From patchwork Thu Dec 22 02:44:13 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Hao Sun X-Patchwork-Id: 35587 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:adf:e747:0:0:0:0:0 with SMTP id c7csp100177wrn; Wed, 21 Dec 2022 18:45:29 -0800 (PST) X-Google-Smtp-Source: AMrXdXuHlmuI8ZTixLDWEQgIBSven9YqS6NL4m8wcrT+n9/sDtpIUDcDHRE8rxEacPXbSM7SgZzy X-Received: by 2002:a05:6a20:24a7:b0:ac:f68:24a0 with SMTP id m39-20020a056a2024a700b000ac0f6824a0mr3543685pzd.29.1671677129651; Wed, 21 Dec 2022 18:45:29 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1671677129; cv=none; d=google.com; s=arc-20160816; b=w0LbJP0I+6T9Qz/crSOJCpleUaib73/I5MIRsF2cYb4UP0FFbKj21LoaVelgdw6Zrg oy6/8I8PmIghqBogtT8MyN4lrUle2++VhSWbaBf61jXnAz7KM8rRFDe0IfDQsnkS7+zh RhsBwINCDR8G5Jc24mvHizapCEgBaGALqYWL5GiG6xFMw7iYoO7gp4EzNdWdDJGgkfed SOMtHz/1y5bUfbL+aRrFAWmMElkpL2w6LSFCsN0YBXBsjQ8KXrqW3WS8JpkJMGYt9Qeo x6yknVk8LEpk7BWM38ikRNiFwFGhRNqfv0JmEPAb+pa3Nh++ZcaVBsA/2NqtcscpEQjI buxA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :message-id:date:subject:cc:to:from:dkim-signature; bh=FTIpJWonjUXndSlUh/081qXEdn8CFGHfdUk14rXmSvs=; b=I8IC2VjnfxPiVwahOttIIywRVumxeQZSgbH9ywyF4wjKRDzl+y17W3alc0hme8VUdX VYJoYNgoTRAZHb0eIM1YoRnwwvHuhu2zoZ4JZ+F6t0omVwFfAxg2Nnt0nDvFgV4Skgvv jswjnDcoTTIIWYld1L6qdyuxW0rxdtk2zlE1CdZomUVpgdExSAsQYnjtw5L5zfAEyE4S 2JpNAZYwaiYL6AJaRWdaq/wWj5Y7NTw+JkNc/ssFvLyQlUQcr6Sojj8zutmBJxNiXxn9 xMn3IlrWls52h6dH5FeOOIbg2sWdHfV86qJQ/8tiMqvBtZfVFjGrVi8viOYHTEtZg+j2 Xd9Q== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@gmail.com header.s=20210112 header.b=lIE9m3xy; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id t186-20020a6381c3000000b004780bcf1c1dsi18036793pgd.172.2022.12.21.18.45.16; Wed, 21 Dec 2022 18:45:29 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@gmail.com header.s=20210112 header.b=lIE9m3xy; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234901AbiLVCos (ORCPT + 99 others); Wed, 21 Dec 2022 21:44:48 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:52746 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229561AbiLVCoq (ORCPT ); Wed, 21 Dec 2022 21:44:46 -0500 Received: from mail-pj1-x1033.google.com (mail-pj1-x1033.google.com [IPv6:2607:f8b0:4864:20::1033]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 205CC19288; Wed, 21 Dec 2022 18:44:46 -0800 (PST) Received: by mail-pj1-x1033.google.com with SMTP id u4-20020a17090a518400b00223f7eba2c4so507701pjh.5; Wed, 21 Dec 2022 18:44:46 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=FTIpJWonjUXndSlUh/081qXEdn8CFGHfdUk14rXmSvs=; b=lIE9m3xystASzY37+oafMZYOu+ArGf2FcGa80JLrO3TpI0c9xcuew1IL5Oub8Xwmb7 8gEkegOvLfjN9fAvoW7UGA2f9Z7+wAFbuKkRtLBotPT76V0tYRCY39/PvcjD1qkQch7k NdovBxzan1qFCjMwAXAJLGQbwBFE78FSJRu3wKuX9TGLwp2D1n7YJoDh/wiy4hrx8U6I PzmICUmDYajrZGIip2jZ3oifkUtLeNEaOUnfX7DSR0LktUWZ18VNrB8LbDTt+jjD9Edu k2yrASXlN8Pttl8U7f1NpvooYngN8+7ggmzemlupc4hfBu6OCUqIGH04OP/p2do2icKe