| Message ID | 158983217236.6512.3045049444791726995.stgit@john-Precision-5820-Tower |
|---|---|
| State | Changes Requested |
| Delegated to: | BPF Maintainers |
| Headers | show |
| Series | verifier, improve ptr is_branch_taken logic | expand |
On Mon, May 18, 2020 at 1:06 PM John Fastabend <john.fastabend@gmail.com> wrote: > > When we have pointer type that is known to be non-null we only follow > the non-null branch. This adds tests to cover this case for reference > tracking. > > Signed-off-by: John Fastabend <john.fastabend@gmail.com> > --- > .../testing/selftests/bpf/verifier/ref_tracking.c | 16 ++++++++++++++++ > 1 file changed, 16 insertions(+) > > diff --git a/tools/testing/selftests/bpf/verifier/ref_tracking.c b/tools/testing/selftests/bpf/verifier/ref_tracking.c > index 604b461..d8f7c04 100644 > --- a/tools/testing/selftests/bpf/verifier/ref_tracking.c > +++ b/tools/testing/selftests/bpf/verifier/ref_tracking.c > @@ -821,3 +821,19 @@ > .result = REJECT, > .errstr = "invalid mem access", > }, > +{ > + "reference tracking: branch tracking valid pointer null comparison", > + .insns = { > + BPF_SK_LOOKUP(sk_lookup_tcp), > + BPF_MOV64_REG(BPF_REG_6, BPF_REG_0), > + BPF_MOV64_IMM(BPF_REG_3, 1), > + BPF_JMP_IMM(BPF_JNE, BPF_REG_6, 0, 1), > + BPF_MOV64_IMM(BPF_REG_3, 0), > + BPF_JMP_IMM(BPF_JEQ, BPF_REG_6, 0, 2), > + BPF_MOV64_REG(BPF_REG_1, BPF_REG_6), > + BPF_EMIT_CALL(BPF_FUNC_sk_release), > + BPF_EXIT_INSN(), > + }, > + .prog_type = BPF_PROG_TYPE_SCHED_CLS, > + .result = ACCEPT, > +}, Can you please add another test where you test against non-zero value to verify that both branches are considered to be taken and verifier actually complaints that sk_release happens only in one of branches. >
diff --git a/tools/testing/selftests/bpf/verifier/ref_tracking.c b/tools/testing/selftests/bpf/verifier/ref_tracking.c index 604b461..d8f7c04 100644 --- a/tools/testing/selftests/bpf/verifier/ref_tracking.c +++ b/tools/testing/selftests/bpf/verifier/ref_tracking.c @@ -821,3 +821,19 @@ .result = REJECT, .errstr = "invalid mem access", }, +{ + "reference tracking: branch tracking valid pointer null comparison", + .insns = { + BPF_SK_LOOKUP(sk_lookup_tcp), + BPF_MOV64_REG(BPF_REG_6, BPF_REG_0), + BPF_MOV64_IMM(BPF_REG_3, 1), + BPF_JMP_IMM(BPF_JNE, BPF_REG_6, 0, 1), + BPF_MOV64_IMM(BPF_REG_3, 0), + BPF_JMP_IMM(BPF_JEQ, BPF_REG_6, 0, 2), + BPF_MOV64_REG(BPF_REG_1, BPF_REG_6), + BPF_EMIT_CALL(BPF_FUNC_sk_release), + BPF_EXIT_INSN(), + }, + .prog_type = BPF_PROG_TYPE_SCHED_CLS, + .result = ACCEPT, +},
When we have pointer type that is known to be non-null we only follow the non-null branch. This adds tests to cover this case for reference tracking. Signed-off-by: John Fastabend <john.fastabend@gmail.com> --- .../testing/selftests/bpf/verifier/ref_tracking.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+)