tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

bpf: Add selftest to check the verifier's abstract multiplication

Add new selftest to test the abstract multiplication technique(s) used
by the verifier, following the recent improvement in tnum
multiplication (tnum_mul). One of the newly added programs,
verifier_mul/mul_precise, results in a false positive with the old
tnum_mul, while the program passes with the latest one.

Signed-off-by: Nandakumar Edamana <nandakumar@nandakumar.co.in>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Reviewed-by: Harishankar Vishwanathan <harishankar.vishwanathan@gmail.com>
Acked-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://lore.kernel.org/bpf/20250826034524.2159515-2-nandakumar@nandakumar.co.in

authored by

Nandakumar Edamana and committed by
Andrii Nakryiko 2660b9d4 1df7dad4

+40
+2
tools/testing/selftests/bpf/prog_tests/verifier.c
··· 59 59 #include "verifier_meta_access.skel.h" 60 60 #include "verifier_movsx.skel.h" 61 61 #include "verifier_mtu.skel.h" 62 + #include "verifier_mul.skel.h" 62 63 #include "verifier_netfilter_ctx.skel.h" 63 64 #include "verifier_netfilter_retcode.skel.h" 64 65 #include "verifier_bpf_fastcall.skel.h" ··· 195 194 void test_verifier_may_goto_2(void) { RUN(verifier_may_goto_2); } 196 195 void test_verifier_meta_access(void) { RUN(verifier_meta_access); } 197 196 void test_verifier_movsx(void) { RUN(verifier_movsx); } 197 + void test_verifier_mul(void) { RUN(verifier_mul); } 198 198 void test_verifier_netfilter_ctx(void) { RUN(verifier_netfilter_ctx); } 199 199 void test_verifier_netfilter_retcode(void) { RUN(verifier_netfilter_retcode); } 200 200 void test_verifier_bpf_fastcall(void) { RUN(verifier_bpf_fastcall); }
+38
tools/testing/selftests/bpf/progs/verifier_mul.c
··· 1 + // SPDX-License-Identifier: GPL-2.0 2 + /* Copyright (c) 2025 Nandakumar Edamana */ 3 + #include <linux/bpf.h> 4 + #include <bpf/bpf_helpers.h> 5 + #include <bpf/bpf_tracing.h> 6 + #include "bpf_misc.h" 7 + 8 + /* Intended to test the abstract multiplication technique(s) used by 9 + * the verifier. Using assembly to avoid compiler optimizations. 10 + */ 11 + SEC("fentry/bpf_fentry_test1") 12 + void BPF_PROG(mul_precise, int x) 13 + { 14 + /* First, force the verifier to be uncertain about the value: 15 + * unsigned int a = (bpf_get_prandom_u32() & 0x2) | 0x1; 16 + * 17 + * Assuming the verifier is using tnum, a must be tnum{.v=0x1, .m=0x2}. 18 + * Then a * 0x3 would be m0m1 (m for uncertain). Added imprecision 19 + * would cause the following to fail, because the required return value 20 + * is 0: 21 + * return (a * 0x3) & 0x4); 22 + */ 23 + asm volatile ("\ 24 + call %[bpf_get_prandom_u32];\ 25 + r0 &= 0x2;\ 26 + r0 |= 0x1;\ 27 + r0 *= 0x3;\ 28 + r0 &= 0x4;\ 29 + if r0 != 0 goto l0_%=;\ 30 + r0 = 0;\ 31 + goto l1_%=;\ 32 + l0_%=:\ 33 + r0 = 1;\ 34 + l1_%=:\ 35 + " : 36 + : __imm(bpf_get_prandom_u32) 37 + : __clobber_all); 38 + }