Qr2A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=FTIpJWonjUXndSlUh/081qXEdn8CFGHfdUk14rXmSvs=; b=7tRgeo0ylPJkert8iscdJJayqE/rtjyHxKgmYJMtSlaxpV/IkSuVOPQpU+hk/Rf3mL i47azvJEYLXBv3+MmxFvwdIbF2rnswy/2YW4TuED8v51MkDnxF78vjMoxuD/4EQfvqYH NTec5TAn0mwuMlh3SbJSP4TvqZKIUzcFgkhIkY+XJ6affBBu61EY05ExRCyUg//nbFGw l41tiWYozWYV7bikrTKx9tmsiJfZbgKiYocNKoTQPyJY3BnzR4MTFpd53ITOcaygCAUZ 7cxe/+K7NP9vWDZ89fl5HovwmHB+WjrBwd+l+yEZwC1/FV5QDycd9ObQJtn6UbYm9AA5 5lzA== X-Gm-Message-State: AFqh2ko6xnxmLgo4WkWUVU8aiUcKAV1thBnz5R9Sxakk2+vIdQQ3UJvC NZCpkyJ0gSv/TYGkaSRMSo9vM+H7rg== X-Received: by 2002:a17:902:a406:b0:189:6ab3:9e75 with SMTP id p6-20020a170902a40600b001896ab39e75mr4605590plq.15.1671677085102; Wed, 21 Dec 2022 18:44:45 -0800 (PST) Received: from localhost.localdomain ([144.214.0.6]) by smtp.gmail.com with ESMTPSA id b3-20020a636703000000b004768b74f208sm10752587pgc.4.2022.12.21.18.44.41 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Wed, 21 Dec 2022 18:44:44 -0800 (PST) From: Hao Sun To: bpf@vger.kernel.org Cc: ast@kernel.org, daniel@iogearbox.net, john.fastabend@gmail.com, andrii@kernel.org, martin.lau@linux.dev, song@kernel.org, yhs@fb.com, kpsingh@kernel.org, sdf@google.com, haoluo@google.com, jolsa@kernel.org, davem@davemloft.net, linux-kernel@vger.kernel.org, Hao Sun Subject: [PATCH bpf-next v3 1/2] bpf: fix nullness propagation for reg to reg comparisons Date: Thu, 22 Dec 2022 10:44:13 +0800 Message-Id: <20221222024414.29539-1-sunhao.th@gmail.com> X-Mailer: git-send-email 2.37.1 (Apple Git-137.1) MIME-Version: 1.0 X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FREEMAIL_FROM, RCVD_IN_DNSWL_NONE,SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1752880517746037508?= X-GMAIL-MSGID: =?utf-8?q?1752880517746037508?= After befae75856ab, the verifier would propagate null information after JEQ/JNE, e.g., if two pointers, one is maybe_null and the other is not, the former would be marked as non-null in eq path. However, as comment "PTR_TO_BTF_ID points to a kernel struct that does not need to be null checked by the BPF program ... The verifier must keep this in mind and can make no assumptions about null or non-null when doing branch ...". If one pointer is maybe_null and the other is PTR_TO_BTF, the former is incorrectly marked non-null. The following BPF prog can trigger a null-ptr-deref, also see this report for more details[1]: 0: (18) r1 = map_fd ; R1_w=map_ptr(ks=4, vs=4) 2: (79) r6 = *(u64 *)(r1 +8) ; R6_w=bpf_map->inner_map_data ; R6 is PTR_TO_BTF_ID ; equals to null at runtime 3: (bf) r2 = r10 4: (07) r2 += -4 5: (62) *(u32 *)(r2 +0) = 0 6: (85) call bpf_map_lookup_elem#1 ; R0_w=map_value_or_null 7: (1d) if r6 == r0 goto pc+1 8: (95) exit ; from 7 to 9: R0=map_value R6=ptr_bpf_map 9: (61) r0 = *(u32 *)(r0 +0) ; null-ptr-deref 10: (95) exit So, make the verifier propagate nullness information for reg to reg comparisons only if neither reg is PTR_TO_BTF_ID. [1] https://lore.kernel.org/bpf/CACkBjsaFJwjC5oiw-1KXvcazywodwXo4zGYsRHwbr2gSG9WcSw@mail.gmail.com/T/#u Fixes: befae75856ab4 ("bpf: propagate nullness information for reg to reg comparisons") Signed-off-by: Hao Sun Acked-by: Yonghong Song --- v1 -> v2 add explanation comments above changes v2 -> v3 rewrite selftests that run under test_progs to use CO-RE --- kernel/bpf/verifier.