|
Shung-Hsi Yu |
069e4c |
From: Martin KaFai Lau <kafai@fb.com>
|
|
Shung-Hsi Yu |
069e4c |
Date: Mon, 1 Nov 2021 23:45:41 -0700
|
|
Shung-Hsi Yu |
069e4c |
Subject: selftests/bpf: Verifier test on refill from a smaller spill
|
|
Shung-Hsi Yu |
069e4c |
Patch-mainline: v5.16-rc1
|
|
Shung-Hsi Yu |
069e4c |
Git-commit: c08455dec5acf4668f5d1eb099f7fedb29f2de5f
|
|
Shung-Hsi Yu |
529c95 |
References: jsc#PED-1377
|
|
Shung-Hsi Yu |
069e4c |
|
|
Shung-Hsi Yu |
069e4c |
This patch adds a verifier test to ensure the verifier can read 8 bytes
|
|
Shung-Hsi Yu |
069e4c |
from the stack after two 32bit write at fp-4 and fp-8. The test is similar
|
|
Shung-Hsi Yu |
069e4c |
to the reported case from bcc [0].
|
|
Shung-Hsi Yu |
069e4c |
|
|
Shung-Hsi Yu |
069e4c |
[0] https://github.com/iovisor/bcc/pull/3683
|
|
Shung-Hsi Yu |
069e4c |
|
|
Shung-Hsi Yu |
069e4c |
Signed-off-by: Martin KaFai Lau <kafai@fb.com>
|
|
Shung-Hsi Yu |
069e4c |
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
|
|
Shung-Hsi Yu |
069e4c |
Acked-by: Yonghong Song <yhs@fb.com>
|
|
Shung-Hsi Yu |
069e4c |
Link: https://lore.kernel.org/bpf/20211102064541.316414-1-kafai@fb.com
|
|
Shung-Hsi Yu |
069e4c |
Acked-by: Shung-Hsi Yu <shung-hsi.yu@suse.com>
|
|
Shung-Hsi Yu |
069e4c |
---
|
|
Shung-Hsi Yu |
069e4c |
tools/testing/selftests/bpf/verifier/spill_fill.c | 17 +++++++++++++++++
|
|
Shung-Hsi Yu |
069e4c |
1 file changed, 17 insertions(+)
|
|
Shung-Hsi Yu |
069e4c |
|
|
Shung-Hsi Yu |
069e4c |
--- a/tools/testing/selftests/bpf/verifier/spill_fill.c
|
|
Shung-Hsi Yu |
069e4c |
+++ b/tools/testing/selftests/bpf/verifier/spill_fill.c
|
|
Shung-Hsi Yu |
069e4c |
@@ -265,3 +265,20 @@
|
|
Shung-Hsi Yu |
069e4c |
.result = ACCEPT,
|
|
Shung-Hsi Yu |
069e4c |
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
|
Shung-Hsi Yu |
069e4c |
},
|
|
Shung-Hsi Yu |
069e4c |
+{
|
|
Shung-Hsi Yu |
069e4c |
+ "Spill a u32 scalar at fp-4 and then at fp-8",
|
|
Shung-Hsi Yu |
069e4c |
+ .insns = {
|
|
Shung-Hsi Yu |
069e4c |
+ /* r4 = 4321 */
|
|
Shung-Hsi Yu |
069e4c |
+ BPF_MOV32_IMM(BPF_REG_4, 4321),
|
|
Shung-Hsi Yu |
069e4c |
+ /* *(u32 *)(r10 -4) = r4 */
|
|
Shung-Hsi Yu |
069e4c |
+ BPF_STX_MEM(BPF_W, BPF_REG_10, BPF_REG_4, -4),
|
|
Shung-Hsi Yu |
069e4c |
+ /* *(u32 *)(r10 -8) = r4 */
|
|
Shung-Hsi Yu |
069e4c |
+ BPF_STX_MEM(BPF_W, BPF_REG_10, BPF_REG_4, -8),
|
|
Shung-Hsi Yu |
069e4c |
+ /* r4 = *(u64 *)(r10 -8) */
|
|
Shung-Hsi Yu |
069e4c |
+ BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_10, -8),
|
|
Shung-Hsi Yu |
069e4c |
+ BPF_MOV64_IMM(BPF_REG_0, 0),
|
|
Shung-Hsi Yu |
069e4c |
+ BPF_EXIT_INSN(),
|
|
Shung-Hsi Yu |
069e4c |
+ },
|
|
Shung-Hsi Yu |
069e4c |
+ .result = ACCEPT,
|
|
Shung-Hsi Yu |
069e4c |
+ .prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
|
Shung-Hsi Yu |
069e4c |
+},
|