selftests: bpf: Add tests for ARG_PTR_TO_LONG_OR_NULL

The new tests replicate the tests done for ARG_PTR_TO_LONG. There is a missing test for the "size < sizeof(long)" case, because I'm not sure I understand what this test is about and how to replicate it with bpf_sk_get_netns. An output of the tests: torvalds#508/p ARG_PTR_TO_LONG_OR_NULL uninitialized OK torvalds#509/p ARG_PTR_TO_LONG_OR_NULL half-uninitialized OK torvalds#510/p ARG_PTR_TO_LONG_OR_NULL misaligned OK torvalds#511/p ARG_PTR_TO_LONG_OR_NULL initialized OK torvalds#512/p ARG_PTR_TO_LONG_OR_NULL initialized to NULL OK Signed-off-by: Krzesimir Nowak <krzesimir@kinvolk.io>
kinvolk · Jul 11, 2019 · 853c617 · 853c617
1 parent 7f3fde3
commit 853c617
Showing 1 changed file with 129 additions and 0 deletions.
diff --git a/tools/testing/selftests/bpf/verifier/int_ptr.c b/tools/testing/selftests/bpf/verifier/int_ptr.c
@@ -158,3 +158,132 @@
 	.result = ACCEPT,
 	.prog_type = BPF_PROG_TYPE_CGROUP_SYSCTL,
 },
+{
+	"ARG_PTR_TO_LONG_OR_NULL uninitialized",
+	.insns = {
+		/* bpf_sk_get_netns arg1 (ctx) */
+		/* nothing to do */
+
+		/* bpf_sk_get_netns arg2 (dev) */
+		BPF_MOV64_REG(BPF_REG_7, BPF_REG_10),
+		BPF_ALU64_IMM(BPF_ADD, BPF_REG_7, -8),
+		BPF_MOV64_REG(BPF_REG_2, BPF_REG_7),
+
+		/* bpf_sk_get_netns arg3 (ino) */
+		BPF_ALU64_IMM(BPF_ADD, BPF_REG_7, -8),
+		BPF_MOV64_REG(BPF_REG_3, BPF_REG_7),
+
+		/* bpf_sk_get_netns() */
+		BPF_EMIT_CALL(BPF_FUNC_sk_get_netns),
+
+		BPF_MOV64_IMM(BPF_REG_0, 0),
+		BPF_EXIT_INSN(),
+	},
+	.result = REJECT,
+	.prog_type = BPF_PROG_TYPE_SOCK_OPS,
+	.errstr = "invalid indirect read from stack off -8+0 size 8",
+},
+{
+	"ARG_PTR_TO_LONG_OR_NULL half-uninitialized",
+	.insns = {
+		/* bpf_sk_get_netns arg1 (ctx) */
+		/* nothing to do */
+
+		/* bpf_sk_get_netns arg2 (dev) */
+		BPF_MOV64_REG(BPF_REG_7, BPF_REG_10),
+		BPF_ALU64_IMM(BPF_ADD, BPF_REG_7, -8),
+		BPF_ST_MEM(BPF_W, BPF_REG_7, 0, 42),
+		BPF_MOV64_REG(BPF_REG_2, BPF_REG_7),
+
+		/* bpf_sk_get_netns arg3 (ino) */
+		BPF_ALU64_IMM(BPF_ADD, BPF_REG_7, -8),
+		BPF_ST_MEM(BPF_W, BPF_REG_7, 4, 42),
+		BPF_MOV64_REG(BPF_REG_3, BPF_REG_7),
+
+		/* bpf_sk_get_netns() */
+		BPF_EMIT_CALL(BPF_FUNC_sk_get_netns),
+
+		BPF_MOV64_IMM(BPF_REG_0, 0),
+		BPF_EXIT_INSN(),
+	},
+	.result = REJECT,
+	.prog_type = BPF_PROG_TYPE_SOCK_OPS,
+	.errstr = "invalid indirect read from stack off -8+4 size 8",
+},
+{
+	"ARG_PTR_TO_LONG_OR_NULL misaligned",
+	.insns = {
+		/* bpf_sk_get_netns arg1 (ctx) */
+		/* nothing to do */
+
+		/* misalign */
+		BPF_MOV64_REG(BPF_REG_7, BPF_REG_10),
+		BPF_ALU64_IMM(BPF_ADD, BPF_REG_7, -4),
+
+		/* bpf_sk_get_netns arg2 (dev) */
+		BPF_ALU64_IMM(BPF_ADD, BPF_REG_7, -8),
+		BPF_ST_MEM(BPF_DW, BPF_REG_7, 0, 42),
+		BPF_MOV64_REG(BPF_REG_2, BPF_REG_7),
+
+		/* bpf_sk_get_netns arg3 (ino) */
+		BPF_ALU64_IMM(BPF_ADD, BPF_REG_7, -8),
+		BPF_ST_MEM(BPF_DW, BPF_REG_7, 0, 42),
+		BPF_MOV64_REG(BPF_REG_3, BPF_REG_7),
+
+		/* bpf_sk_get_netns() */
+		BPF_EMIT_CALL(BPF_FUNC_sk_get_netns),
+
+		BPF_MOV64_IMM(BPF_REG_0, 0),
+		BPF_EXIT_INSN(),
+	},
+	.result = REJECT,
+	.prog_type = BPF_PROG_TYPE_SOCK_OPS,
+	.errstr = "misaligned stack access off (0x0; 0x0)+-12+0 size 8",
+},
+{
+	"ARG_PTR_TO_LONG_OR_NULL initialized",
+	.insns = {
+		/* bpf_sk_get_netns arg1 (ctx) */
+		/* nothing to do */
+
+		/* bpf_sk_get_netns arg2 (dev) */
+		BPF_MOV64_REG(BPF_REG_7, BPF_REG_10),
+		BPF_ALU64_IMM(BPF_ADD, BPF_REG_7, -8),
+		BPF_ST_MEM(BPF_DW, BPF_REG_7, 0, 0),
+		BPF_MOV64_REG(BPF_REG_2, BPF_REG_7),
+
+		/* bpf_sk_get_netns arg3 (ino) */
+		BPF_ALU64_IMM(BPF_ADD, BPF_REG_7, -8),
+		BPF_ST_MEM(BPF_DW, BPF_REG_7, 0, 0),
+		BPF_MOV64_REG(BPF_REG_3, BPF_REG_7),
+
+		/* bpf_sk_get_netns() */
+		BPF_EMIT_CALL(BPF_FUNC_sk_get_netns),
+
+		BPF_MOV64_IMM(BPF_REG_0, 0),
+		BPF_EXIT_INSN(),
+	},
+	.result = ACCEPT,
+	.prog_type = BPF_PROG_TYPE_SOCK_OPS,
+},
+{
+	"ARG_PTR_TO_LONG_OR_NULL initialized to NULL",
+	.insns = {
+		/* bpf_sk_get_netns arg1 (ctx) */
+		/* nothing to do */
+
+		/* bpf_sk_get_netns arg2 (dev) */
+		BPF_MOV64_IMM(BPF_REG_2, 0),
+
+		/* bpf_sk_get_netns arg3 (ino) */
+		BPF_MOV64_IMM(BPF_REG_3, 0),
+
+		/* bpf_sk_get_netns() */
+		BPF_EMIT_CALL(BPF_FUNC_sk_get_netns),
+
+		BPF_MOV64_IMM(BPF_REG_0, 0),
+		BPF_EXIT_INSN(),
+	},
+	.result = ACCEPT,
+	.prog_type = BPF_PROG_TYPE_SOCK_OPS,
+},