bpf: Selftests, verifier case for non null pointer map value branch (f9b16ec0) · Commits · 戴 / test

When we have pointer type that is known to be non-null we only follow the non-null branch. This adds tests to cover the map_value pointer returned from a map lookup. To force an error if both branches are followed we do an ALU op on R10. Signed-off-by:

John Fastabend <john.fastabend@gmail.com> Signed-off-by:

Alexei Starovoitov <ast@kernel.org> Acked-by:

Andrii Nakryiko <andriin@fb.com> Link: https://lore.kernel.org/bpf/159009168650.6313.7434084136067263554.stgit@john-Precision-5820-Tower

tools/testing/selftests/bpf/verifier/value_or_null.c

+19 −0

Original line number	Diff line number	Diff line
		@@ -150,3 +150,22 @@
		.result_unpriv = REJECT,
		.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
		},
		{
		"map lookup and null branch prediction",
		.insns = {
		BPF_MOV64_IMM(BPF_REG_1, 10),
		BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
		BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
		BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
		BPF_LD_MAP_FD(BPF_REG_1, 0),
		BPF_RAW_INSN(BPF_JMP \| BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
		BPF_MOV64_REG(BPF_REG_6, BPF_REG_0),
		BPF_JMP_IMM(BPF_JEQ, BPF_REG_6, 0, 2),
		BPF_JMP_IMM(BPF_JNE, BPF_REG_6, 0, 1),
		BPF_ALU64_IMM(BPF_ADD, BPF_REG_10, 10),
		BPF_EXIT_INSN(),
		},
		.fixup_map_hash_8b = { 4 },
		.prog_type = BPF_PROG_TYPE_SCHED_CLS,
		.result = ACCEPT,
		},

Admin message