From patchwork Mon May 18 20:02:33 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: John Fastabend X-Patchwork-Id: 1292773 X-Patchwork-Delegate: bpf@iogearbox.net Return-Path: X-Original-To: patchwork-incoming-netdev@ozlabs.org Delivered-To: patchwork-incoming-netdev@ozlabs.org Authentication-Results: ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org (client-ip=23.128.96.18; helo=vger.kernel.org; envelope-from=netdev-owner@vger.kernel.org; receiver=) Authentication-Results: ozlabs.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20161025 header.b=fTEKeNUQ; dkim-atps=neutral Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by ozlabs.org (Postfix) with ESMTP id 49QqgX33YWz9sT8 for ; Tue, 19 May 2020 06:02:48 +1000 (AEST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726595AbgERUCs (ORCPT ); Mon, 18 May 2020 16:02:48 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:53672 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726250AbgERUCr (ORCPT ); Mon, 18 May 2020 16:02:47 -0400 Received: from mail-io1-xd42.google.com (mail-io1-xd42.google.com [IPv6:2607:f8b0:4864:20::d42]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 56FB1C061A0C; Mon, 18 May 2020 13:02:47 -0700 (PDT) Received: by mail-io1-xd42.google.com with SMTP id h10so12029982iob.10; Mon, 18 May 2020 13:02:47 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=subject:from:to:cc:date:message-id:in-reply-to:references :user-agent:mime-version:content-transfer-encoding; bh=mtWZlrGOIDYWU5A0cqRih5f0ht2YzMcHfkailvCxd6U=; b=fTEKeNUQ8qD2Z7cdhLlA1rOETQWrxhTWvRU59ct+Xe4kaXo4bNkkWVg9nkEwY/sX4q Y2D4/N+g7QL1bhVb/tfjHZM3mheRSr1XBvo2HBem1q7hihdDyz77OlM4eNbUkjAInblQ wWKrmIERZYaLik9FnjXHBgLMoQHghO42ycptgbjp361jtoGNuIr2djutlPVm9pXVsgd/ /vBUpm97d7a8PZZhd6lGse5qkJvUUPYypk40adcDuR5IHIkTOm5YOFC+8skEMoqP5TLI pp/RYiDVeRv7PcGyfOelVhP89Os5I+WMUKw3ZjnQXcjzDju0yRsaf9kbYsNxR7TiuKeI eUBA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:from:to:cc:date:message-id:in-reply-to :references:user-agent:mime-version:content-transfer-encoding; bh=mtWZlrGOIDYWU5A0cqRih5f0ht2YzMcHfkailvCxd6U=; b=LvsVHwzLzzi0YUhWlN0Q1nxSyG5B8TJpcWWOxJykwWUgsu7oOm8Y6GR02didczO2p9 aYBIwNHK+znZ5H6yqu2eRV8nEsCGTPDT3vIzT7ISUsB0oU68eyXspq44AjrEOlyNtlvq +2jtqPfIdguhptWJNYvuKjanAmlODydssUMpuqoY6jKENfkT9vCiPPs41QQjMKBygvZ8 65biBZ2JB3g4xN8dmeH51Ki3zRQbjRI7lFfPZB/pkcjLHFseic/M7zfvIo7Aq/pKKKxB 1P+t2fp2jd8q+3LuLjEYKPGQ1qy6dxzFbUu+jb3LIe4gMK3wCp17xPCrrzGkWACwP6yI OaMw== X-Gm-Message-State: AOAM531sFUuq+7OEtxE/GJuydSSR/0hJ7h78XvaeTePt3sz9JtnRIbnu JICQNzB+nehaUJ7vmBegNKhBnCNr X-Google-Smtp-Source: ABdhPJy1tTZe/E3vKovr5P4VIYcB1PKsokIVsN58nsPwCljOK8+kk9a9wQVtv5D33GbHmm4cjwdlIQ== X-Received: by 2002:a05:6638:45d:: with SMTP id r29mr16451933jap.93.1589832166377; Mon, 18 May 2020 13:02:46 -0700 (PDT) Received: from [127.0.1.1] ([184.63.162.180]) by smtp.gmail.com with ESMTPSA id a13sm4232762ioa.42.2020.05.18.13.02.40 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Mon, 18 May 2020 13:02:45 -0700 (PDT) Subject: [bpf-next PATCH 1/4] bpf: verifier track null pointer branch_taken with JNE and JEQ From: John Fastabend To: ast@kernel.org, daniel@iogearbox.net Cc: netdev@vger.kernel.org, bpf@vger.kernel.org, john.fastabend@gmail.com Date: Mon, 18 May 2020 13:02:33 -0700 Message-ID: <158983215367.6512.2773569595786906135.stgit@john-Precision-5820-Tower> In-Reply-To: <158983199930.6512.18408887419883363781.stgit@john-Precision-5820-Tower> References: <158983199930.6512.18408887419883363781.stgit@john-Precision-5820-Tower> User-Agent: StGit/0.17.1-dirty MIME-Version: 1.0 Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org Current verifier when considering which branch may be taken on a conditional test with pointer returns -1 meaning either branch may be taken. But, we track if pointers can be NULL by using dedicated types for valid pointers (pointers that can not be NULL). For example, we have PTR_TO_SOCK and PTR_TO_SOCK_OR_NULL to indicate a pointer that is valid or not, PTR_TO_SOCK being the validated pointer type. We can then use this extra information when we encounter null tests against pointers. Consider, if (sk_ptr == NULL) ... else ... if the sk_ptr has type PTR_TO_SOCK we know the null check will fail and the null branch can not be taken. In this patch we extend is_branch_taken to consider this extra information and to return only the branch that will be taken. This resolves a verifier issue reported with this C code, sk = bpf_sk_lookup_tcp(skb, tuple, tuple_len, BPF_F_CURRENT_NETNS, 0); bpf_printk("sk=%d\n", sk ? 1 : 0); if (sk) bpf_sk_release(sk); return sk ? TC_ACT_OK : TC_ACT_UNSPEC; The generated asm then looks like this, 43: (85) call bpf_sk_lookup_tcp#84 44: (bf) r6 = r0 <- do the lookup and put result in r6 ... <- do some more work 51: (55) if r6 != 0x0 goto pc+1 <- test sk ptr for printk use ... 56: (85) call bpf_trace_printk#6 ... 61: (15) if r6 == 0x0 goto pc+1 <- do the if (sk) test from C code 62: (b7) r0 = 0 <- skip release because both branches are taken in verifier 63: (95) exit Unreleased reference id=3 alloc_insn=43 In the verifier path the flow is, 51 -> 53 ... 61 -> 62 Because at 51->53 jmp verifier promoted reg6 from type PTR_TO_SOCK_OR_NULL to PTR_TO_SOCK but then at 62 we still test both paths ignoring that we already promoted the type. So we incorrectly conclude an unreleased reference. To fix this we add logic in is_branch_taken to test the OR_NULL portion of the type and if its not possible for a pointer to be NULL we can prune the branch taken where 'r6 == 0x0'. After the above additional logic is added the C code above passes as expected. This makes the assumption that all pointer types PTR_TO_* that can be null have an equivalent type PTR_TO_*_OR_NULL logic. Suggested-by: Alexei Starovoitov Reported-by: Andrey Ignatov Signed-off-by: John Fastabend --- 0 files changed diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index 180933f..8f576e2 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -393,6 +393,14 @@ static bool type_is_sk_pointer(enum bpf_reg_type type) type == PTR_TO_XDP_SOCK; } +static bool reg_type_not_null(enum bpf_reg_type type) +{ + return type == PTR_TO_SOCKET || + type == PTR_TO_TCP_SOCK || + type == PTR_TO_MAP_VALUE || + type == PTR_TO_SOCK_COMMON; +} + static bool reg_type_may_be_null(enum bpf_reg_type type) { return type == PTR_TO_MAP_VALUE_OR_NULL || @@ -1970,8 +1978,9 @@ static int __mark_chain_precision(struct bpf_verifier_env *env, int regno, if (regno >= 0) { reg = &func->regs[regno]; if (reg->type != SCALAR_VALUE) { - WARN_ONCE(1, "backtracing misuse"); - return -EFAULT; + if (unlikely(!reg_type_not_null(reg->type))) + WARN_ONCE(1, "backtracing misuse"); + return 0; } if (!reg->precise) new_marks = true; @@ -6306,8 +6315,26 @@ static int is_branch64_taken(struct bpf_reg_state *reg, u64 val, u8 opcode) static int is_branch_taken(struct bpf_reg_state *reg, u64 val, u8 opcode, bool is_jmp32) { - if (__is_pointer_value(false, reg)) - return -1; + if (__is_pointer_value(false, reg)) { + if (!reg_type_not_null(reg->type)) + return -1; + + /* If pointer is valid tests against zero will fail so we can + * use this to direct branch taken. + */ + switch (opcode) { + case BPF_JEQ: + if (val == 0) + return 0; + return 1; + case BPF_JNE: + if (val == 0) + return 1; + return 0; + default: + return -1; + } + } if (is_jmp32) return is_branch32_taken(reg, val, opcode); From patchwork Mon May 18 20:02:52 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: John Fastabend X-Patchwork-Id: 1292775 X-Patchwork-Delegate: bpf@iogearbox.net Return-Path: X-Original-To: incoming-bpf@patchwork.ozlabs.org Delivered-To: patchwork-incoming-bpf@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org (client-ip=23.128.96.18; helo=vger.kernel.org; envelope-from=bpf-owner@vger.kernel.org; receiver=) Authentication-Results: ozlabs.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20161025 header.b=Y61lJUBm; dkim-atps=neutral Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by ozlabs.org (Postfix) with ESMTP id 49Qqgv2phcz9sT6 for ; Tue, 19 May 2020 06:03:07 +1000 (AEST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726276AbgERUDH (ORCPT ); Mon, 18 May 2020 16:03:07 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:53724 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726250AbgERUDG (ORCPT ); Mon, 18 May 2020 16:03:06 -0400 Received: from mail-il1-x142.google.com (mail-il1-x142.google.com [IPv6:2607:f8b0:4864:20::142]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 9183DC061A0C; Mon, 18 May 2020 13:03:06 -0700 (PDT) Received: by mail-il1-x142.google.com with SMTP id c20so9000896ilk.6; Mon, 18 May 2020 13:03:06 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=subject:from:to:cc:date:message-id:in-reply-to:references :user-agent:mime-version:content-transfer-encoding; bh=hGopJ23Awe8jxA58mwcFFf07exvBHSCVePFTn+MGlQQ=; b=Y61lJUBmeumknlNq+e891qmunLIGNScJ8uK218PAslIp7gr7/zt/YsCop/t94uow6j 2PjB774TQw4Q6MUB3pvDfpSO0v1mdUD+i5cmh/Yh0CE4LCzNSOQBrT/FLJ1ZlWd/y8Ta yZZp14DzGJ2PrIEtl2aEl0oqktBkb6TmEgkQIOYM3r1wLFFLNOSmDc0IK4oclCu7CtPK BYxGZffhDNcyS3Wf91C0ISdXdrUQyES2LFk6wNWyCzW2bPpaHEF1ClTAhR9zC3eWXCgu 1UcY6R0pe0ZYb+vMJrBLDlQ7E4Ri2KC0wTIAuW9zFwVm1hxlFptaQmB9WrqpzlEsaZN0 EWig== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:from:to:cc:date:message-id:in-reply-to :references:user-agent:mime-version:content-transfer-encoding; bh=hGopJ23Awe8jxA58mwcFFf07exvBHSCVePFTn+MGlQQ=; b=bTSOqqsQ2HHrByhLe3XW6/N9tUy78mNi721Tua3nlxubxY0HcdVhVyAAHIpg/s9I67 Rh9WJCY4ptq2Pw+3BRtoEaJkihnyN0dptEd/dZ0Oy0GtzV26pt0hUO8RjAcKwL7pCk5p OW6RubjN2CR9aiu21P2v+3WyXv/5zO0nmoC3U6T7KIjGp9dz6LclHIdg0Q6m+8TknzEb EB3oBgWh3cAdJa2gyPjB1OqXmmpO58Ovzv117RH6ii3H13tBYl5DccZd+cTE7ZSOgTDj 0/FT0+Ban0EQFlzDkvD8hjpQ8HIGkGFM7Y07ERpj0JTfcs5RJqKEnRDI7mh1yvQ8jB0h 4zVA== X-Gm-Message-State: AOAM532TrifGaMmq2es64XY0XrWTt/IatVOg3Ru42SQ7FwA6+u1Rog4f eR1MT+wadD/MB8MOO5O861Ph6IcG X-Google-Smtp-Source: ABdhPJyfalBY6xuYwLp0myvWtGzvIc2Han1BgetJDOYK6K3p7slHWsx8d6RymXcamnMwD8W+NMM4fA== X-Received: by 2002:a92:3cd0:: with SMTP id j77mr19117788ilf.112.1589832185727; Mon, 18 May 2020 13:03:05 -0700 (PDT) Received: from [127.0.1.1] ([184.63.162.180]) by smtp.gmail.com with ESMTPSA id o17sm5129335ilo.75.2020.05.18.13.02.59 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Mon, 18 May 2020 13:03:05 -0700 (PDT) Subject: [bpf-next PATCH 2/4] bpf: selftests, verifier case for non null pointer check branch taken From: John Fastabend To: ast@kernel.org, daniel@iogearbox.net Cc: netdev@vger.kernel.org, bpf@vger.kernel.org, john.fastabend@gmail.com Date: Mon, 18 May 2020 13:02:52 -0700 Message-ID: <158983217236.6512.3045049444791726995.stgit@john-Precision-5820-Tower> In-Reply-To: <158983199930.6512.18408887419883363781.stgit@john-Precision-5820-Tower> References: <158983199930.6512.18408887419883363781.stgit@john-Precision-5820-Tower> User-Agent: StGit/0.17.1-dirty MIME-Version: 1.0 Sender: bpf-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: bpf@vger.kernel.org When we have pointer type that is known to be non-null we only follow the non-null branch. This adds tests to cover this case for reference tracking. Signed-off-by: John Fastabend --- .../testing/selftests/bpf/verifier/ref_tracking.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/tools/testing/selftests/bpf/verifier/ref_tracking.c b/tools/testing/selftests/bpf/verifier/ref_tracking.c index 604b461..d8f7c04 100644 --- a/tools/testing/selftests/bpf/verifier/ref_tracking.c +++ b/tools/testing/selftests/bpf/verifier/ref_tracking.c @@ -821,3 +821,19 @@ .result = REJECT, .errstr = "invalid mem access", }, +{ + "reference tracking: branch tracking valid pointer null comparison", + .insns = { + BPF_SK_LOOKUP(sk_lookup_tcp), + BPF_MOV64_REG(BPF_REG_6, BPF_REG_0), + BPF_MOV64_IMM(BPF_REG_3, 1), + BPF_JMP_IMM(BPF_JNE, BPF_REG_6, 0, 1), + BPF_MOV64_IMM(BPF_REG_3, 0), + BPF_JMP_IMM(BPF_JEQ, BPF_REG_6, 0, 2), + BPF_MOV64_REG(BPF_REG_1, BPF_REG_6), + BPF_EMIT_CALL(BPF_FUNC_sk_release), + BPF_EXIT_INSN(), + }, + .prog_type = BPF_PROG_TYPE_SCHED_CLS, + .result = ACCEPT, +}, From patchwork Mon May 18 20:03:11 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: John Fastabend X-Patchwork-Id: 1292777 X-Patchwork-Delegate: bpf@iogearbox.net Return-Path: X-Original-To: patchwork-incoming-netdev@ozlabs.org Delivered-To: patchwork-incoming-netdev@ozlabs.org Authentication-Results: ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org (client-ip=23.128.96.18; helo=vger.kernel.org; envelope-from=netdev-owner@vger.kernel.org; receiver=) Authentication-Results: ozlabs.