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) base-commit: 7b43df6c6ec38c9097420902a1c8165c4b25bf70 diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index faa358b3d5d7..966d98bfdb60 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -11823,10 +11823,17 @@ static int check_cond_jmp_op(struct bpf_verifier_env *env, * register B - not null * for JNE A, B, ... - A is not null in the false branch; * for JEQ A, B, ... - A is not null in the true branch. + * + * Since PTR_TO_BTF_ID points to a kernel struct that does + * not need to be null checked by the BPF program, i.e., + * could be null even without PTR_MAYBE_NULL marking, so + * only propagate nullness when neither reg is that type. */ if (!is_jmp32 && BPF_SRC(insn->code) == BPF_X && __is_pointer_value(false, src_reg) && __is_pointer_value(false, dst_reg) && - type_may_be_null(src_reg->type) != type_may_be_null(dst_reg->type)) { + type_may_be_null(src_reg->type) != type_may_be_null(dst_reg->type) && + base_type(src_reg->type) != PTR_TO_BTF_ID && + base_type(dst_reg->type) != PTR_TO_BTF_ID) { eq_branch_regs = NULL; switch (opcode) { case BPF_JEQ: From patchwork Thu Dec 22 02:44:14 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Hao Sun X-Patchwork-Id: 35588 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:adf:e747:0:0:0:0:0 with SMTP id c7csp100624wrn; Wed, 21 Dec 2022 18:47:03 -0800 (PST) X-Google-Smtp-Source: AMrXdXvq4q57/2eWcOawtikk5JPWDuU3814Z80kJ6qfCKppybnGHH+aOSwqd1O+IvfpUdASQELzQ X-Received: by 2002:a05:6a00:1caa:b0:57f:ca45:5fef with SMTP id y42-20020a056a001caa00b0057fca455fefmr4601314pfw.30.1671677223392; Wed, 21 Dec 2022 18:47:03 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1671677223; cv=none; d=google.com; s=arc-20160816; b=WLDpd1BDMu3iKj5w2cyQh0YtWVYSmMZbBKQNKTjxOLjxUdbobrrEDCHhY4itnzzL4N bNT2aH4733izwhDuy/xuiQ+wURTsDiS5CHTFfFOXnutGX38Wt7c2hf7N73iTXX77nTKf BqSwNY1ylpnCl2E1x779zbKGVkZPIcdBlrfWfLLcZHYkYqS8nm2rvJslm3iUHu60zExs sfex8S0+BVrjNuYrYIsanb/H9ML5yzWRgXBPxAuRNMBQPUGi2mOKmABDZodAOZ5dlTPA jpBP8K6JcEIVNdBUs4ofLQJUxc+sUKO0Id/lMKHSNFHLZkJJjbCf3K0W82mpW6F54Hw3 HXBg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :dkim-signature; bh=50e+rc76FX6NnQ/PJbD86Ddg3fIOGCMiwgvLcm7Z4zA=; b=wZofu4F49ptuDh1jxmST09gdQizTryc9oqtRhuoOe0BlPQGdf78+eCMz6Uxz8Xgl80 MZI3QFyJ0a1oXEjTdFznj4bSa+4o/FpRVnv2QGgKRhKOIerI6T3vHq1N7EED5IHVySmF ecs6yVJ4IP2T56NE+a6G85QKPbAEW2IAW+lN5Ozg/MtLvqIRlAN6xPnZGizRWoEmcBAv ttXYHmT8c1JhgkruGvWRa2qbEt9+Kgdya8I4lxCdxZXngnmtWv2CdhGH0v+7p28QN/KY