Skip to content

L
linux
Commit 21ccaf21 authored by Daniel Borkmann's avatar Daniel Borkmann Committed by Alexei Starovoitov
Browse files
Options

bpf: add further test cases around div/mod and others 

Update selftests to relfect recent changes and add various new
test cases.
Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
Acked-by: default avatarAlexei Starovoitov <ast@kernel.org>
Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
parent 73ae3c04
Hide whitespace changes
Inline Side-by-side
Showing with 336 additions and 15 deletions
lib/test_bpf.c
View file @ 21ccaf21
...@@ -2003,10 +2003,14 @@ static struct bpf_test tests[] = { ...@@ -2003,10 +2003,14 @@ static struct bpf_test tests[] = {
{ { 4, 0 }, { 5, 10 } } { { 4, 0 }, { 5, 10 } }
}, },
{ {
"INT: DIV by zero", /* This one doesn't go through verifier, but is just raw insn
* as opposed to cBPF tests from here. Thus div by 0 tests are
* done in test_verifier in BPF kselftests.
*/
"INT: DIV by -1",
.u.insns_int = { .u.insns_int = {
BPF_ALU64_REG(BPF_MOV, R6, R1), BPF_ALU64_REG(BPF_MOV, R6, R1),
BPF_ALU64_IMM(BPF_MOV, R7, 0), BPF_ALU64_IMM(BPF_MOV, R7, -1),
BPF_LD_ABS(BPF_B, 3), BPF_LD_ABS(BPF_B, 3),
BPF_ALU32_REG(BPF_DIV, R0, R7), BPF_ALU32_REG(BPF_DIV, R0, R7),
BPF_EXIT_INSN(), BPF_EXIT_INSN(),
......
tools/testing/selftests/bpf/test_verifier.c
View file @ 21ccaf21
...@@ -21,6 +21,7 @@ ...@@ -21,6 +21,7 @@
#include <stddef.h> #include <stddef.h>
#include <stdbool.h> #include <stdbool.h>
#include <sched.h> #include <sched.h>
#include <limits.h>
#include <sys/capability.h> #include <sys/capability.h>
#include <sys/resource.h> #include <sys/resource.h>
...@@ -111,7 +112,7 @@ static struct bpf_test tests[] = { ...@@ -111,7 +112,7 @@ static struct bpf_test tests[] = {
BPF_EXIT_INSN(), BPF_EXIT_INSN(),
}, },
.result = ACCEPT, .result = ACCEPT,
.retval = 0, .retval = 42,
}, },
{ {
"DIV32 by 0, zero check 2", "DIV32 by 0, zero check 2",
...@@ -123,7 +124,7 @@ static struct bpf_test tests[] = { ...@@ -123,7 +124,7 @@ static struct bpf_test tests[] = {
BPF_EXIT_INSN(), BPF_EXIT_INSN(),
}, },
.result = ACCEPT, .result = ACCEPT,
.retval = 0, .retval = 42,
}, },
{ {
"DIV64 by 0, zero check", "DIV64 by 0, zero check",
...@@ -135,7 +136,7 @@ static struct bpf_test tests[] = { ...@@ -135,7 +136,7 @@ static struct bpf_test tests[] = {
BPF_EXIT_INSN(), BPF_EXIT_INSN(),
}, },
.result = ACCEPT, .result = ACCEPT,
.retval = 0, .retval = 42,
}, },
{ {
"MOD32 by 0, zero check 1", "MOD32 by 0, zero check 1",
...@@ -147,7 +148,7 @@ static struct bpf_test tests[] = { ...@@ -147,7 +148,7 @@ static struct bpf_test tests[] = {
BPF_EXIT_INSN(), BPF_EXIT_INSN(),
}, },
.result = ACCEPT, .result = ACCEPT,
.retval = 0, .retval = 42,
}, },
{ {
"MOD32 by 0, zero check 2", "MOD32 by 0, zero check 2",
...@@ -159,7 +160,7 @@ static struct bpf_test tests[] = { ...@@ -159,7 +160,7 @@ static struct bpf_test tests[] = {
BPF_EXIT_INSN(), BPF_EXIT_INSN(),
}, },
.result = ACCEPT, .result = ACCEPT,
