torvalds/linux
3
0
Fork 0
mirror of git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-04-03 21:19:09 +08:00
Code Issues Packages Projects Releases Wiki Activity

bpf: Add a possibly-zero-sized read test

Browse Source 
This patch adds a test for the condition that the previous patch mucked
with - illegal zero-sized helper memory access. As opposed to existing
tests, this new one uses a size whose lower bound is zero, as opposed to
a known-zero one.

Signed-off-by: Andrei Matei <andreimatei1@gmail.com>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/bpf/20231221232225.568730-3-andreimatei1@gmail.com
This commit is contained in:
Andrei Matei
2023-12-21 18:22:25 -05:00
committed by Andrii Nakryiko
parent 8a021e7fa1
commit 72187506de
1 changed files with 38 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

39
tools/testing/selftests/bpf/progs/verifier_helper_value_access.c
View File

@@ -89,9 +89,14 @@ l0_%=: exit; \
: __clobber_all);
}
/* Call a function taking a pointer and a size which doesn't allow the size to
* be zero (i.e. bpf_trace_printk() declares the second argument to be
* ARG_CONST_SIZE, not ARG_CONST_SIZE_OR_ZERO). We attempt to pass zero for the
* size and expect to fail.
*/
SEC("tracepoint")
__description("helper access to map: empty range")
__failure __msg("R2 invalid zero-sized read")
__failure __msg("R2 invalid zero-sized read: u64=[0,0]")
__naked void access_to_map_empty_range(void)
{
asm volatile (" \
@@ -113,6 +118,38 @@ l0_%=: exit; \
: __clobber_all);
}
/* Like the test above, but this time the size register is not known to be zero;
* its lower-bound is zero though, which is still unacceptable.
*/
SEC("tracepoint")
__description("helper access to map: possibly-empty ange")
__failure __msg("R2 invalid zero-sized read: u64=[0,4]")
__naked void access_to_map_possibly_empty_range(void)
{
asm volatile (" \
r2 = r10; \
r2 += -8; \
r1 = 0; \
*(u64*)(r2 + 0) = r1; \
r1 = %[map_hash_48b] ll; \
call %[bpf_map_lookup_elem]; \
if r0 == 0 goto l0_%=; \
r1 = r0; \
/* Read an unknown value */ \
r7 = *(u64*)(r0 + 0); \
/* Make it small and positive, to avoid other errors */ \
r7 &= 4; \
r2 = 0; \
r2 += r7; \
call %[bpf_trace_printk]; \
l0_%=: exit; \
" :
: __imm(bpf_map_lookup_elem),
__imm(bpf_trace_printk),
__imm_addr(map_hash_48b)
: __clobber_all);
}
SEC("tracepoint")
__description("helper access to map: out-of-bound range")
__failure __msg("invalid access to map value, value_size=48 off=0 size=56")