• Jean-Philippe Brucker's avatar
    selftests/bpf: Fix array access with signed variable test · 77ce220c
    Jean-Philippe Brucker authored
    The test fails because of a recent fix to the verifier, even though this
    program is valid. In details what happens is:
    
        7: (61) r1 = *(u32 *)(r0 +0)
    
    Load a 32-bit value, with signed bounds [S32_MIN, S32_MAX]. The bounds
    of the 64-bit value are [0, U32_MAX]...
    
        8: (65) if r1 s> 0xffffffff goto pc+1
    
    ... therefore this is always true (the operand is sign-extended).
    
        10: (b4) w2 = 11
        11: (6d) if r2 s> r1 goto pc+1
    
    When true, the 64-bit bounds become [0, 10]. The 32-bit bounds are still
    [S32_MIN, 10].
    
        13: (64) w1 <<= 2
    
    Because this is a 32-bit operation, the verifier propagates the new
    32-bit bounds to the 64-bit ones, and the knowledge gained from insn 11
    is lost.
    
        14: (0f) r0 += r1
        15: (7a) *(u64 *)(r0 +0) = 4
    
    Then the verifier considers r0 unbounded here, rejecting the test. To
    make the test work, change insn 8 to check the sign of the 32-bit value.
    Signed-off-by: default avatarJean-Philippe Brucker <jean-philippe@linaro.org>
    Acked-by: default avatarJohn Fastabend <john.fastabend@gmail.com>
    Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
    77ce220c
array_access.c 12 KB