bpf: Add a possibly-zero-sized read test

This patch adds a test for the condition that the previous patch mucked
with - illegal zero-sized helper memory access. As opposed to existing
tests, this new one uses a size whose lower bound is zero, as opposed to
a known-zero one.

Signed-off-by: Andrei Matei <andreimatei1@gmail.com>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/bpf/20231221232225.568730-3-andreimatei1@gmail.com

diff --git a/tools/testing/selftests/bpf/progs/verifier_helper_value_access.c b/tools/testing/selftests/bpf/progs/verifier_helper_value_access.c
index 3e8340c2408f3794789c68e8f4d465684b31ab41..886498b5e6f34339161fc705f34e19dcb8f4ed03 100644 (file)
--- a/tools/testing/selftests/bpf/progs/verifier_helper_value_access.c
+++ b/tools/testing/selftests/bpf/progs/verifier_helper_value_access.c
@@ -89,9 +89,14 @@ l0_%=:       exit;                                           \
        : __clobber_all);
 }
 
+/* Call a function taking a pointer and a size which doesn't allow the size to
+ * be zero (i.e. bpf_trace_printk() declares the second argument to be
+ * ARG_CONST_SIZE, not ARG_CONST_SIZE_OR_ZERO). We attempt to pass zero for the
+ * size and expect to fail.
+ */
 SEC("tracepoint")
 __description("helper access to map: empty range")
-__failure __msg("R2 invalid zero-sized read")
+__failure __msg("R2 invalid zero-sized read: u64=[0,0]")
 __naked void access_to_map_empty_range(void)
 {
        asm volatile ("                                 \
@@ -113,6 +118,38 @@ l0_%=:     exit;                                           \
        : __clobber_all);
 }
 
+/* Like the test above, but this time the size register is not known to be zero;
+ * its lower-bound is zero though, which is still unacceptable.
+ */
+SEC("tracepoint")
+__description("helper access to map: possibly-empty ange")
+__failure __msg("R2 invalid zero-sized read: u64=[0,4]")
+__naked void access_to_map_possibly_empty_range(void)
+{
+       asm volatile ("                                         \
+       r2 = r10;                                               \
+       r2 += -8;                                               \
+       r1 = 0;                                                 \
+       *(u64*)(r2 + 0) = r1;                                   \
+       r1 = %[map_hash_48b] ll;                                \
+       call %[bpf_map_lookup_elem];                            \
+       if r0 == 0 goto l0_%=;                                  \
+       r1 = r0;                                                \
+       /* Read an unknown value */                             \
+       r7 = *(u64*)(r0 + 0);                                   \
+       /* Make it small and positive, to avoid other errors */ \
+       r7 &= 4;                                                \
+       r2 = 0;                                                 \
+       r2 += r7;                                               \
+       call %[bpf_trace_printk];                               \
+l0_%=: exit;                                               \
+"      :
+       : __imm(bpf_map_lookup_elem),
+         __imm(bpf_trace_printk),
+         __imm_addr(map_hash_48b)
+       : __clobber_all);
+}
+
 SEC("tracepoint")
 __description("helper access to map: out-of-bound range")
 __failure __msg("invalid access to map value, value_size=48 off=0 size=56")