD(BPF_REG_1, 0),

			BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,

				     BPF_FUNC_map_lookup_elem),

			BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3),

			BPF_MOV64_IMM(BPF_REG_1, 4),

			BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),

			BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),

			BPF_MOV64_IMM(BPF_REG_0, 1),

			BPF_EXIT_INSN(),

		},

		.fixup_map_array_48b = { 3 },

		.result = ACCEPT,

		.retval = 1,

	},

	{

		"map access: unknown scalar += value_ptr",

		.insns = {

			BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),

			BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),

			BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),

			BPF_LD_MAP_FD(BPF_REG_1, 0),

			BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,

				     BPF_FUNC_map_lookup_elem),

			BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),

			BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),

			BPF_ALU64_IMM(BPF_AND, BPF_REG_1, 0xf),

			BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_0),

			BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1, 0),

			BPF_MOV64_IMM(BPF_REG_0, 1),

			BPF_EXIT_INSN(),

		},

		.fixup_map_array_48b = { 3 },

		.result = ACCEPT,

		.retval = 1,

	},

	{

		"map access: value_ptr += unknown scalar",

		.insns = {

			BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),

			BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),

			BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),

			BPF_LD_MAP_FD(BPF_REG_1, 0),

			BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,

				     BPF_FUNC_map_lookup_elem),

			BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),

			BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),

			BPF_ALU64_IMM(BPF_AND, BPF_REG_1, 0xf),

			BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),

			BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),

			BPF_MOV64_IMM(BPF_REG_0, 1),

			BPF_EXIT_INSN(),

		},

		.fixup_map_array_48b = { 3 },

		.result = ACCEPT,

		.retval = 1,

	},

	{

		"map access: value_ptr += value_ptr",

		.insns = {

			BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),

			BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),

			BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),

			BPF_LD_MAP_FD(BPF_REG_1, 0),

			BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,

				     BPF_FUNC_map_lookup_elem),

			BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),

			BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_0),

			BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),

			BPF_MOV64_IMM(BPF_REG_0, 1),

			BPF_EXIT_INSN(),

		},

		.fixup_map_array_48b = { 3 },

		.result = REJECT,

		.errstr = "R0 pointer += pointer prohibited",

	},

	{

		"map access: known scalar -= value_ptr",

		.insns = {

			BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),

			BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),

			BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),

			BPF_LD_MAP_FD(BPF_REG_1, 0),

			BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,

				     BPF_FUNC_map_lookup_elem),

			BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3),

			BPF_MOV64_IMM(BPF_REG_1, 4),

			BPF_ALU64_REG(BPF_SUB, BPF_REG_1, BPF_REG_0),

			BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1, 0),

			BPF_MOV64_IMM(BPF_REG_0, 1),

			BPF_EXIT_INSN(),

		},

		.fixup_map_array_48b = { 3 },

		.result = REJECT,

		.errstr = "R1 tried to subtract pointer from scalar",

	},

	{

		"map access: value_ptr -= known scalar",

		.insns = {

			BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),

			BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),

			BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),

			BPF_LD_MAP_FD(BPF_REG_1, 0),

			BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,

				     BPF_FUNC_map_lookup_elem),

			BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3),

			BPF_MOV64_IMM(BPF_REG_1, 4),

			BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),

			BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),

			BPF_MOV64_IMM(BPF_REG_0, 1),

			BPF_EXIT_INSN(),

		},

		.fixup_map_array_48b = { 3 },

		.result = REJECT,

		.errstr = "R0 min value is outside of the array range",

	},

	{

		"map access: value_ptr -= known scalar, 2",

		.insns = {

			BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),

			BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),

			BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),

			BPF_LD_MAP_FD(BPF_REG_1, 0),

			BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,

				     BPF_FUNC_map_lookup_elem),

			BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),

			BPF_MOV64_IMM(BPF_REG_1, 6),

			BPF_MOV64_IMM(BPF_REG_2, 4),

			BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),

			BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_2),

			BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),

			BPF_MOV64_IMM(BPF_REG_0, 1),

			BPF_EXIT_INSN(),

		},

		.fixup_map_array_48b = { 3 },

		.result = ACCEPT,

		.retval = 1,

	},

	{

		"map access: unknown scalar -= value_ptr",

		.insns = {

			BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),

			BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),

			BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),

			BPF_LD_MAP_FD(BPF_REG_1, 0),

			BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,

				     BPF_FUNC_map_lookup_elem),

			BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),

			BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),

			BPF_ALU64_IMM(BPF_AND, BPF_REG_1, 0xf),

			BPF_ALU64_REG(BPF_SUB, BPF_REG_1, BPF_REG_0),

			BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1, 0),

			BPF_MOV64_IMM(BPF_REG_0, 1),

			BPF_EXIT_INSN(),

		},

		.fixup_map_array_48b = { 3 },

		.result = REJECT,

		.errstr = "R1 tried to subtract pointer from scalar",

	},

	{

		"map access: value_ptr -= unknown scalar",

		.insns = {

			BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),

			BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),

			BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),

			BPF_LD_MAP_FD(BPF_REG_1, 0),

			BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,

				     BPF_FUNC_map_lookup_elem),

			BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),

			BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),

			BPF_ALU64_IMM(BPF_AND, BPF_REG_1, 0xf),

			BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),

			BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),

			BPF_MOV64_IMM(BPF_REG_0, 1),

			BPF_EXIT_INSN(),

		},

		.fixup_map_array_48b = { 3 },

		.result = REJECT,

		.errstr = "R0 min value is negative",

	},

	{

		"map access: value_ptr -= unknown scalar, 2",

		.insns = {

			BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),

			BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),

			BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),

			BPF_LD_MAP_FD(BPF_REG_1, 0),

			BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,

				     BPF_FUNC_map_lookup_elem),

			BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 8),

			BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),

			BPF_ALU64_IMM(BPF_AND, BPF_REG_1, 0xf),

			BPF_ALU64_IMM(BPF_OR, BPF_REG_1, 0x7),

			BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),

			BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),

			BPF_ALU64_IMM(BPF_AND, BPF_REG_1, 0x7),

			BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),

			BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),

			BPF_MOV64_IMM(BPF_REG_0, 1),

			BPF_EXIT_INSN(),

		},

		.fixup_map_array_48b = { 3 },

		.result = ACCEPT,

		.retval = 1,

	},

	{

		"map access: value_ptr -= value_ptr",

		.insns = {

			BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),

			BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),

			BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),

			BPF_LD_MAP_FD(BPF_REG_1, 0),

			BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,

				     BPF_FUNC_map_lookup_elem),

			BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),

			BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_0),

			BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),

			BPF_MOV64_IMM(BPF_REG_0, 1),

			BPF_EXIT_INSN(),

		},

		.fixup_map_array_48b = { 3 },

		.result = REJECT,

		.errstr = "R0 invalid mem access 'inv'",

		.errstr_unpriv = "R0 pointer -= pointer prohibited",

	},

	{

		"map lookup helper access to map",

		.insns = {

CRA Git | Maintained and supported by SUSTech CRA and CCSE