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20161025 header.b=GiJIt1Y4; dkim-atps=neutral Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by ozlabs.org (Postfix) with ESMTP id 49QqhH2xXxz9sT8 for ; Tue, 19 May 2020 06:03:27 +1000 (AEST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726824AbgERUD0 (ORCPT ); Mon, 18 May 2020 16:03:26 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:53774 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726250AbgERUD0 (ORCPT ); Mon, 18 May 2020 16:03:26 -0400 Received: from mail-io1-xd41.google.com (mail-io1-xd41.google.com [IPv6:2607:f8b0:4864:20::d41]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 38A22C061A0C; Mon, 18 May 2020 13:03:26 -0700 (PDT) Received: by mail-io1-xd41.google.com with SMTP id k6so12088275iob.3; Mon, 18 May 2020 13:03:26 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=subject:from:to:cc:date:message-id:in-reply-to:references :user-agent:mime-version:content-transfer-encoding; bh=agQ+4wVRhoNV84CE8L8RDwfrGYoUTzWhBPUecoU6cFU=; b=GiJIt1Y4ZBzOrTL6Vk8tvGR2iPbK+qzTetK/qCOePrM+9cjRoToENU6WvCKPRndC+w U+gsIx/D+A5Mk1mXnhQ+CGgq4nI46Z4e2vi1RnfsFUPd6X7pM80a0DV6BD9Flyadzksy uxTUBubzem2D2B1/JsV8t5kvnyKsZP/CbZehIV2b4SItwexa3DNrzSkiCF1qPTwuf2hJ X52sOc5eFE8Gb/SsCQIGRWEBDKjmPXE/s8ghHgrDykJ3ES3QcMN5/oenEg712XRWDP5w OkXKRzE7PrUAqMIkSMAuwY+Ulk1Lj1qmjz2mizLizg5AH9sRnC1AkmimkfgueSny2egI CycQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:from:to:cc:date:message-id:in-reply-to :references:user-agent:mime-version:content-transfer-encoding; bh=agQ+4wVRhoNV84CE8L8RDwfrGYoUTzWhBPUecoU6cFU=; b=m4ZmBxztTrn5z1yLXzir2Wp2aBGc1rYy2+S0iSL0rfLdfp3EBurNWy5uT4cLHXgXTm xwle/VYGnVmgeC1QimUTnErprzKZPM/Wa6xp90f7HmyIIElU7fQTOvw2BRlMcqTjsOp+ 9AksJE7G7G+FuBLaKGeBD6hhnzxg8CUeJRT2do36OJCwrel1NxuHcDlGWeYFzShuRqWM kcbfq2AmeL7siYRmhLMGbmmDAD5ouft7yMKG3kX08biTskHcuRNJzX8FQq8RA7MXTvxN Kdkb5BoFgomFR0X6pZbtyuCdbSyfhoJrtAL/UyQhDuad4VzFvjN7O9Ot2FuyRJKvUwXY 54mQ== X-Gm-Message-State: AOAM533sbVv6195nTJt3d/gGG+UUrxsibgnxMLquzDTy7mUxc4QN2SqC P6uMQ+PlJiM/BzkqQBb7FCJngHjX X-Google-Smtp-Source: ABdhPJzQWbC+TghvxDozC9S7az+xajKIignd18z0rxgb1NKZHazGA1ZuZTSmaB6Fsp351oTuK/2aZw== X-Received: by 2002:a05:6602:1616:: with SMTP id x22mr14806513iow.70.1589832204397; Mon, 18 May 2020 13:03:24 -0700 (PDT) Received: from [127.0.1.1] ([184.63.162.180]) by smtp.gmail.com with ESMTPSA id j16sm5220029ild.8.2020.05.18.13.03.18 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Mon, 18 May 2020 13:03:23 -0700 (PDT) Subject: [bpf-next PATCH 3/4] bpf: selftests, verifier case for non null pointer map value branch From: John Fastabend To: ast@kernel.org, daniel@iogearbox.net Cc: netdev@vger.kernel.org, bpf@vger.kernel.org, john.fastabend@gmail.com Date: Mon, 18 May 2020 13:03:11 -0700 Message-ID: <158983219168.6512.11784750707821433806.stgit@john-Precision-5820-Tower> In-Reply-To: <158983199930.6512.18408887419883363781.stgit@john-Precision-5820-Tower> References: <158983199930.6512.18408887419883363781.stgit@john-Precision-5820-Tower> User-Agent: StGit/0.17.1-dirty MIME-Version: 1.0 Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org When we have pointer type that is known to be non-null we only follow the non-null branch. This adds tests to cover the map_value pointer returned from a map lookup. To force an error if both branches are followed we do an ALU op on R10. Signed-off-by: John Fastabend Acked-by: Andrii Nakryiko --- .../testing/selftests/bpf/verifier/value_or_null.c | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/tools/testing/selftests/bpf/verifier/value_or_null.c b/tools/testing/selftests/bpf/verifier/value_or_null.c index 860d4a7..3ecb70a 100644 --- a/tools/testing/selftests/bpf/verifier/value_or_null.c +++ b/tools/testing/selftests/bpf/verifier/value_or_null.c @@ -150,3 +150,22 @@ .result_unpriv = REJECT, .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, }, +{ + "map lookup and null branch prediction", + .insns = { + BPF_MOV64_IMM(BPF_REG_1, 10), + BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8), + BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), + BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8), + BPF_LD_MAP_FD(BPF_REG_1, 0), + BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem), + BPF_MOV64_REG(BPF_REG_6, BPF_REG_0), + BPF_JMP_IMM(BPF_JEQ, BPF_REG_6, 0, 2), + BPF_JMP_IMM(BPF_JNE, BPF_REG_6, 0, 1), + BPF_ALU64_IMM(BPF_ADD, BPF_REG_10, 10), + BPF_EXIT_INSN(), + }, + .fixup_map_hash_8b = { 4 }, + .prog_type = BPF_PROG_TYPE_SCHED_CLS, + .result = ACCEPT, +}, From patchwork Mon May 18 20:03:30 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: John Fastabend X-Patchwork-Id: 1292779 X-Patchwork-Delegate: bpf@iogearbox.net Return-Path: X-Original-To: patchwork-incoming-netdev@ozlabs.org Delivered-To: patchwork-incoming-netdev@ozlabs.org Authentication-Results: ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org (client-ip=23.128.96.18; helo=vger.kernel.org; envelope-from=netdev-owner@vger.kernel.org; receiver=) Authentication-Results: ozlabs.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20161025 header.b=T5Z6dfdd; dkim-atps=neutral Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by ozlabs.org (Postfix) with ESMTP id 49Qqhf3qwMz9sT6 for ; Tue, 19 May 2020 06:03:46 +1000 (AEST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726948AbgERUDp (ORCPT ); Mon, 18 May 2020 16:03:45 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:53822 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726250AbgERUDp (ORCPT ); Mon, 18 May 2020 16:03:45 -0400 Received: from mail-io1-xd43.google.com (mail-io1-xd43.google.com [IPv6:2607:f8b0:4864:20::d43]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id E4E33C061A0C; Mon, 18 May 2020 13:03:43 -0700 (PDT) Received: by mail-io1-xd43.google.com with SMTP id t15so5210543ios.4; Mon, 18 May 2020 13:03:43 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=subject:from:to:cc:date:message-id:in-reply-to:references :user-agent:mime-version:content-transfer-encoding; bh=N3rvqAX4uqzP8ZJYpHlcH0UIASMnlqmntD/M6QqshOc=; b=T5Z6dfddQv472Evjqb9BiRBnao7msU9//6vRnR/mkUtb7aIozt7nejWabjiPxy9Xnf