From patchwork Tue Dec 19 13:47:57 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Menglong Dong X-Patchwork-Id: 756696 Received: from mail-oo1-f65.google.com (mail-oo1-f65.google.com [209.85.161.65]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id F3D871A58F; Tue, 19 Dec 2023 13:50:43 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="ioGokt/z" Received: by mail-oo1-f65.google.com with SMTP id 006d021491bc7-593d9b1139fso811752eaf.1; Tue, 19 Dec 2023 05:50:43 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1702993843; x=1703598643; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=vIG7gX50kKtmhzIyeXshzVLZolIi3kTx5IiKTBxlLu0=; b=ioGokt/z7J9mHNSSlfnrNpmaKq6ggDsV2EvsOMhhnH2kulZcbIPnsixNNwOt7VKBtS 6VNgVkRNPrhBiMquVeRkt298IJJFpCtjWj9qmPRsnH+6PIEXzdEJh25DfXB9zwQA8Ru8 uhbsa9mBGCB93E4dhKNReE6k7ykx+9RIvN3N3DLzsf0DqplqQAvlMuURIVnkHdtIJ00c TIOplV+/fnG/fK0MBMIsRyr5+E3n9uGO0AyYx49nDV3S+DeT484jemClgYr2ynNJcmMN zWMm9jpfNlBQB1Xaqw6HPCCyCh+ofOwn7YxpGEM9vimrw8ZLFuFw2QFCoyOKDWgPFySf Fgfw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1702993843; x=1703598643; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=vIG7gX50kKtmhzIyeXshzVLZolIi3kTx5IiKTBxlLu0=; b=EVmr7XrIFAmA+X0m1Bw9MVAwnEtYhhV1KF8MRTDYwrI0IQq3yiVoBAJUP1wXRJhlYF F/s5xLY+0y2AbbYXMawxZ2D1RWD+n2DV8FWOAksP4CJ14zUvib1VPUoKjz70/3grvKik t5g0QT/p2GDKC26FCDE/wQEtpJ/vv4jn3rj31OD6FVxx4Y6XCqD/1LyMM1FhCrPiAaKG IjmwlAxO4QY00W3qjY838h9Ojtoz9MCfkBXl3m+h+G+htINmq3xoJ2en7mWK37P1O9Ix 9zpY06TJ/4mTqVyF7Ph4yY9+NhfQi4iBt7l9ppjVXL0rboqZdVzt8OnxD4/djPECE+NP dCnw== X-Gm-Message-State: AOJu0YzFWdFcsR7we6t7W7zJcQWh0UQt0aE7KMSUasuQD3sJ6uVnO/gQ qUfyA7D+Xtdw2HXtkosp4ic33NXVI/xihEFx X-Google-Smtp-Source: AGHT+IEUwCFelS+UDCF6zIJzpNrzXI5jANkHv2yAjuwZIR0y0E6j5IOFn16FRHcI6Z86VT3MRtmB8w== X-Received: by 2002:a05:6358:5e15:b0:170:b07b:8352 with SMTP id q21-20020a0563585e1500b00170b07b8352mr17482631rwn.4.1702993842987; Tue, 19 Dec 2023 05:50:42 -0800 (PST) Received: from localhost.localdomain ([43.129.244.20]) by smtp.gmail.com with ESMTPSA id d17-20020a056a00245100b006cddecbf432sm20695264pfj.96.2023.12.19.05.50.38 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 19 Dec 2023 05:50:42 -0800 (PST) From: Menglong Dong To: andrii@kernel.org, eddyz87@gmail.com, yonghong.song@linux.dev, alexei.starovoitov@gmail.com Cc: ast@kernel.org, daniel@iogearbox.net, john.fastabend@gmail.com, martin.lau@linux.dev, song@kernel.org, kpsingh@kernel.org, sdf@google.com, haoluo@google.com, jolsa@kernel.org, mykolal@fb.com, shuah@kernel.org, menglong8.dong@gmail.com, bpf@vger.kernel.org, linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org, Shung-Hsi Yu Subject: [PATCH bpf-next v5 1/4] bpf: make the verifier tracks the "not equal" for regs Date: Tue, 19 Dec 2023 21:47:57 +0800 Message-Id: <20231219134800.1550388-2-menglong8.dong@gmail.com> X-Mailer: git-send-email 2.39.2 In-Reply-To: <20231219134800.1550388-1-menglong8.dong@gmail.com> References: <20231219134800.1550388-1-menglong8.dong@gmail.com> Precedence: bulk X-Mailing-List: linux-kselftest@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 We can derive some new information for BPF_JNE in regs_refine_cond_op(). Take following code for example: /* The type of "a" is u32 */ if (a > 0 && a < 100) { /* the range of the register for a is [0, 99], not [1, 99], * and will cause the following error: * * invalid zero-sized read * * as a can be 0. */ bpf_skb_store_bytes(skb, xx, xx, a, 0); } In the code above, "a > 0" will be compiled to "jmp xxx if a == 0". In the TRUE branch, the dst_reg will be marked as known to 0. However, in the fallthrough(FALSE) branch, the dst_reg will not be handled, which makes the [min, max] for a is [0, 99], not [1, 99]. For BPF_JNE, we can reduce the range of the dst reg if the src reg is a const and is exactly the edge of the dst reg. Signed-off-by: Menglong Dong Acked-by: Andrii Nakryiko Acked-by: Shung-Hsi Yu --- v2: - fix a typo in the subject - add some comments, as Eduard advised --- kernel/bpf/verifier.c | 38 +++++++++++++++++++++++++++++++++++++- 1 file changed, 37 insertions(+), 1 deletion(-) diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index 1863826a4ac3..29c41d66ea6f 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -14343,7 +14343,43 @@ static void regs_refine_cond_op(struct bpf_reg_state *reg1, struct bpf_reg_state } break; case BPF_JNE: - /* we don't derive any new information for inequality yet */ + if (!is_reg_const(reg2, is_jmp32)) + swap(reg1, reg2); + if (!is_reg_const(reg2, is_jmp32)) + break; + + /* try to recompute the bound of reg1 if reg2 is a const and + * is exactly the edge of reg1. + */ + val = reg_const_value(reg2, is_jmp32); + if (is_jmp32) { + /* u32_min_value is not equal to 0xffffffff at this point, + * because otherwise u32_max_value is 0xffffffff as well, + * in such a case both reg1 and reg2 would be constants, + * jump would be predicted and reg_set_min_max() won't + * be called. + * + * Same reasoning works for all {u,s}{min,max}{32,64} cases + * below. + */ + if (reg1->u32_min_value == (u32)val) + reg1->u32_min_value++; + if (reg1->u32_max_value == (u32)val) + reg1->u32_max_value--; + if (reg1->s32_min_value == (s32)val) + reg1->s32_min_value++; + if (reg1->s32_max_value == (s32)val) + reg1->s32_max_value--; + } else { + if (reg1->umin_value == (u64)val) + reg1->umin_value++; + if (reg1->umax_value == (u64)val) + reg1->umax_value--; + if (reg1->smin_value == (s64)val) + reg1->smin_value++; + if (reg1->smax_value == (s64)val) + reg1->smax_value--; + } break; case BPF_JSET: if (!is_reg_const(reg2, is_jmp32)) From patchwork Tue Dec 19 13:47:58 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Menglong Dong X-Patchwork-Id: 756287 Received: from mail-pg1-f193.google.com (mail-pg1-f193.google.com [209.85.215.193]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2A5ED1B297; Tue, 19 Dec 2023 13:50:47 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="Q2rgLoyi" Received: by