From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Jean-Philippe Brucker <jean-philippe@linaro.org>,
John Fastabend <john.fastabend@gmail.com>,
Alexei Starovoitov <ast@kernel.org>,
Sasha Levin <sashal@kernel.org>,
linux-kselftest@vger.kernel.org, netdev@vger.kernel.org,
bpf@vger.kernel.org
Subject: [PATCH AUTOSEL 5.9 11/15] selftests/bpf: Fix array access with signed variable test
Date: Sat, 19 Dec 2020 22:34:29 -0500 [thread overview]
Message-ID: <20201220033434.2728348-11-sashal@kernel.org> (raw)
In-Reply-To: <20201220033434.2728348-1-sashal@kernel.org>
From: Jean-Philippe Brucker <jean-philippe@linaro.org>
[ Upstream commit 77ce220c0549dcc3db8226c61c60e83fc59dfafc ]
The test fails because of a recent fix to the verifier, even though this
program is valid. In details what happens is:
7: (61) r1 = *(u32 *)(r0 +0)
Load a 32-bit value, with signed bounds [S32_MIN, S32_MAX]. The bounds
of the 64-bit value are [0, U32_MAX]...
8: (65) if r1 s> 0xffffffff goto pc+1
... therefore this is always true (the operand is sign-extended).
10: (b4) w2 = 11
11: (6d) if r2 s> r1 goto pc+1
When true, the 64-bit bounds become [0, 10]. The 32-bit bounds are still
[S32_MIN, 10].
13: (64) w1 <<= 2
Because this is a 32-bit operation, the verifier propagates the new
32-bit bounds to the 64-bit ones, and the knowledge gained from insn 11
is lost.
14: (0f) r0 += r1
15: (7a) *(u64 *)(r0 +0) = 4
Then the verifier considers r0 unbounded here, rejecting the test. To
make the test work, change insn 8 to check the sign of the 32-bit value.
Signed-off-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
Acked-by: John Fastabend <john.fastabend@gmail.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/testing/selftests/bpf/verifier/array_access.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/tools/testing/selftests/bpf/verifier/array_access.c b/tools/testing/selftests/bpf/verifier/array_access.c
index 1c4b1939f5a8d..bed53b561e044 100644
--- a/tools/testing/selftests/bpf/verifier/array_access.c
+++ b/tools/testing/selftests/bpf/verifier/array_access.c
@@ -68,7 +68,7 @@
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
- BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 0xffffffff, 1),
+ BPF_JMP32_IMM(BPF_JSGT, BPF_REG_1, 0xffffffff, 1),
BPF_MOV32_IMM(BPF_REG_1, 0),
BPF_MOV32_IMM(BPF_REG_2, MAX_ENTRIES),
BPF_JMP_REG(BPF_JSGT, BPF_REG_2, BPF_REG_1, 1),
--
2.27.0
next prev parent reply other threads:[~2020-12-20 3:39 UTC|newest]
Thread overview: 15+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-12-20 3:34 [PATCH AUTOSEL 5.9 01/15] ARM: sunxi: Add machine match for the Allwinner V3 SoC Sasha Levin
2020-12-20 3:34 ` [PATCH AUTOSEL 5.9 02/15] pNFS/flexfiles: Fix array overflow when flexfiles mirroring is enabled Sasha Levin
2020-12-20 3:34 ` [PATCH AUTOSEL 5.9 03/15] cfg80211: initialize rekey_data Sasha Levin
2020-12-20 3:34 ` [PATCH AUTOSEL 5.9 04/15] ethernet: select CONFIG_CRC32 as needed Sasha Levin
2020-12-20 3:34 ` [PATCH AUTOSEL 5.9 05/15] [SECURITY] fix namespaced fscaps when !CONFIG_SECURITY Sasha Levin
2020-12-20 3:34 ` [PATCH AUTOSEL 5.9 06/15] lwt: Disable BH too in run_lwt_bpf() Sasha Levin
2020-12-20 3:34 ` [PATCH AUTOSEL 5.9 07/15] net: stmmac: increase the timeout for dma reset Sasha Levin
2020-12-20 3:34 ` [PATCH AUTOSEL 5.9 08/15] drm/amd/display: Prevent bandwidth overflow Sasha Levin
2020-12-20 3:34 ` [PATCH AUTOSEL 5.9 09/15] drm/amdkfd: Fix leak in dmabuf import Sasha Levin
2020-12-20 3:34 ` [PATCH AUTOSEL 5.9 10/15] Input: cros_ec_keyb - send 'scancodes' in addition to key events Sasha Levin
2020-12-20 3:34 ` Sasha Levin [this message]
2020-12-20 3:34 ` [PATCH AUTOSEL 5.9 12/15] selftests/bpf: Fix "dubious pointer arithmetic" test Sasha Levin
2020-12-20 3:34 ` [PATCH AUTOSEL 5.9 13/15] initramfs: fix clang build failure Sasha Levin
2020-12-20 3:34 ` [PATCH AUTOSEL 5.9 14/15] elfcore: fix building with clang Sasha Levin
2020-12-20 3:34 ` [PATCH AUTOSEL 5.9 15/15] Input: goodix - add upside-down quirk for Teclast X98 Pro tablet Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20201220033434.2728348-11-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=jean-philippe@linaro.org \
--cc=john.fastabend@gmail.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-kselftest@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
Powered by JetHome