selftests/bpf: Add verifier test for release_reference()

Add a test case to ensure that released pointer registers will not be
leaked into the map.

Before fix:

  ./test_verifier 984
    984/u reference tracking: try to leak released ptr reg FAIL
    Unexpected success to load!
    verification time 67 usec
    stack depth 4
    processed 23 insns (limit 1000000) max_states_per_insn 0 total_states 2
    peak_states 2 mark_read 1
    984/p reference tracking: try to leak released ptr reg OK
    Summary: 1 PASSED, 0 SKIPPED, 1 FAILED

After fix:

  ./test_verifier 984
    984/u reference tracking: try to leak released ptr reg OK
    984/p reference tracking: try to leak released ptr reg OK
    Summary: 2 PASSED, 0 SKIPPED, 0 FAILED

Signed-off-by: Youlin Li <liulin063@gmail.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/bpf/20221103093440.3161-2-liulin063@gmail.com

diff --git a/tools/testing/selftests/bpf/verifier/ref_tracking.c b/tools/testing/selftests/bpf/verifier/ref_tracking.c
index f18ce86..fd683a3 100644 (file)
--- a/tools/testing/selftests/bpf/verifier/ref_tracking.c
+++ b/tools/testing/selftests/bpf/verifier/ref_tracking.c
@@ -1044,3 +1044,39 @@
        .result_unpriv = REJECT,
        .errstr_unpriv = "unknown func",
 },
+{
+       "reference tracking: try to leak released ptr reg",
+       .insns = {
+               BPF_MOV64_IMM(BPF_REG_0, 0),
+               BPF_STX_MEM(BPF_W, BPF_REG_10, BPF_REG_0, -4),
+               BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+               BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4),
+               BPF_LD_MAP_FD(BPF_REG_1, 0),
+               BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
+               BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
+               BPF_EXIT_INSN(),
+               BPF_MOV64_REG(BPF_REG_9, BPF_REG_0),
+
+               BPF_MOV64_IMM(BPF_REG_0, 0),
+               BPF_LD_MAP_FD(BPF_REG_1, 0),
+               BPF_MOV64_IMM(BPF_REG_2, 8),
+               BPF_MOV64_IMM(BPF_REG_3, 0),
+               BPF_EMIT_CALL(BPF_FUNC_ringbuf_reserve),
+               BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
+               BPF_EXIT_INSN(),
+               BPF_MOV64_REG(BPF_REG_8, BPF_REG_0),
+
+               BPF_MOV64_REG(BPF_REG_1, BPF_REG_8),
+               BPF_MOV64_IMM(BPF_REG_2, 0),
+               BPF_EMIT_CALL(BPF_FUNC_ringbuf_discard),
+               BPF_MOV64_IMM(BPF_REG_0, 0),
+
+               BPF_STX_MEM(BPF_DW, BPF_REG_9, BPF_REG_8, 0),
+               BPF_EXIT_INSN()
+       },
+       .fixup_map_array_48b = { 4 },
+       .fixup_map_ringbuf = { 11 },
+       .result = ACCEPT,
+       .result_unpriv = REJECT,
+       .errstr_unpriv = "R8 !read_ok"
+},