mail-pg1-f193.google.com with SMTP id 41be03b00d2f7-5ca1b4809b5so1461400a12.3; Tue, 19 Dec 2023 05:50:47 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1702993847; x=1703598647; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=Z7mA8MymjOnfLLN21jKPyYTlZV26MOBWF1PlZH9/rQM=; b=Q2rgLoyiy5Awat4HvtATMZhMvSpXXwjtjnNHz9/6UE6Bq4KvDw0rUkfxf5920jRV07 vbDT+MXCVyO4kNJGhdBYpyyjUMoqNzGTR/neOPoWF4vvg5EFaT1AeoRYh8PHD50JTVCY G8IPDdekE8L3axJZbzIBHjlE8nGYE4CccQ/LGg2SMky2Oj5u9948IMCbEFrsGxqAVJew CTCxjYemGw6yC8Pu3oshRQCthWcv+sZyo25s8bJlyZ8mCD4pQMtAa3wYwAZ75zRm2qyX LCUUdK51JaZfGKw18ImLLYmPwCS+fqzq0kzp+b16VxVF5ey//7CXnSUm8mxrs0D1wj3b quwA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1702993847; x=1703598647; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=Z7mA8MymjOnfLLN21jKPyYTlZV26MOBWF1PlZH9/rQM=; b=ABv8f0MLIeTAAaqp4h7CjJjnznLVWSm+Ico55EyhxvZIcMBXbsiuR75Ble/jaBZq9l F7EYCsTnAJrfJr2YhAtNAPLwbAH3TvNruYg0zc/fnf3nlZ0Tv4cjsnJAlRL7qnFgeMZt DITVX0CnFNQuFrUngJALRW7Xe0uOcJJSVsr1Nuzovf8CYW9Q3ObCPZ4Bl5SUGG8K5Trd C1ueMcV8qjEWA304WXdha+OASE8DYMR8pkR/55Tj7O85T0S7IFxfyPa3zqgm+CmNrrJZ 7tjnXr1jUVV69kfJqAsvclOSZBZQj42HSdM+VZ5IUN/VadTs8gFiuZN2XAiM28YCO3HR HKvg== X-Gm-Message-State: AOJu0YwxSOdxN0BYJW1S+isilJaKA61mISOnVTVUNsf/vvVZPpoO8srQ Redg598uHpyr3hPoTjIvJLk= X-Google-Smtp-Source: AGHT+IGHPIIKUI8Yhg8rr/cCt80nFAeuyks61zvvkfTfX9LSHq5MgdhqFMasfsrpp1iWrAMqly+mkw== X-Received: by 2002:a05:6a20:7287:b0:187:703a:8658 with SMTP id o7-20020a056a20728700b00187703a8658mr9178168pzk.59.1702993847323; Tue, 19 Dec 2023 05:50:47 -0800 (PST) Received: from localhost.localdomain ([43.129.244.20]) by smtp.gmail.com with ESMTPSA id d17-20020a056a00245100b006cddecbf432sm20695264pfj.96.2023.12.19.05.50.43 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 19 Dec 2023 05:50:47 -0800 (PST) From: Menglong Dong To: andrii@kernel.org, eddyz87@gmail.com, yonghong.song@linux.dev, alexei.starovoitov@gmail.com Cc: ast@kernel.org, daniel@iogearbox.net, john.fastabend@gmail.com, martin.lau@linux.dev, song@kernel.org, kpsingh@kernel.org, sdf@google.com, haoluo@google.com, jolsa@kernel.org, mykolal@fb.com, shuah@kernel.org, menglong8.dong@gmail.com, bpf@vger.kernel.org, linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org Subject: [PATCH bpf-next v5 2/4] selftests/bpf: remove reduplicated s32 casting in "crafted_cases" Date: Tue, 19 Dec 2023 21:47:58 +0800 Message-Id: <20231219134800.1550388-3-menglong8.dong@gmail.com> X-Mailer: git-send-email 2.39.2 In-Reply-To: <20231219134800.1550388-1-menglong8.dong@gmail.com> References: <20231219134800.1550388-1-menglong8.dong@gmail.com> Precedence: bulk X-Mailing-List: linux-kselftest@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 The "S32_MIN" is already defined with s32 casting, so there is no need to do it again. Signed-off-by: Menglong Dong Acked-by: Andrii Nakryiko --- tools/testing/selftests/bpf/prog_tests/reg_bounds.