Re: [PATCH net-next 3/4] bpf/verifier: when pruning a branch, ignore its write marks

On 8/22/17 11:03 AM, Edward Cree wrote:

On 22/08/17 16:50, Edward Cree wrote:

quoted

On 22/08/17 16:24, Alexei Starovoitov wrote:

quoted

Do you have a test case for this by any chance?

I think something like
    if (cond)
        r0=0;
    if (cond)
        r0=0;
    return r0;
might tickle the bug, but I'm not sure.

It turns out that (cond) has to be constructed not to alter our knowledge
 of whatever register we're testing, but apart from that, this works.
    {
        "liveness pruning and write screening",
        .insns = {
            /* Get an unknown value */
            BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 0),
            /* branch conditions teach us nothing about R2 */
            BPF_JMP_IMM(BPF_JGE, BPF_REG_2, 0, 1),
            BPF_MOV64_IMM(BPF_REG_0, 0),
            BPF_JMP_IMM(BPF_JGE, BPF_REG_2, 0, 1),
            BPF_MOV64_IMM(BPF_REG_0, 0),
            BPF_EXIT_INSN(),
        },
        .errstr = "R0 !read_ok",
        .result = REJECT,
        .prog_type = BPF_PROG_TYPE_LWT_IN,
    },
This test fails on net-next, but passes with my patch.
I'll include it in the next spin of the series.

nice. thanks for the test!