selftests/bpf: test cases for bpf_loop SCC and state graph backedges

Test for state graph backedges accumulation for SCCs formed by
bpf_loop(). Equivalent to the following C program:

  int main(void) {
    1: fp[-8] = bpf_get_prandom_u32();
    2: fp[-16] = -32;                       // used in a memory access below
    3: bpf_loop(7, loop_cb4, fp, 0);
    4: return 0;
  }

  int loop_cb4(int i, void *ctx) {
    5: if (unlikely(ctx[-8] > bpf_get_prandom_u32()))
    6:   *(u64 *)(fp + ctx[-16]) = 42;      // aligned access expected
    7: if (unlikely(fp[-8] > bpf_get_prandom_u32()))
    8:   ctx[-16] = -31;                    // makes said access unaligned
    9: return 0;
  }

If state graph backedges are not accumulated properly at the SCC
formed by loop_cb4() call from bpf_loop(), the state {ctx[-16]=-32}
injected at instruction 9 on verification path 1,2,3,5,7,9,4 would be
considered fully verified and would lack precision mark for ctx[-16].
This would lead to early pruning of verification path 1,2,3,5,7,8,9 in
state {ctx[-16]=-31}, which in turn leads to the incorrect assumption
that the above program is safe.

Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://lore.kernel.org/r/20251229-scc-for-callbacks-v1-2-ceadfe679900@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>

diff --git a/tools/testing/selftests/bpf/progs/iters.c b/tools/testing/selftests/bpf/progs/iters.c
index 7dd92a303bf6b3f0fc2962f6ce6cc453350561e3..69061f0309579eada74e5f2a68640470ff94a8b3 100644 (file)
--- a/tools/testing/selftests/bpf/progs/iters.c
+++ b/tools/testing/selftests/bpf/progs/iters.c
@@ -1926,4 +1926,79 @@ static int loop1_wrapper(void)
        );
 }
 
+/*
+ * This is similar to a test case absent_mark_in_the_middle_state(),
+ * but adapted for use with bpf_loop().
+ */
+SEC("raw_tp")
+__flag(BPF_F_TEST_STATE_FREQ)
+__failure __msg("math between fp pointer and register with unbounded min value is not allowed")
+__naked void absent_mark_in_the_middle_state4(void)
+{
+       /*
+        * Equivalent to a C program below:
+        *
+        * int main(void) {
+        *   fp[-8] = bpf_get_prandom_u32();
+        *   fp[-16] = -32;                    // used in a memory access below
+        *   bpf_loop(7, loop_cb4, fp, 0);
+        *   return 0;
+        * }
+        *
+        * int loop_cb4(int i, void *ctx) {
+        *   if (unlikely(ctx[-8] > bpf_get_prandom_u32()))
+        *     *(u64 *)(fp + ctx[-16]) = 42;   // aligned access expected
+        *   if (unlikely(fp[-8] > bpf_get_prandom_u32()))
+        *     ctx[-16] = -31;                 // makes said access unaligned
+        *   return 0;
+        * }
+        */
+       asm volatile (
+               "call %[bpf_get_prandom_u32];"
+               "r8 = r0;"
+               "*(u64 *)(r10 - 8) = r0;"
+               "*(u64 *)(r10 - 16) = -32;"
+               "r1 = 7;"
+               "r2 = loop_cb4 ll;"
+               "r3 = r10;"
+               "r4 = 0;"
+               "call %[bpf_loop];"
+               "r0 = 0;"
+               "exit;"
+               :
+               : __imm(bpf_loop),
+                 __imm(bpf_get_prandom_u32)
+               : __clobber_all
+       );
+}
+
+__used __naked
+static void loop_cb4(void)
+{
+       asm volatile (
+               "r9 = r2;"
+               "r8 = *(u64 *)(r9 - 8);"
+               "r6 = *(u64 *)(r9 - 16);"
+               "call %[bpf_get_prandom_u32];"
+               "if r0 > r8 goto use_fp16_%=;"
+       "1:"
+               "call %[bpf_get_prandom_u32];"
+               "if r0 > r8 goto update_fp16_%=;"
+       "2:"
+               "r0 = 0;"
+               "exit;"
+       "use_fp16_%=:"
+               "r1 = r10;"
+               "r1 += r6;"
+               "*(u64 *)(r1 + 0) = 42;"
+               "goto 1b;"
+       "update_fp16_%=:"
+               "*(u64 *)(r9 - 16) = -31;"
+               "goto 2b;"
+               :
+               : __imm(bpf_get_prandom_u32)
+               : __clobber_all
+       );
+}
+
 char _license[] SEC("license") = "GPL";