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/tools/testing/selftests/bpf/prog_tests/reg_bounds.c b/tools/testing/selftests/bpf/prog_tests/reg_bounds.c index 0c9abd279e18..3bf4ddd720a8 100644 --- a/tools/testing/selftests/bpf/prog_tests/reg_bounds.c +++ b/tools/testing/selftests/bpf/prog_tests/reg_bounds.c @@ -2097,10 +2097,10 @@ static struct subtest_case crafted_cases[] = { {U32, S32, {0, U32_MAX}, {U32_MAX, U32_MAX}}, - {S32, U64, {(u32)(s32)S32_MIN, (u32)(s32)S32_MIN}, {(u32)(s32)-255, 0}}, - {S32, S64, {(u32)(s32)S32_MIN, (u32)(s32)-255}, {(u32)(s32)-2, 0}}, - {S32, S64, {0, 1}, {(u32)(s32)S32_MIN, (u32)(s32)S32_MIN}}, - {S32, U32, {(u32)(s32)S32_MIN, (u32)(s32)S32_MIN}, {(u32)(s32)S32_MIN, (u32)(s32)S32_MIN}}, + {S32, U64, {(u32)S32_MIN, (u32)S32_MIN}, {(u32)(s32)-255, 0}}, + {S32, S64, {(u32)S32_MIN, (u32)(s32)-255}, {(u32)(s32)-2, 0}}, + {S32, S64, {0, 1}, {(u32)S32_MIN, (u32)S32_MIN}}, + {S32, U32, {(u32)S32_MIN, (u32)S32_MIN}, {(u32)S32_MIN, (u32)S32_MIN}}, }; /* Go over crafted hard-coded cases. This is fast, so we do it as part of From patchwork Tue Dec 19 13:47:59 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Menglong Dong X-Patchwork-Id: 756695 Received: from mail-pf1-f193.google.com (mail-pf1-f193.google.com [209.85.210.193]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A88ED1BDF4; Tue, 19 Dec 2023 13:50:52 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="RI7sX6aA" Received: by mail-pf1-f193.google.com with SMTP id d2e1a72fcca58-6d93278bfbeso457388b3a.3; Tue, 19 Dec 2023 05:50:52 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1702993852; x=1703598652; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=xq1f1jBr4XkUyEUcj8yDFOYNMksjfFLPe3NKskOFWQA=; b=RI7sX6aArHRjZH77NdZumcIPQBo4sn9YK/QYORvTzLgn2BqVc4qb9iRbUq5SLt2iL1 Z6SKWLaEubFiLyZY7/0oSAknmctNdD03r+IJJJTMO264UkXd1OVNZ6R5D8gb3yEQV4dv wJBi/vHtA/2xcbNoj5MeDyTvE7z9ozICkLP9/fkrtTJ0uKXA8ld+4MEN6otKMUH+CiI1 E34SbF2RoWoONuKxozTxAHzgMZWF5Ru7PvcrCEF/DrGatyWmHuPFVeSrrMpkUPyhkOg/ Y2fee7e7h8BEzWfvZvblrU+L65/cNjc418Xuo9VGd5aAxFTbSIkGZ7+IlxqlZEwVrUgx 11iQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1702993852; x=1703598652; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=xq1f1jBr4XkUyEUcj8yDFOYNMksjfFLPe3NKskOFWQA=; b=Toqr9jHRobYhfjEma2GXVk0OVwZ+UvqAuNCt5HUYzpOLuNlUI/uwsJuEg/I0XYcr4h CbxP8bjjPwHVgSiZdi5Q/EnxfqHVEZxAo7WCTBs8ckDUMV3bF/UxmCZ0Ssmle1gmirta hneU8O+8XMGxq1awXLuvjKxZgXFjr3b6/HD1rH0SAmXkHzNJCTFmB4Vbg6rgpMmje8za rhbFvUX4YJeqTJwfVVat4Sy1ig/L3yVDto0KL8Pp1agwLG73P1StzeCdFyVaLGoVI6p1 RWnr+cXDdM3bavw9Wfnk4zx/e2uxz84tCk0emwOmCE/ChSFSkQwxJyPOlC9Cv06UkUDr sY7g== X-Gm-Message-State: AOJu0YzlT2RJoIdHFuT5YbiYpCIsY+Tz2YoHOBBY/iCB45wQ5i+uW8nq bljAEbU2vHaqCwi/v6i4mHU= X-Google-Smtp-Source: AGHT+IFXUWRj9t/MbZUpJFBlRR3CykUJVbDUmllPXTpoY8VdVe8ynDBEYHT/rOywdbigHM8GB8DOqQ== X-Received: by 2002:a05:6a00:2712:b0:6d3:fe2d:e37b with SMTP id x18-20020a056a00271200b006d3fe2de37bmr2129372pfv.10.1702993851870; Tue, 19 Dec 2023 05:50:51 -0800 (PST) Received: from localhost.localdomain ([43.129.244.20]) by smtp.gmail.com with ESMTPSA id