This patch adds coverage for the warning detected by syzkaller and fixed
in the previous patch. Without the previous patch, this test fails with:
verifier bug: REG INVARIANTS VIOLATION (true_reg1): range bounds
violation u64=[0xffffffffffffff01, 0xffffffffffffff00]
s64=[0xffffffffffffff01, 0xffffffffffffff00]
u32=[0xffffff01, 0xffffff00] s32=[0xffffff00, 0xffffff00]
var_off=(0xffffffffffffff00, 0x0)
verifier bug: REG INVARIANTS VIOLATION (true_reg2): range bounds
violation u64=[0xffffffffffffff01, 0xffffffffffffff00]
s64=[0xffffffffffffff01, 0xffffffffffffff00]
u32=[0xffffff01, 0xffffff00] s32=[0xffffff01, 0xffffff00]
var_off=(0xffffffffffffff00, 0x0)
Signed-off-by: KaFai Wan <kafai.wan@linux.dev>
---
.../selftests/bpf/progs/verifier_bounds.c | 23 +++++++++++++++++++
1 file changed, 23 insertions(+)
diff --git a/tools/testing/selftests/bpf/progs/verifier_bounds.c b/tools/testing/selftests/bpf/progs/verifier_bounds.c
index 0a72e0228ea9..304ab5a07a3b 100644
--- a/tools/testing/selftests/bpf/progs/verifier_bounds.c
+++ b/tools/testing/selftests/bpf/progs/verifier_bounds.c
@@ -1550,6 +1550,29 @@ l0_%=: r0 = 0; \
: __clobber_all);
}
+SEC("socket")
+__description("dead branch on jeq, does not result in invariants violation error")
+__success __log_level(2)
+__retval(0) __flag(BPF_F_TEST_REG_INVARIANTS)
+__naked void jeq_range_analysis(void)
+{
+ asm volatile (" \
+ call %[bpf_get_prandom_u32]; \
+ r6 = r0; \
+ r6 &= 0xFFFFFFFFFFFFFFF0; \
+ r7 = r0; \
+ r7 &= 0x07; \
+ r7 -= 0xFF; \
+ if r6 == r7 goto l1_%=; \
+l0_%=: r0 = 0; \
+ exit; \
+l1_%=: r0 = 1; \
+ exit; \
+" :
+ : __imm(bpf_get_prandom_u32)
+ : __clobber_all);
+}
+
/* This test covers the bounds deduction on 64bits when the s64 and u64 ranges
* overlap on the negative side. At instruction 7, the ranges look as follows:
*
--
2.43.0