.retval = 0, .retval = 42,
}, },
{ {
"MOD64 by 0, zero check", "MOD64 by 0, zero check",
...@@ -171,13 +172,245 @@ static struct bpf_test tests[] = { ...@@ -171,13 +172,245 @@ static struct bpf_test tests[] = {
BPF_EXIT_INSN(), BPF_EXIT_INSN(),
}, },
.result = ACCEPT, .result = ACCEPT,
.retval = 42,
},
{
"DIV32 by 0, zero check ok, cls",
.insns = {
BPF_MOV32_IMM(BPF_REG_0, 42),
BPF_MOV32_IMM(BPF_REG_1, 2),
BPF_MOV32_IMM(BPF_REG_2, 16),
BPF_ALU32_REG(BPF_DIV, BPF_REG_2, BPF_REG_1),
BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
BPF_EXIT_INSN(),
},
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
.result = ACCEPT,
.retval = 8,
},
{
"DIV32 by 0, zero check 1, cls",
.insns = {
BPF_MOV32_IMM(BPF_REG_1, 0),
BPF_MOV32_IMM(BPF_REG_0, 1),
BPF_ALU32_REG(BPF_DIV, BPF_REG_0, BPF_REG_1),
BPF_EXIT_INSN(),
},
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
.result = ACCEPT,
.retval = 0,
},
{
"DIV32 by 0, zero check 2, cls",
.insns = {
BPF_LD_IMM64(BPF_REG_1, 0xffffffff00000000LL),
BPF_MOV32_IMM(BPF_REG_0, 1),
BPF_ALU32_REG(BPF_DIV, BPF_REG_0, BPF_REG_1),
BPF_EXIT_INSN(),
},
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
.result = ACCEPT,
.retval = 0,
},
{
"DIV64 by 0, zero check, cls",
.insns = {
BPF_MOV32_IMM(BPF_REG_1, 0),
BPF_MOV32_IMM(BPF_REG_0, 1),
BPF_ALU64_REG(BPF_DIV, BPF_REG_0, BPF_REG_1),
BPF_EXIT_INSN(),
},
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
.result = ACCEPT,
.retval = 0,
},
{
"MOD32 by 0, zero check ok, cls",
.insns = {
BPF_MOV32_IMM(BPF_REG_0, 42),
BPF_MOV32_IMM(BPF_REG_1, 3),
BPF_MOV32_IMM(BPF_REG_2, 5),
BPF_ALU32_REG(BPF_MOD, BPF_REG_2, BPF_REG_1),
BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
BPF_EXIT_INSN(),
},
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
.result = ACCEPT,
.retval = 2,
},
{
"MOD32 by 0, zero check 1, cls",
.insns = {
BPF_MOV32_IMM(BPF_REG_1, 0),
BPF_MOV32_IMM(BPF_REG_0, 1),
BPF_ALU32_REG(BPF_MOD, BPF_REG_0, BPF_REG_1),
BPF_EXIT_INSN(),
},
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
.result = ACCEPT,
.retval = 1,
},
{
"MOD32 by 0, zero check 2, cls",
.insns = {
BPF_LD_IMM64(BPF_REG_1, 0xffffffff00000000LL),
BPF_MOV32_IMM(BPF_REG_0, 1),
BPF_ALU32_REG(BPF_MOD, BPF_REG_0, BPF_REG_1),
BPF_EXIT_INSN(),
},
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
.result = ACCEPT,
.retval = 1,
},
{
"MOD64 by 0, zero check 1, cls",
.insns = {
BPF_MOV32_IMM(BPF_REG_1, 0),
BPF_MOV32_IMM(BPF_REG_0, 2),
BPF_ALU64_REG(BPF_MOD, BPF_REG_0, BPF_REG_1),
BPF_EXIT_INSN(),
},
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
.result = ACCEPT,
.retval = 2,
},
{
"MOD64 by 0, zero check 2, cls",
.insns = {
BPF_MOV32_IMM(BPF_REG_1, 0),
BPF_MOV32_IMM(BPF_REG_0, -1),
BPF_ALU64_REG(BPF_MOD, BPF_REG_0, BPF_REG_1),
BPF_EXIT_INSN(),
},
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
.result = ACCEPT,
.retval = -1,
},
/* Just make sure that JITs used udiv/umod as otherwise we get
* an exception from INT_MIN/-1 overflow similarly as with div
* by zero.
