selftests/bpf: Add tests for BPF_NEG range tracking logic

BPF_REG now has range tracking logic. Add selftests for BPF_NEG.
Specifically, return value of LSM hook lsm.s/socket_connect is used to
show that the verifer tracks BPF_NEG(1) falls in the [-4095, 0] range;
while BPF_NEG(100000) does not fall in that range.

Signed-off-by: Song Liu <song@kernel.org>
Acked-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://lore.kernel.org/r/20250625164025.3310203-3-song@kernel.org
Signed-off-by: Alexei Starovoitov <ast@kernel.org>

diff --git a/tools/testing/selftests/bpf/progs/verifier_precision.c b/tools/testing/selftests/bpf/progs/verifier_precision.c
index 9fe5d255ee377a36116bef76c35de5c1b8d3233c..73fee2aec6983c5694ddd8a118fc75ba2a9b0420 100644 (file)
--- a/tools/testing/selftests/bpf/progs/verifier_precision.c
+++ b/tools/testing/selftests/bpf/progs/verifier_precision.c
@@ -231,4 +231,74 @@ __naked void bpf_cond_op_not_r10(void)
        ::: __clobber_all);
 }
 
+SEC("lsm.s/socket_connect")
+__success __log_level(2)
+__msg("0: (b7) r0 = 1                        ; R0_w=1")
+__msg("1: (84) w0 = -w0                      ; R0_w=0xffffffff")
+__msg("mark_precise: frame0: last_idx 2 first_idx 0 subseq_idx -1")
+__msg("mark_precise: frame0: regs=r0 stack= before 1: (84) w0 = -w0")
+__msg("mark_precise: frame0: regs=r0 stack= before 0: (b7) r0 = 1")
+__naked int bpf_neg_2(void)
+{
+       /*
+        * lsm.s/socket_connect requires a return value within [-4095, 0].
+        * Returning -1 is allowed
+        */
+       asm volatile (
+       "r0 = 1;"
+       "w0 = -w0;"
+       "exit;"
+       ::: __clobber_all);
+}
+
+SEC("lsm.s/socket_connect")
+__failure __msg("At program exit the register R0 has")
+__naked int bpf_neg_3(void)
+{
+       /*
+        * lsm.s/socket_connect requires a return value within [-4095, 0].
+        * Returning -10000 is not allowed.
+        */
+       asm volatile (
+       "r0 = 10000;"
+       "w0 = -w0;"
+       "exit;"
+       ::: __clobber_all);
+}
+
+SEC("lsm.s/socket_connect")
+__success __log_level(2)
+__msg("0: (b7) r0 = 1                        ; R0_w=1")
+__msg("1: (87) r0 = -r0                      ; R0_w=-1")
+__msg("mark_precise: frame0: last_idx 2 first_idx 0 subseq_idx -1")
+__msg("mark_precise: frame0: regs=r0 stack= before 1: (87) r0 = -r0")
+__msg("mark_precise: frame0: regs=r0 stack= before 0: (b7) r0 = 1")
+__naked int bpf_neg_4(void)
+{
+       /*
+        * lsm.s/socket_connect requires a return value within [-4095, 0].
+        * Returning -1 is allowed
+        */
+       asm volatile (
+       "r0 = 1;"
+       "r0 = -r0;"
+       "exit;"
+       ::: __clobber_all);
+}
+
+SEC("lsm.s/socket_connect")
+__failure __msg("At program exit the register R0 has")
+__naked int bpf_neg_5(void)
+{
+       /*
+        * lsm.s/socket_connect requires a return value within [-4095, 0].
+        * Returning -10000 is not allowed.
+        */
+       asm volatile (
+       "r0 = 10000;"
+       "r0 = -r0;"
+       "exit;"
+       ::: __clobber_all);
+}
+
 char _license[] SEC("license") = "GPL";