YDzuE8V15xSlwm4XKqwUT0novi6ny817ytnrIMgZ4rcD4MBn6LK+zo3Ijk2B//6b838N u43g== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@gmail.com header.s=20210112 header.b=hTMh95th; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id h14-20020a056a00170e00b0056cb8f67eefsi19265056pfc.70.2022.12.21.18.46.47; Wed, 21 Dec 2022 18:47:03 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@gmail.com header.s=20210112 header.b=hTMh95th; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234967AbiLVCo6 (ORCPT + 99 others); Wed, 21 Dec 2022 21:44:58 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:52870 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234980AbiLVCo4 (ORCPT ); Wed, 21 Dec 2022 21:44:56 -0500 Received: from mail-pl1-x62d.google.com (mail-pl1-x62d.google.com [IPv6:2607:f8b0:4864:20::62d]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 0C0B31B1E4; Wed, 21 Dec 2022 18:44:55 -0800 (PST) Received: by mail-pl1-x62d.google.com with SMTP id w20so704143ply.12; Wed, 21 Dec 2022 18:44:55 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=50e+rc76FX6NnQ/PJbD86Ddg3fIOGCMiwgvLcm7Z4zA=; b=hTMh95thyJnZQ/2t3RqHqb0NAyNk6lMUjNzpFtGHVwVcU3lhdNEGGzBpVNm+p5Ugn8 TpcBsV3MHaUv1vpiJws0EuzybzLMtCH9mBbF/r/yy2/Bl+gngnE/XCcuELw8dCAZhocS 5D9+H1c+VcVejnHlLSK30i8+bwjWeURy7ZIZyEjcD0bDhYvRCV5L2nY8PAJA5kxcLXSW fzhz6EaFFxOc9EfGj17X+GYfUrBtfBMCT62VSZ5oVjF5cdZ/OOtZNG6Ocs7ehL4uPIF4 srnROYEmjeT60KVc4n1/UfuE/swwJBp+LRdHv0Y4kq8tVFCSEQYDokFbz6qHTqyMGdhq yEhw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=50e+rc76FX6NnQ/PJbD86Ddg3fIOGCMiwgvLcm7Z4zA=; b=CWeHcAMiOnoNiei43HFyoQipPzJyjetqI30KgAnJ71EPtNMeLdHHOuulVfnsp7BCyB ZYXS7ajA8pzlLV9cLV4tJhEd9G/xNTgWeKlmpdUsVQIJjajW+gPcnSWmZfB9Ltpjc3qQ pNHjM+fQ9JbKAy9LwMGig0LYtPUhO4pfTdVlXxkFOH2xdu8cvPrGOGOKL/RbA4JIsTin 103DkOEFyWVsKxFy3vqVpTyR1YCNH4k6n0L6oKbP68h6Z+8jKb+AH47RaIjlBjs7STe7 oD/9GEsoUeINvm7yPeHG6DjuS0h8A7dZRPnvGwzHIuvPX/gmxT3Czcmq3Dw8ITBv0Fzj w67Q== X-Gm-Message-State: AFqh2kpdoFy8x3CCAk4lcoHm8u1e5AzBOuJPKd3zKaWougE3hjgHrMli eld+i7Qqz3KVXHnVdWp1cT8Zo7lWpQ== X-Received: by 2002:a05:6a21:e302:b0:a3:d6:8795 with SMTP id cb2-20020a056a21e30200b000a300d68795mr5941938pzc.17.1671677094277; Wed, 21 Dec 2022 18:44:54 -0800 (PST) Received: from localhost.localdomain ([144.214.0.6]) by smtp.gmail.com with ESMTPSA id b3-20020a636703000000b004768b74f208sm10752587pgc.4.2022.12.21.18.44.51 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Wed, 21 Dec 2022 18:44:53 -0800 (PST) From: Hao Sun To: bpf@vger.kernel.org Cc: ast@kernel.org, daniel@iogearbox.net, john.fastabend@gmail.com, andrii@kernel.org, martin.lau@linux.dev, song@kernel.org, yhs@fb.com, kpsingh@kernel.org, sdf@google.com, haoluo@google.com, jolsa@kernel.org, davem@davemloft.net, linux-kernel@vger.kernel.org, Hao Sun , Martin KaFai Lau Subject: [PATCH bpf-next v3 2/2] selftests/bpf: check null propagation only neither reg is