db+7ZY59oU6fUuq5k7ICun9KrGI5f1S7u+d04VltIzZ2ZCliIFbzmJCFR+BmS/XqNWpB 9puUETlWIHJRfwM1X0QkBLH5js41XE6wWFiOvtx8cQJ/9bnloAFaZTrJ7tTn4OFLYN4K G+v4iGOnrOfFgmG22K7Fin9DINmua5XBlzpycbze+Y0Mm68OShjPfMdEVksSXXzlEPp8 pq3zUUPO0Meb4aMsGFxX0EXlKCQLMzuVJUJ3rUlrbbC1h+jeQTExfefuxYG2iauGi3Vo ISzw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:from:to:cc:date:message-id:in-reply-to :references:user-agent:mime-version:content-transfer-encoding; bh=N3rvqAX4uqzP8ZJYpHlcH0UIASMnlqmntD/M6QqshOc=; b=m8yV13TO3kqJXbEUaTQtamRIF6ZqTXY8q9ObmFm22QB/Mp4kTlh/dDM23ZhMk+lNPE rqN/V7uUnLn0DvzV5R6PC2QfC+2yaR9N+uCd6MRgVogAeGPJAYpTo9i91SgG7X59bxVz dDaB6Z0/mXfvvRGWOp+KwBLg+hISPyofIh7VgsEC27GGYvcQ9rBrXF5abvMrBFTAHNBk /bqYk2/Yq1gxjSVBxYkQbwhYLDItjrtJE7W+aa1KlqSTTKMAJe+SlSbIEDMyToyI6zOa pvEM5D0sLi/JULm9GfqTDhrNKNgSKjWDhBl58kC7Nc2WmhyRxMUT/1txNrmGmOIYf2bY +AxA== X-Gm-Message-State: AOAM531d5P9HnSOcUmudtPvlroq4/RPFStUSpCFziSqizeEXz4NIaj5I E+LqBYX7mpQnB2rYfxQlDuRYcE0X X-Google-Smtp-Source: ABdhPJzJ5tfoIJtDb/MHQ/a/ffjHIXXs6JRT/RFfBYrFNmcPgy7rbNA6zh34Y64h0fYZVqiqrolDPQ== X-Received: by 2002:a6b:6508:: with SMTP id z8mr15995597iob.130.1589832222983; Mon, 18 May 2020 13:03:42 -0700 (PDT) Received: from [127.0.1.1] ([184.63.162.180]) by smtp.gmail.com with ESMTPSA id c13sm5215475ilu.81.2020.05.18.13.03.37 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Mon, 18 May 2020 13:03:42 -0700 (PDT) Subject: [bpf-next PATCH 4/4] bpf: selftests, add printk to test_sk_lookup_kern to encode null ptr check From: John Fastabend To: ast@kernel.org, daniel@iogearbox.net Cc: netdev@vger.kernel.org, bpf@vger.kernel.org, john.fastabend@gmail.com Date: Mon, 18 May 2020 13:03:30 -0700 Message-ID: <158983221039.6512.6745842570405722925.stgit@john-Precision-5820-Tower> In-Reply-To: <158983199930.6512.18408887419883363781.stgit@john-Precision-5820-Tower> References: <158983199930.6512.18408887419883363781.stgit@john-Precision-5820-Tower> User-Agent: StGit/0.17.1-dirty MIME-Version: 1.0 Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org Adding a printk to test_sk_lookup_kern created the reported failure where a pointer type is checked twice for NULL. Lets add it to the progs test test_sk_lookup_kern.c so we test the case from C all the way into the verifier. We already have printk's in selftests so seems OK to add another one. Signed-off-by: John Fastabend Acked-by: Andrii Nakryiko --- .../selftests/bpf/progs/test_sk_lookup_kern.c | 1 + 1 file changed, 1 insertion(+) diff --git a/tools/testing/selftests/bpf/progs/test_sk_lookup_kern.c b/tools/testing/selftests/bpf/progs/test_sk_lookup_kern.c index d2b38fa..e83d0b4 100644 --- a/tools/testing/selftests/bpf/progs/test_sk_lookup_kern.c +++ b/tools/testing/selftests/bpf/progs/test_sk_lookup_kern.c @@ -73,6 +73,7 @@ int bpf_sk_lookup_test0(struct __sk_buff *skb) tuple_len = ipv4 ? sizeof(tuple->ipv4) : sizeof(tuple->ipv6); sk = bpf_sk_lookup_tcp(skb, tuple, tuple_len, BPF_F_CURRENT_NETNS, 0); + bpf_printk("sk=%d\n", sk ? 1 : 0); if (sk) bpf_sk_release(sk); return sk ? TC_ACT_OK : TC_ACT_UNSPEC;