*/
{
"DIV32 overflow, check 1",
.insns = {
BPF_MOV32_IMM(BPF_REG_1, -1),
BPF_MOV32_IMM(BPF_REG_0, INT_MIN),
BPF_ALU32_REG(BPF_DIV, BPF_REG_0, BPF_REG_1),
BPF_EXIT_INSN(),
},
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
.result = ACCEPT,
.retval = 0,
},
{
"DIV32 overflow, check 2",
.insns = {
BPF_MOV32_IMM(BPF_REG_0, INT_MIN),
BPF_ALU32_IMM(BPF_DIV, BPF_REG_0, -1),
BPF_EXIT_INSN(),
},
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
.result = ACCEPT,
.retval = 0,
},
{
"DIV64 overflow, check 1",
.insns = {
BPF_MOV64_IMM(BPF_REG_1, -1),
BPF_LD_IMM64(BPF_REG_0, LLONG_MIN),
BPF_ALU64_REG(BPF_DIV, BPF_REG_0, BPF_REG_1),
BPF_EXIT_INSN(),
},
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
.result = ACCEPT,
.retval = 0,
},
{
"DIV64 overflow, check 2",
.insns = {
BPF_LD_IMM64(BPF_REG_0, LLONG_MIN),
BPF_ALU64_IMM(BPF_DIV, BPF_REG_0, -1),
BPF_EXIT_INSN(),
},
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
.result = ACCEPT,
.retval = 0, .retval = 0,
}, },
{
"MOD32 overflow, check 1",
.insns = {
BPF_MOV32_IMM(BPF_REG_1, -1),
BPF_MOV32_IMM(BPF_REG_0, INT_MIN),
BPF_ALU32_REG(BPF_MOD, BPF_REG_0, BPF_REG_1),
BPF_EXIT_INSN(),
},
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
.result = ACCEPT,
.retval = INT_MIN,
},
{
"MOD32 overflow, check 2",
.insns = {
BPF_MOV32_IMM(BPF_REG_0, INT_MIN),
BPF_ALU32_IMM(BPF_MOD, BPF_REG_0, -1),
BPF_EXIT_INSN(),
},
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
.result = ACCEPT,
.retval = INT_MIN,
},
{
"MOD64 overflow, check 1",
.insns = {
BPF_MOV64_IMM(BPF_REG_1, -1),
BPF_LD_IMM64(BPF_REG_2, LLONG_MIN),
BPF_MOV64_REG(BPF_REG_3, BPF_REG_2),
BPF_ALU64_REG(BPF_MOD, BPF_REG_2, BPF_REG_1),
BPF_MOV32_IMM(BPF_REG_0, 0),
BPF_JMP_REG(BPF_JNE, BPF_REG_3, BPF_REG_2, 1),
BPF_MOV32_IMM(BPF_REG_0, 1),
BPF_EXIT_INSN(),
},
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
.result = ACCEPT,
.retval = 1,
},
{
"MOD64 overflow, check 2",
.insns = {
BPF_LD_IMM64(BPF_REG_2, LLONG_MIN),
BPF_MOV64_REG(BPF_REG_3, BPF_REG_2),
BPF_ALU64_IMM(BPF_MOD, BPF_REG_2, -1),
BPF_MOV32_IMM(BPF_REG_0, 0),
BPF_JMP_REG(BPF_JNE, BPF_REG_3, BPF_REG_2, 1),
BPF_MOV32_IMM(BPF_REG_0, 1),
BPF_EXIT_INSN(),
},
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
.result = ACCEPT,
.retval = 1,
},
{
"xor32 zero extend check",
.insns = {
BPF_MOV32_IMM(BPF_REG_2, -1),
BPF_ALU64_IMM(BPF_LSH, BPF_REG_2, 32),
BPF_ALU64_IMM(BPF_OR, BPF_REG_2, 0xffff),
BPF_ALU32_REG(BPF_XOR, BPF_REG_2, BPF_REG_2),
BPF_MOV32_IMM(BPF_REG_0, 2),
BPF_JMP_IMM(BPF_JNE, BPF_REG_2, 0, 1),
BPF_MOV32_IMM(BPF_REG_0, 1),
BPF_EXIT_INSN(),
},
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
.result = ACCEPT,
.retval = 1,
},
{ {
"empty prog", "empty prog",
