bpf: Selftests, verifier case for non null pointer check branch taken
When we have pointer type that is known to be non-null and comparing against zero we only follow the non-null branch. This adds tests to cover this case for reference tracking. Also add the other case when comparison against a non-zero value and ensure we still fail with unreleased reference. Signed-off-by: John Fastabend <john.fastabend@gmail.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Link: https://lore.kernel.org/bpf/159009166599.6313.1593680633787453767.stgit@john-Precision-5820-Tower
This commit is contained in:
parent
cac616db39
commit
c72b5cbb09
|
@ -821,3 +821,36 @@
|
|||
.result = REJECT,
|
||||
.errstr = "invalid mem access",
|
||||
},
|
||||
{
|
||||
"reference tracking: branch tracking valid pointer null comparison",
|
||||
.insns = {
|
||||
BPF_SK_LOOKUP(sk_lookup_tcp),
|
||||
BPF_MOV64_REG(BPF_REG_6, BPF_REG_0),
|
||||
BPF_MOV64_IMM(BPF_REG_3, 1),
|
||||
BPF_JMP_IMM(BPF_JNE, BPF_REG_6, 0, 1),
|
||||
BPF_MOV64_IMM(BPF_REG_3, 0),
|
||||
BPF_JMP_IMM(BPF_JEQ, BPF_REG_6, 0, 2),
|
||||
BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
|
||||
BPF_EMIT_CALL(BPF_FUNC_sk_release),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
||||
.result = ACCEPT,
|
||||
},
|
||||
{
|
||||
"reference tracking: branch tracking valid pointer value comparison",
|
||||
.insns = {
|
||||
BPF_SK_LOOKUP(sk_lookup_tcp),
|
||||
BPF_MOV64_REG(BPF_REG_6, BPF_REG_0),
|
||||
BPF_MOV64_IMM(BPF_REG_3, 1),
|
||||
BPF_JMP_IMM(BPF_JEQ, BPF_REG_6, 0, 4),
|
||||
BPF_MOV64_IMM(BPF_REG_3, 0),
|
||||
BPF_JMP_IMM(BPF_JEQ, BPF_REG_6, 1234, 2),
|
||||
BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
|
||||
BPF_EMIT_CALL(BPF_FUNC_sk_release),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
||||
.errstr = "Unreleased reference",
|
||||
.result = REJECT,
|
||||
},
|
||||
|
|
Loading…
Reference in New Issue