selftests/bpf: add basic verifier tests for loops

This set of tests is a rewrite of Edward's earlier tests:
https://patchwork.ozlabs.org/patch/877221/

Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>

diff --git a/tools/testing/selftests/bpf/verifier/loops1.c b/tools/testing/selftests/bpf/verifier/loops1.c
new file mode 100644 (file)
index 0000000..5e980a5
--- /dev/null
+++ b/tools/testing/selftests/bpf/verifier/loops1.c
@@ -0,0 +1,161 @@
+{
+       "bounded loop, count to 4",
+       .insns = {
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 1),
+       BPF_JMP_IMM(BPF_JLT, BPF_REG_0, 4, -2),
+       BPF_EXIT_INSN(),
+       },
+       .result = ACCEPT,
+       .prog_type = BPF_PROG_TYPE_TRACEPOINT,
+       .retval = 4,
+},
+{
+       "bounded loop, count to 20",
+       .insns = {
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 3),
+       BPF_JMP_IMM(BPF_JLT, BPF_REG_0, 20, -2),
+       BPF_EXIT_INSN(),
+       },
+       .result = ACCEPT,
+       .prog_type = BPF_PROG_TYPE_TRACEPOINT,
+},
+{
+       "bounded loop, count from positive unknown to 4",
+       .insns = {
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_get_prandom_u32),
+       BPF_JMP_IMM(BPF_JSLT, BPF_REG_0, 0, 2),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 1),
+       BPF_JMP_IMM(BPF_JLT, BPF_REG_0, 4, -2),
+       BPF_EXIT_INSN(),
+       },
+       .result = ACCEPT,
+       .prog_type = BPF_PROG_TYPE_TRACEPOINT,
+       .retval = 4,
+},
+{
+       "bounded loop, count from totally unknown to 4",
+       .insns = {
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_get_prandom_u32),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 1),
+       BPF_JMP_IMM(BPF_JLT, BPF_REG_0, 4, -2),
+       BPF_EXIT_INSN(),
+       },
+       .result = ACCEPT,
+       .prog_type = BPF_PROG_TYPE_TRACEPOINT,
+},
+{
+       "bounded loop, count to 4 with equality",
+       .insns = {
+               BPF_MOV64_IMM(BPF_REG_0, 0),
+               BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 1),
+               BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 4, -2),
+               BPF_EXIT_INSN(),
+       },
+       .result = ACCEPT,
+       .prog_type = BPF_PROG_TYPE_TRACEPOINT,
+},
+{
+       "bounded loop, start in the middle",
+       .insns = {
+               BPF_MOV64_IMM(BPF_REG_0, 0),
+               BPF_JMP_A(1),
+               BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 1),
+               BPF_JMP_IMM(BPF_JLT, BPF_REG_0, 4, -2),
+               BPF_EXIT_INSN(),
+       },
+       .result = REJECT,
+       .errstr = "back-edge",
+       .prog_type = BPF_PROG_TYPE_TRACEPOINT,
+       .retval = 4,
+},
+{
+       "bounded loop containing a forward jump",
+       .insns = {
+               BPF_MOV64_IMM(BPF_REG_0, 0),
+               BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 1),
+               BPF_JMP_REG(BPF_JEQ, BPF_REG_0, BPF_REG_0, 0),
+               BPF_JMP_IMM(BPF_JLT, BPF_REG_0, 4, -3),
+               BPF_EXIT_INSN(),
+       },
+       .result = ACCEPT,
+       .prog_type = BPF_PROG_TYPE_TRACEPOINT,
+       .retval = 4,
+},
+{
+       "bounded loop that jumps out rather than in",
+       .insns = {
+       BPF_MOV64_IMM(BPF_REG_6, 0),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
+       BPF_JMP_IMM(BPF_JGT, BPF_REG_6, 10000, 2),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_get_prandom_u32),
+       BPF_JMP_A(-4),
+       BPF_EXIT_INSN(),
+       },
+       .result = ACCEPT,
+       .prog_type = BPF_PROG_TYPE_TRACEPOINT,
+},
+{
+       "infinite loop after a conditional jump",
+       .insns = {
+       BPF_MOV64_IMM(BPF_REG_0, 5),
+       BPF_JMP_IMM(BPF_JLT, BPF_REG_0, 4, 2),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 1),
+       BPF_JMP_A(-2),
+       BPF_EXIT_INSN(),
+       },
+       .result = REJECT,
+       .errstr = "program is too large",
+       .prog_type = BPF_PROG_TYPE_TRACEPOINT,
+},
+{
+       "bounded recursion",
+       .insns = {
+       BPF_MOV64_IMM(BPF_REG_1, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
+       BPF_EXIT_INSN(),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 1),
+       BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
+       BPF_JMP_IMM(BPF_JLT, BPF_REG_1, 4, 1),
+       BPF_EXIT_INSN(),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, -5),
+       BPF_EXIT_INSN(),
+       },
+       .result = REJECT,
+       .errstr = "back-edge",
+       .prog_type = BPF_PROG_TYPE_TRACEPOINT,
+},
+{
+       "infinite loop in two jumps",
+       .insns = {
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_JMP_A(0),
+       BPF_JMP_IMM(BPF_JLT, BPF_REG_0, 4, -2),
+       BPF_EXIT_INSN(),
+       },
+       .result = REJECT,
+       .errstr = "loop detected",
+       .prog_type = BPF_PROG_TYPE_TRACEPOINT,
+},
+{
+       "infinite loop: three-jump trick",
+       .insns = {
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 1),
+       BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 1),
+       BPF_JMP_IMM(BPF_JLT, BPF_REG_0, 2, 1),
+       BPF_EXIT_INSN(),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 1),
+       BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 1),
+       BPF_JMP_IMM(BPF_JLT, BPF_REG_0, 2, 1),
+       BPF_EXIT_INSN(),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 1),
+       BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 1),
+       BPF_JMP_IMM(BPF_JLT, BPF_REG_0, 2, -11),
+       BPF_EXIT_INSN(),
+       },
+       .result = REJECT,
+       .errstr = "loop detected",
+       .prog_type = BPF_PROG_TYPE_TRACEPOINT,
+},