.insns = { .insns = {
}, },
.errstr = "last insn is not an exit or jmp", .errstr = "unknown opcode 00",
.result = REJECT, .result = REJECT,
}, },
{ {
...@@ -374,7 +607,7 @@ static struct bpf_test tests[] = { ...@@ -374,7 +607,7 @@ static struct bpf_test tests[] = {
BPF_EXIT_INSN(), BPF_EXIT_INSN(),
}, },
.result = REJECT, .result = REJECT,
.errstr = "BPF_ARSH not supported for 32 bit ALU", .errstr = "unknown opcode c4",
}, },
{ {
"arsh32 on reg", "arsh32 on reg",
...@@ -385,7 +618,7 @@ static struct bpf_test tests[] = { ...@@ -385,7 +618,7 @@ static struct bpf_test tests[] = {
BPF_EXIT_INSN(), BPF_EXIT_INSN(),
}, },
.result = REJECT, .result = REJECT,
.errstr = "BPF_ARSH not supported for 32 bit ALU", .errstr = "unknown opcode cc",
}, },
{ {
"arsh64 on imm", "arsh64 on imm",
...@@ -501,7 +734,7 @@ static struct bpf_test tests[] = { ...@@ -501,7 +734,7 @@ static struct bpf_test tests[] = {
BPF_RAW_INSN(BPF_JMP | BPF_CALL | BPF_X, 0, 0, 0, 0), BPF_RAW_INSN(BPF_JMP | BPF_CALL | BPF_X, 0, 0, 0, 0),
BPF_EXIT_INSN(), BPF_EXIT_INSN(),
}, },
.errstr = "BPF_CALL uses reserved", .errstr = "unknown opcode 8d",
.result = REJECT, .result = REJECT,
}, },
{ {
...@@ -691,7 +924,7 @@ static struct bpf_test tests[] = { ...@@ -691,7 +924,7 @@ static struct bpf_test tests[] = {
BPF_RAW_INSN(0, 0, 0, 0, 0), BPF_RAW_INSN(0, 0, 0, 0, 0),
BPF_EXIT_INSN(), BPF_EXIT_INSN(),
}, },
.errstr = "invalid BPF_LD_IMM", .errstr = "unknown opcode 00",
.result = REJECT, .result = REJECT,
}, },
{ {
...@@ -709,7 +942,7 @@ static struct bpf_test tests[] = { ...@@ -709,7 +942,7 @@ static struct bpf_test tests[] = {
BPF_RAW_INSN(-1, 0, 0, 0, 0), BPF_RAW_INSN(-1, 0, 0, 0, 0),
BPF_EXIT_INSN(), BPF_EXIT_INSN(),
}, },
.errstr = "invalid BPF_ALU opcode f0", .errstr = "unknown opcode ff",
.result = REJECT, .result = REJECT,
}, },
{ {
...@@ -718,7 +951,7 @@ static struct bpf_test tests[] = { ...@@ -718,7 +951,7 @@ static struct bpf_test tests[] = {
BPF_RAW_INSN(-1, -1, -1, -1, -1), BPF_RAW_INSN(-1, -1, -1, -1, -1),
BPF_EXIT_INSN(), BPF_EXIT_INSN(),
}, },
.errstr = "invalid BPF_ALU opcode f0", .errstr = "unknown opcode ff",
.result = REJECT, .result = REJECT,
}, },
{ {
...@@ -7543,7 +7776,7 @@ static struct bpf_test tests[] = { ...@@ -7543,7 +7776,7 @@ static struct bpf_test tests[] = {
}, },
BPF_EXIT_INSN(), BPF_EXIT_INSN(),
}, },
.errstr = "BPF_END uses reserved fields", .errstr = "unknown opcode d7",
.result = REJECT, .result = REJECT,
}, },
{ {
...@@ -8963,6 +9196,90 @@ static struct bpf_test tests[] = { ...@@ -8963,6 +9196,90 @@ static struct bpf_test tests[] = {
.result = ACCEPT, .result = ACCEPT,
.retval = 1, .retval = 1,
}, },
{
"calls: div by 0 in subprog",
.insns = {
BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 8),
BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
offsetof(struct __sk_buff, data_end)),
BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 8),
BPF_JMP_REG(BPF_JGT, BPF_REG_2, BPF_REG_1, 1),
BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
BPF_MOV64_IMM(BPF_REG_0, 1),
BPF_EXIT_INSN(),
BPF_MOV32_IMM(BPF_REG_2, 0),
BPF_MOV32_IMM(BPF_REG_3, 1),
BPF_ALU32_REG(BPF_DIV, BPF_REG_3, BPF_REG_2),
BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
offsetof(struct __sk_buff, data)),
BPF_EXIT_INSN(),
},
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
.result = ACCEPT,
.retval = 1,
},
{
"calls: multiple ret types in subprog 1",
.insns = {
BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 8),
BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
offsetof(struct __sk_buff, data_end)),
BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 8),
BPF_JMP_REG(BPF_JGT, BPF_REG_2, BPF_REG_1, 1),
BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
BPF_MOV64_IMM(BPF_REG_0, 1),
BPF_EXIT_INSN(),
BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
offsetof(struct __sk_buff, data)),
BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
BPF_MOV32_IMM(BPF_REG_0, 42),
BPF_EXIT_INSN(),
},
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
.result = REJECT,
.errstr = "R0 invalid mem access 'inv'",
},
{
"calls: multiple ret types in subprog 2",
.insns = {
BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 8),
BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
offsetof(struct __sk_buff, data_end)),
BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 8),
BPF_JMP_REG(BPF_JGT, BPF_REG_2, BPF_REG_1, 1),
BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
BPF_MOV64_IMM(BPF_REG_0, 1),
BPF_EXIT_INSN(),
BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
offsetof(struct __sk_buff, data)),
BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 9),
BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
BPF_LD_MAP_FD(BPF_REG_1, 0),
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
BPF_FUNC_map_lookup_elem),
BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_6,
offsetof(struct __sk_buff, data)),
BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 64),
BPF_EXIT_INSN(),
},
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
.fixup_map1 = { 16 },
.result = REJECT,
.errstr = "R0 min value is outside of the array range",
},
{ {
"calls: overlapping caller/callee", "calls: overlapping caller/callee",
.insns = { .insns = {
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment
GitLab Nexedi Edition | About GitLab | About Nexedi | 沪ICP备2021021310号-2 | 沪ICP备2021021310号-7