PTR_TO_BTF_ID Date: Thu, 22 Dec 2022 10:44:14 +0800 Message-Id: <20221222024414.29539-2-sunhao.th@gmail.com> X-Mailer: git-send-email 2.37.1 (Apple Git-137.1) In-Reply-To: <20221222024414.29539-1-sunhao.th@gmail.com> References: <20221222024414.29539-1-sunhao.th@gmail.com> MIME-Version: 1.0 X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FREEMAIL_FROM, RCVD_IN_DNSWL_NONE,SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1752880615963046035?= X-GMAIL-MSGID: =?utf-8?q?1752880615963046035?= Verify that nullness information is not porpagated in the branches of register to register JEQ and JNE operations if one of them is PTR_TO_BTF_ID. Implement this in C level so we can use CO-RE. Signed-off-by: Hao Sun Suggested-by: Martin KaFai Lau --- .../bpf/prog_tests/jeq_infer_not_null.c | 9 ++++ .../bpf/progs/jeq_infer_not_null_fail.c | 42 +++++++++++++++++++ 2 files changed, 51 insertions(+) create mode 100644 tools/testing/selftests/bpf/prog_tests/jeq_infer_not_null.c create mode 100644 tools/testing/selftests/bpf/progs/jeq_infer_not_null_fail.c diff --git a/tools/testing/selftests/bpf/prog_tests/jeq_infer_not_null.c b/tools/testing/selftests/bpf/prog_tests/jeq_infer_not_null.c new file mode 100644 index 000000000000..3add34df5767 --- /dev/null +++ b/tools/testing/selftests/bpf/prog_tests/jeq_infer_not_null.c @@ -0,0 +1,9 @@ +// SPDX-License-Identifier: GPL-2.0 + +#include +#include "jeq_infer_not_null_fail.skel.h" + +void test_jeq_infer_not_null(void) +{ + RUN_TESTS(jeq_infer_not_null_fail); +} diff --git a/tools/testing/selftests/bpf/progs/jeq_infer_not_null_fail.c b/tools/testing/selftests/bpf/progs/jeq_infer_not_null_fail.c new file mode 100644 index 000000000000..f46965053acb --- /dev/null +++ b/tools/testing/selftests/bpf/progs/jeq_infer_not_null_fail.c @@ -0,0 +1,42 @@ +// SPDX-License-Identifier: GPL-2.0 + +#include "vmlinux.h" +#include +#include "bpf_misc.h" + +char _license[] SEC("license") = "GPL"; + +struct { + __uint(type, BPF_MAP_TYPE_HASH); + __uint(max_entries, 1); + __type(key, u64); + __type(value, u64); +} m_hash SEC(".maps"); + +SEC("?raw_tp") +__failure __msg("R8 invalid mem access 'map_value_or_null") +int jeq_infer_not_null_ptr_to_btfid(void *ctx) +{ + struct bpf_map *map = (struct bpf_map *)&m_hash; + struct bpf_map *inner_map = map->inner_map_meta; + u64 key = 0, ret = 0, *val; + + val = bpf_map_lookup_elem(map, &key); + /* Do not mark ptr as non-null if one of them is + * PTR_TO_BTF_ID (R9), reject because of invalid + * access to map value (R8). + * + * Here, we need to inline those insns to access + * R8 directly, since compiler may use other reg + * once it figures out val==inner_map. + */ + asm volatile("r8 = %[val];\n" + "r9 = %[inner_map];\n" + "if r8 != r9 goto +1;\n" + "%[ret] = *(u64 *)(r8 +0);\n" + : [ret] "+r"(ret) + : [inner_map] "r"(inner_map), [val] "r"(val) + : "r8", "r9"); + + return ret; +}