On Fri, Jun 2, 2017 at 7:42 AM, Edward Cree <ecree@...> wrote:

A couple of the tests in tools/testing/selftests/bpf/test_verifier.c seem to be bogus: Test "multiple registers share map_lookup_elem bad reg type" is supposed to
error with "R3 invalid mem access 'inv'", but from my reading of it, R3 gets
loaded with a map_value_or_null, that later gets null-checked (both directly
and - through R0 - indirectly), and finally stored through. I don't see
what's supposed to make R3 become a bad pointer.

You are right. In this case,
r0 = bpf_map_lookup
r2 = r0
r3 = r0
r4 = r0
r5 = r0
if (r0 != 0) <=== condition 1
r1 = 1
if (r0 != 0)
r1 = 2
if (r3 != 0)
*r3 = 0
...

If (r0 != 0) if false, the current verifier marks r2/r3/r4/r5 as unknown value.
I guess here what you did to have precise value 0 helps and make verifier
complaint go away correctly.

Test "helper access to variable memory: stack, bitwise AND + JMP, correct
bounds" is listed as expected to pass, but it passes zero in the 'size'
argument, an ARG_CONST_SIZE, to bpf_probe_read; I believe this should fail
(and with my WIP patch it does).

Probably a typo or mis-statement. "size" is not passed in with "zero", but
with an unknown value. Hence, it probably should fail.

BPF_MOV64_IMM(BPF_REG_2, 16),
BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 64),
BPF_MOV64_IMM(BPF_REG_4, 0),
BPF_JMP_REG(BPF_JGE, BPF_REG_4, BPF_REG_2, 2),
BPF_MOV64_IMM(BPF_REG_3, 0),
BPF_EMIT_CALL(BPF_FUNC_probe_read),


In kernel/bpf/verifier.c,

} else if (arg_type == ARG_CONST_SIZE ||
arg_type == ARG_CONST_SIZE_OR_ZERO) {
expected_type = CONST_IMM;
/* One exception. Allow UNKNOWN_VALUE registers when the
* boundaries are known and don't cause unsafe memory accesses
*/
if (type != UNKNOWN_VALUE && type != expected_type)
goto err_type;

Maybe somebody can provide some historical context for this relaxation.