Two programs, one per field width that coerce_subreg_to_size_sx() handles. Each builds a 32-bit range that straddles zero but still fits the target field, so the sign extension is a no-op: [-63, 0] for (s8) and [-4095, 0] for (s16). The guard that follows can only be resolved statically if the range survives, and it protects a div by zero, so a widened range is a verification failure rather than a silently weaker test.
Signed-off-by: Vineet Gupta <[email protected]> --- v3: was v2 6/13. - moved with patch 1, and narrowed to the 32-bit mov to match it. The ALU64 forms v2 tested now pass with or without the patch. .../selftests/bpf/progs/verifier_movsx.c | 55 +++++++++++++++++++ 1 file changed, 55 insertions(+) diff --git a/tools/testing/selftests/bpf/progs/verifier_movsx.c b/tools/testing/selftests/bpf/progs/verifier_movsx.c index 195b27a51224..3fcd03b7a547 100644 --- a/tools/testing/selftests/bpf/progs/verifier_movsx.c +++ b/tools/testing/selftests/bpf/progs/verifier_movsx.c @@ -202,6 +202,61 @@ l0_%=: \ : __clobber_all); } +/* + * A 32-bit range that already fits the field is unchanged by the sign + * extension. Both of these straddle zero, so reg_umax() is huge and the high + * bits of s32_min and s32_max differ: neither of the gates that predate + * testing the range against the field can keep it. The guard that follows can + * only be resolved statically if the range survives, and it protects a div by + * zero, so a widened range is a verification failure rather than a silently + * weaker test. + */ +SEC("socket") +__description("MOV32SX, S8, negative range is preserved") +__success __success_unpriv __retval(0) +__naked void mov32sx_s8_negative_range(void) +{ + asm volatile (" \ + call %[bpf_get_prandom_u32]; \ + w0 &= 0x3f; \ + w0 -= 0x3f; \ + /* w0 is [-63, 0], already a valid s8 */ \ + w0 = (s8)w0; \ + if w0 s< -0x3f goto l0_%=; \ + w0 = 0; \ + exit; \ +l0_%=: \ + /* unreachable unless the range was widened */ \ + w0 /= 0; \ + exit; \ +" : + : __imm(bpf_get_prandom_u32) + : __clobber_all); +} + +SEC("socket") +__description("MOV32SX, S16, negative range is preserved") +__success __success_unpriv __retval(0) +__naked void mov32sx_s16_negative_range(void) +{ + asm volatile (" \ + call %[bpf_get_prandom_u32]; \ + w0 &= 0xfff; \ + w0 -= 0xfff; \ + /* w0 is [-4095, 0], already a valid s16 */ \ + w0 = (s16)w0; \ + if w0 s< -0xfff goto l0_%=; \ + w0 = 0; \ + exit; \ +l0_%=: \ + /* unreachable unless the range was widened */ \ + w0 /= 0; \ + exit; \ +" : + : __imm(bpf_get_prandom_u32) + : __clobber_all); +} + SEC("socket") __description("MOV64SX, S16, R10 Sign Extension") __failure __msg("R1 type=scalar expected=fp, pkt, pkt_meta, map_key, map_value, mem, ringbuf_mem, buf, trusted_ptr_") -- 2.53.0-Meta
