github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-06-01 19:13:47 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

selftests/bpf: Add test for conditional jumps on same scalar register

Browse Source 
Add test cases to verify the correctness of the BPF verifier's branch analysis
when conditional jumps are performed on the same scalar register. And make sure
that JGT does not trigger verifier BUG.

Signed-off-by: KaFai Wan <kafai.wan@linux.dev>
Acked-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://lore.kernel.org/r/20251103063108.1111764-3-kafai.wan@linux.dev
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
This commit is contained in:
KaFai Wan 2025-11-03 14:31:08 +08:00 committed by Alexei Starovoitov
parent d43ad9da80
commit 9f32bfec54
1 changed files with 154 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

154
tools/testing/selftests/bpf/progs/verifier_bounds.c
View File

@ -1709,4 +1709,158 @@ __naked void jeq_disagreeing_tnums(void *ctx)
: __clobber_all);
}
SEC("socket")
__description("conditional jump on same register, branch taken")
__not_msg("20: (b7) r0 = 1 {{.*}} R0=1")
__success __log_level(2)
__retval(0) __flag(BPF_F_TEST_REG_INVARIANTS)
__naked void condition_jump_on_same_register(void *ctx)
{
asm volatile(" \
call %[bpf_get_prandom_u32]; \
w8 = 0x80000000; \
r0 &= r8; \
if r0 == r0 goto +1; \
goto l1_%=; \
if r0 >= r0 goto +1; \
goto l1_%=; \
if r0 s>= r0 goto +1; \
goto l1_%=; \
if r0 <= r0 goto +1; \
goto l1_%=; \
if r0 s<= r0 goto +1; \
goto l1_%=; \
if r0 != r0 goto l1_%=; \
if r0 > r0 goto l1_%=; \
if r0 s> r0 goto l1_%=; \
if r0 < r0 goto l1_%=; \
if r0 s< r0 goto l1_%=; \
l0_%=: r0 = 0; \
exit; \
l1_%=: r0 = 1; \
exit; \
" :
: __imm(bpf_get_prandom_u32)
: __clobber_all);
}
SEC("socket")
__description("jset on same register, constant value branch taken")
__not_msg("7: (b7) r0 = 1 {{.*}} R0=1")
__success __log_level(2)
__retval(0) __flag(BPF_F_TEST_REG_INVARIANTS)
__naked void jset_on_same_register_1(void *ctx)
{
asm volatile(" \
r0 = 0; \
if r0 & r0 goto l1_%=; \
r0 = 1; \
if r0 & r0 goto +1; \
goto l1_%=; \
l0_%=: r0 = 0; \
exit; \
l1_%=: r0 = 1; \
exit; \
" :
: __imm(bpf_get_prandom_u32)
: __clobber_all);
}
SEC("socket")
__description("jset on same register, scalar value branch taken")
__not_msg("12: (b7) r0 = 1 {{.*}} R0=1")
__success __log_level(2)
__retval(0) __flag(BPF_F_TEST_REG_INVARIANTS)
__naked void jset_on_same_register_2(void *ctx)
{
asm volatile(" \
/* range [1;2] */ \
call %[bpf_get_prandom_u32]; \
r0 &= 0x1; \
r0 += 1; \
if r0 & r0 goto +1; \
goto l1_%=; \
/* range [-2;-1] */ \
call %[bpf_get_prandom_u32]; \
r0 &= 0x1; \
r0 -= 2; \
if r0 & r0 goto +1; \
goto l1_%=; \
l0_%=: r0 = 0; \
exit; \
l1_%=: r0 = 1; \
exit; \
" :
: __imm(bpf_get_prandom_u32)
: __clobber_all);
}
SEC("socket")
__description("jset on same register, scalar value unknown branch 1")
__msg("3: (b7) r0 = 0 {{.*}} R0=0")
__msg("5: (b7) r0 = 1 {{.*}} R0=1")
__success __log_level(2)
__flag(BPF_F_TEST_REG_INVARIANTS)
__naked void jset_on_same_register_3(void *ctx)
{
asm volatile(" \
/* range [0;1] */ \
call %[bpf_get_prandom_u32]; \
r0 &= 0x1; \
if r0 & r0 goto l1_%=; \
l0_%=: r0 = 0; \
exit; \
l1_%=: r0 = 1; \
exit; \
" :
: __imm(bpf_get_prandom_u32)
: __clobber_all);
}
SEC("socket")
__description("jset on same register, scalar value unknown branch 2")
__msg("4: (b7) r0 = 0 {{.*}} R0=0")
__msg("6: (b7) r0 = 1 {{.*}} R0=1")
__success __log_level(2)
__flag(BPF_F_TEST_REG_INVARIANTS)
__naked void jset_on_same_register_4(void *ctx)
{
asm volatile(" \
/* range [-1;0] */ \
call %[bpf_get_prandom_u32]; \
r0 &= 0x1; \
r0 -= 1; \
if r0 & r0 goto l1_%=; \
l0_%=: r0 = 0; \
exit; \
l1_%=: r0 = 1; \
exit; \
" :
: __imm(bpf_get_prandom_u32)
: __clobber_all);
}
SEC("socket")
__description("jset on same register, scalar value unknown branch 3")
__msg("4: (b7) r0 = 0 {{.*}} R0=0")
__msg("6: (b7) r0 = 1 {{.*}} R0=1")
__success __log_level(2)
__flag(BPF_F_TEST_REG_INVARIANTS)
__naked void jset_on_same_register_5(void *ctx)
{
asm volatile(" \
/* range [-1;1] */ \
call %[bpf_get_prandom_u32]; \
r0 &= 0x2; \
r0 -= 1; \
if r0 & r0 goto l1_%=; \
l0_%=: r0 = 0; \
exit; \
l1_%=: r0 = 1; \
exit; \
" :
: __imm(bpf_get_prandom_u32)
: __clobber_all);
}
char _license[] SEC("license") = "GPL";