selftests/bpf: adjust global_func15 test to validate prog exit precision

Add one more subtest to  global_func15 selftest to validate that
verifier properly marks r0 as precise and avoids erroneous state pruning
of the branch that has return value outside of expected [0, 1] value.

Acked-by: Eduard Zingerman <eddyz87@gmail.com>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/r/20231202175705.885270-11-andrii@kernel.org
Signed-off-by: Alexei Starovoitov <ast@kernel.org>

diff --git a/tools/testing/selftests/bpf/progs/test_global_func15.c b/tools/testing/selftests/bpf/progs/test_global_func15.c
index f80207480e8ad0ab348d5b347966f52e6ebb508f..b4e089d6981da01b73c687086f80f3f79326b07d 100644 (file)
--- a/tools/testing/selftests/bpf/progs/test_global_func15.c
+++ b/tools/testing/selftests/bpf/progs/test_global_func15.c
@@ -22,3 +22,35 @@ int global_func15(struct __sk_buff *skb)
 
        return v;
 }
+
+SEC("cgroup_skb/ingress")
+__log_level(2) __flag(BPF_F_TEST_STATE_FREQ)
+__failure
+/* check that fallthrough code path marks r0 as precise */
+__msg("mark_precise: frame0: regs=r0 stack= before 2: (b7) r0 = 1")
+/* check that branch code path marks r0 as precise */
+__msg("mark_precise: frame0: regs=r0 stack= before 0: (85) call bpf_get_prandom_u32#7")
+__msg("At program exit the register R0 has ")
+__naked int global_func15_tricky_pruning(void)
+{
+       asm volatile (
+               "call %[bpf_get_prandom_u32];"
+               "if r0 s> 1000 goto 1f;"
+               "r0 = 1;"
+       "1:"
+               "goto +0;" /* checkpoint */
+               /* cgroup_skb/ingress program is expected to return [0, 1]
+                * values, so branch above makes sure that in a fallthrough
+                * case we have a valid 1 stored in R0 register, but in
+                * a branch case we assign some random value to R0.  So if
+                * there is something wrong with precision tracking for R0 at
+                * program exit, we might erronenously prune branch case,
+                * because R0 in fallthrough case is imprecise (and thus any
+                * value is valid from POV of verifier is_state_equal() logic)
+                */
+               "exit;"
+               :
+               : __imm(bpf_get_prandom_u32)
+               : __clobber_common
+       );
+}