• John Fastabend's avatar
    bpf: Test_verifier, #65 error message updates for trunc of boundary-cross · 32f13a5a
    John Fastabend authored
    After changes to add update_reg_bounds after ALU ops and 32-bit bounds
    tracking truncation of boundary crossing range will fail earlier and with
    a different error message. Now the test error trace is the following
    
    11: (17) r1 -= 2147483584
    12: R0_w=map_value(id=0,off=0,ks=8,vs=8,imm=0)
        R1_w=invP(id=0,smin_value=-2147483584,smax_value=63)
        R10=fp0 fp-8_w=mmmmmmmm
    12: (17) r1 -= 2147483584
    13: R0_w=map_value(id=0,off=0,ks=8,vs=8,imm=0)
        R1_w=invP(id=0,
                  umin_value=18446744069414584448,umax_value=18446744071562068095,
                  var_off=(0xffffffff00000000; 0xffffffff))
        R10=fp0 fp-8_w=mmmmmmmm
    13: (77) r1 >>= 8
    14: R0_w=map_value(id=0,off=0,ks=8,vs=8,imm=0)
        R1_w=invP(id=0,
                  umin_value=72057594021150720,umax_value=72057594029539328,
                  var_off=(0xffffffff000000; 0xffffff),
                  s32_min_value=-16777216,s32_max_value=-1,
                  u32_min_value=-16777216)
        R10=fp0 fp-8_w=mmmmmmmm
    14: (0f) r0 += r1
    value 72057594021150720 makes map_value pointer be out of bounds
    
    Because we have 'umin_value == umax_value' instead of previously
    where 'umin_value != umax_value' we can now fail earlier noting
    that pointer addition is out of bounds.
    Signed-off-by: default avatarJohn Fastabend <john.fastabend@gmail.com>
    Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
    Link: https://lore.kernel.org/bpf/158560428103.10843.6316594510312781186.stgit@john-Precision-5820-Tower
    32f13a5a
bounds.c 16.2 KB