d17-20020a056a00245100b006cddecbf432sm20695264pfj.96.2023.12.19.05.50.47 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 19 Dec 2023 05:50:51 -0800 (PST) From: Menglong Dong To: andrii@kernel.org, eddyz87@gmail.com, yonghong.song@linux.dev, alexei.starovoitov@gmail.com Cc: ast@kernel.org, daniel@iogearbox.net, john.fastabend@gmail.com, martin.lau@linux.dev, song@kernel.org, kpsingh@kernel.org, sdf@google.com, haoluo@google.com, jolsa@kernel.org, mykolal@fb.com, shuah@kernel.org, menglong8.dong@gmail.com, bpf@vger.kernel.org, linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org Subject: [PATCH bpf-next v5 3/4] selftests/bpf: activate the OP_NE logic in range_cond() Date: Tue, 19 Dec 2023 21:47:59 +0800 Message-Id: <20231219134800.1550388-4-menglong8.dong@gmail.com> X-Mailer: git-send-email 2.39.2 In-Reply-To: <20231219134800.1550388-1-menglong8.dong@gmail.com> References: <20231219134800.1550388-1-menglong8.dong@gmail.com> Precedence: bulk X-Mailing-List: linux-kselftest@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 The edge range checking for the registers is supported by the verifier now, so we can activate the extended logic in tools/testing/selftests/bpf/prog_tests/reg_bounds.c/range_cond() to test such logic. Besides, I added some cases to the "crafted_cases" array for this logic. These cases are mainly used to test the edge of the src reg and dst reg. All reg bounds testings has passed in the SLOW_TESTS mode: $ export SLOW_TESTS=1 && ./test_progs -t reg_bounds -j Summary: 65/18959832 PASSED, 0 SKIPPED, 0 FAILED Signed-off-by: Menglong Dong --- v5: - add "{U32, U32, {0, U32_MAX}, {U32_MAX, U32_MAX}}" v4: - remove reduplicated s32 casting v3: - do some adjustment to the crafted cases that we added v2: - add some cases to the "crafted_cases" --- .../selftests/bpf/prog_tests/reg_bounds.c | 19 +++++++++++++------ 1 file changed, 13 insertions(+), 6 deletions(-) diff --git a/tools/testing/selftests/bpf/prog_tests/reg_bounds.c b/tools/testing/selftests/bpf/prog_tests/reg_bounds.c index 3bf4ddd720a8..820d0bcfc474 100644 --- a/tools/testing/selftests/bpf/prog_tests/reg_bounds.c +++ b/tools/testing/selftests/bpf/prog_tests/reg_bounds.c @@ -590,12 +590,7 @@ static void range_cond(enum num_t t, struct range x, struct range y, *newy = range(t, max_t(t, x.a, y.a), min_t(t, x.b, y.b)); break; case OP_NE: - /* generic case, can't derive more information */ - *newx = range(t, x.a, x.b); - *newy = range(t, y.a, y.b); - break; - - /* below extended logic is not supported by verifier just yet */ + /* below logic is supported by the verifier now */ if (x.a == x.b && x.a == y.a) { /* X is a constant matching left side of Y */ *newx = range(t, x.a, x.b); @@ -2101,6 +2096,18 @@ static struct subtest_case crafted_cases[] = { {S32, S64, {(u32)S32_MIN, (u32)(s32)-255}, {(u32)(s32)-2, 0}}, {S32, S64, {0, 1}, {(u32)S32_MIN, (u32)S32_MIN}}, {S32, U32, {(u32)S32_MIN, (u32)S32_MIN}, {(u32)S32_MIN, (u32)S32_MIN}}, + + /* edge overlap testings for BPF_NE */ + {U64, U64, {0, U64_MAX}, {U64_MAX, U64_MAX}}, + {U64, U64, {0, U64_MAX}, {0, 0}}, + {S64, U64, {S64_MIN, 0}, {S64_MIN, S64_MIN}}, + {S64, U64, {S64_MIN, 0}, {0, 0}}, + {S64, U64, {S64_MIN, S64_MAX}, {S64_MAX, S64_MAX}}, + {U32, U32, {0, U32_MAX}, {0, 0}}, + {U32, U32, {0, U32_MAX}, {U32_MAX, U32_MAX}}, + {S32, U32, {(u32)S32_MIN, 0}, {0, 0}}, + {S32, U32, {(u32)S32_MIN, 0}, {(u32)S32_MIN, (u32)S32_MIN}}, + {S32, U32, {(u32)S32_MIN, S32_MAX}, {S32_MAX, S32_MAX}}, }; /* Go over crafted hard-coded cases. This is fast, so we do it as part of From patchwork Tue Dec 19 13:48:00 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Menglong Dong X-Patchwork-Id: 756286 Received: from mail-pf1-f196.google.com (mail-pf1-f196.google.com [209.85.210.196]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 36D731C2B2; Tue, 19 Dec 2023 13:50:57 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="J23keRt2" Received: by mail-pf1-f196.google.com with SMTP id d2e1a72fcca58-6d93d15db24so248426b3a.0; Tue, 19 Dec 2023 05:50:57 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1702993856; x=1703598656; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=WYz67IsFZfue1NP3JExLN1mOy5YJ/ePcLatZPz8TkS8=; b=J23keRt2Kn+EGTs2WIr+QcttBiZqKx1gltE9odV+0frRXL4OlM12MMA6HRg1irXE+H ElopFSa0lGx1NHRnVFYOdvhJxUWe9iMIbzu2s4AKxkUr40qt04GfHD/sxi2hN22tI8m+ 8eb95I9hxdmqr+Pc192CLxR1XN5F/T/i8uav64cilhLG2sT1DLR2LxzLWarUQl661t7k +M9AtfDmvS0k51mxTCtY9fwNdPMGmBJDYfmTk3EB7gDiv8xhu8fP++Cjkm69n6/tS6kZ JhgFQkrMDw+joI1zFpuyKIGJvrlnwVwC+6cV/SKysw9o/SD7vl4eqF83xX5PUf166SU+ J8hA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1702993856; x=1703598656; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=WYz67IsFZfue1NP3JExLN1mOy5YJ/ePcLatZPz8TkS8=; b=dyBN7TNRYKgwRIsTKId1B08YPc5mCpNEaqq8AJuMsOWoa83g73j/hX1tz1hy0OwKPY csS4VAtShnafN8FswS9BWwvZjj6pUo0RdiVG1fpK5+x08c4hopgxbtye5O8gUE2mQN6M c3tkRMvIEyKodnNcy4T98aLCznMQ48Jt/h02+XRvBqTgxUlZNeQPKAXzeVJT0VE4Pbks 5YuGcQthFpIBkeSBwgr8D+NvJVZIlIwaWmUT3SdFN97o3Q78OHIsDBONw2uUnDCXmqO4 q6xvqF7Yloa0M5B7tBVahOmTWwPGlcwNfs7WTewf1hjaFJGwi3CWDbCPIHlYiQCcIPxx Uttw== X-Gm-Message-State: AOJu0Yz4kEDpACoTUlixQml5CjHgUyTBhnA3uil5j/YRDHA4+qZ/MU0x KkhJUDuwTohGGgpWbEC1VaI= X-Google-Smtp-Source: AGHT+IGqYjdAsBO/QZE/Idvn9u+0mC5C5Cl7Crbzazs43pTYyoQ8quPa/0+0RSBS1+rC17ZIbYm5Pw== X-Received: by 2002:a05:6a20:42a6:b0:18f:97c:8a1c with SMTP id o38-20020a056a2042a600b0018f097c8a1cmr25153568pzj.71.1702993856543; Tue, 19 Dec 2023 05:50:56 -0800 (PST) Received: from localhost.localdomain ([43.129.244.20]) by smtp.gmail.com with ESMTPSA id d17-20020a056a00245100b006cddecbf432sm20695264pfj.96.2023.12.19.05.50.52 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 19 Dec 2023 05:50:56 -0800 (PST) From: Menglong Dong To: andrii@kernel.org, eddyz87@gmail.com, yonghong.song@linux.dev, alexei.starovoitov@gmail.com Cc: ast@kernel.org, daniel@iogearbox.net, john.fastabend@gmail.com, martin.lau@linux.dev, song@kernel.org, kpsingh@kernel.org, sdf@google.com, haoluo@google.com, jolsa@kernel.org, mykolal@fb.com, shuah@kernel.org, menglong8.dong@gmail.com, bpf@vger.kernel.org, linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org Subject: [PATCH bpf-next v5 4/4] selftests/bpf: add testcase to verifier_bounds.c for BPF_JNE Date: Tue, 19 Dec 2023 21:48:00 +0800 Message-Id: <20231219134800.1550388-5-menglong8.dong@gmail.com> X-Mailer: git-send-email 2.39.2 In-Reply-To: <20231219134800.1550388-1-menglong8.dong@gmail.com> References: <20231219134800.1550388-1-menglong8.dong@gmail.com> Precedence: bulk X-Mailing-List: linux-kselftest@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Add testcase for the logic that the verifier tracks the BPF_JNE for regs. The assembly function "reg_not_equal_const()" and "reg_equal_const" that we add is exactly converted from the following case: u32 a = bpf_get_prandom_u32(); u64 b = 0; a %= 8; /* the "a > 0" here will be optimized to "a != 0" */ if (a > 0) { /* now the range of a should be [1, 7] */ bpf_skb_store_bytes(skb, 0, &b, a, 0); } Signed-off-by: Menglong Dong Acked-by: Andrii Nakryiko --- v5: - add some comments to the function that we add - add reg_not_equal_const() --- .../selftests/bpf/progs/verifier_bounds.c | 62 +++++++++++++++++++ 1 file changed, 62 insertions(+) diff --git a/tools/testing/selftests/bpf/progs/verifier_bounds.c b/tools/testing/selftests/bpf/progs/verifier_bounds.c index ec430b71730b..960998f16306 100644 --- a/tools/testing/selftests/bpf/progs/verifier_bounds.c +++ b/tools/testing/selftests/bpf/progs/verifier_bounds.c @@ -1075,4 +1075,66 @@ l0_%=: r0 = 0; \ : __clobber_all); } +SEC("tc") +__description("bounds check with JMP_NE for reg edge") +__success __retval(0) +__naked void reg_not_equal_const(void) +{ + asm volatile (" \ + r6 = r1; \ + r1 = 0; \ + *(u64*)(r10 - 8) = r1; \ + call %[bpf_get_prandom_u32]; \ + r4 = r0; \ + r4 &= 7; \ + if r4 != 0 goto l0_%=; \ + r0 = 0; \ + exit; \ +l0_%=: r1 = r6; \ + r2 = 0; \ + r3 = r10; \ + r3 += -8; \ + r5 = 0; \ + /* The 4th argument of bpf_skb_store_bytes is defined as \ + * ARG_CONST_SIZE, so 0 is not allowed. The 'r4 != 0' \ + * is providing us this exclusion of zero from initial \ + * [0, 7] range. \ + */ \ + call %[bpf_skb_store_bytes]; \ + r0 = 0; \ + exit; \ +" : + : __imm(bpf_get_prandom_u32), + __imm(bpf_skb_store_bytes) + : __clobber_all); +} + +SEC("tc") +__description("bounds check with JMP_EQ for reg edge") +__success __retval(0) +__naked void reg_equal_const(void) +{ + asm volatile (" \ + r6 = r1; \ + r1 = 0; \ + *(u64*)(r10 - 8) = r1; \ + call %[bpf_get_prandom_u32]; \ + r4 = r0; \ + r4 &= 7; \ + if r4 == 0 goto l0_%=; \ + r1 = r6; \ + r2 = 0; \ + r3 = r10; \ + r3 += -8; \ + r5 = 0; \ + /* Just the same as what we do in reg_not_equal_const() */ \ + call %[bpf_skb_store_bytes]; \ +l0_%=: r0 = 0; \ + exit; \ +" : + : __imm(bpf_get_prandom_u32), + __imm(bpf_skb_store_bytes) + : __clobber_all); +} + char _license[] SEC("license") = "GPL";