bpf: add test cases for non-pointer sanitiation logic

Add two additional tests for further asserting the
BPF_ALU_NON_POINTER logic with cases that were missed
previously.

Cc: Marek Majkowski <marek@cloudflare.com>
Cc: Arthur Fabre <afabre@cloudflare.com>
Acked-by: Song Liu <songliubraving@fb.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>

diff --git a/tools/testing/selftests/bpf/verifier/value_ptr_arith.c b/tools/testing/selftests/bpf/verifier/value_ptr_arith.c
index 4b721a7..c3de1a2 100644 (file)
--- a/tools/testing/selftests/bpf/verifier/value_ptr_arith.c
+++ b/tools/testing/selftests/bpf/verifier/value_ptr_arith.c
@@ -173,7 +173,7 @@
        .retval = 0,
 },
 {
-       "sanitation: alu with different scalars",
+       "sanitation: alu with different scalars 1",
        .insns = {
        BPF_MOV64_IMM(BPF_REG_0, 1),
        BPF_LD_MAP_FD(BPF_REG_ARG1, 0),
@@ -199,6 +199,48 @@
        .retval = 0x100000,
 },
 {
+       "sanitation: alu with different scalars 2",
+       .insns = {
+       BPF_MOV64_IMM(BPF_REG_0, 1),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_FP),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16),
+       BPF_ST_MEM(BPF_DW, BPF_REG_FP, -16, 0),
+       BPF_EMIT_CALL(BPF_FUNC_map_delete_elem),
+       BPF_MOV64_REG(BPF_REG_7, BPF_REG_0),
+       BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_FP),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16),
+       BPF_EMIT_CALL(BPF_FUNC_map_delete_elem),
+       BPF_MOV64_REG(BPF_REG_6, BPF_REG_0),
+       BPF_MOV64_REG(BPF_REG_8, BPF_REG_6),
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_8, BPF_REG_7),
+       BPF_MOV64_REG(BPF_REG_0, BPF_REG_8),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_array_48b = { 1 },
+       .result = ACCEPT,
+       .retval = -EINVAL * 2,
+},
+{
+       "sanitation: alu with different scalars 3",
+       .insns = {
+       BPF_MOV64_IMM(BPF_REG_0, EINVAL),
+       BPF_ALU64_IMM(BPF_MUL, BPF_REG_0, -1),
+       BPF_MOV64_REG(BPF_REG_7, BPF_REG_0),
+       BPF_MOV64_IMM(BPF_REG_0, EINVAL),
+       BPF_ALU64_IMM(BPF_MUL, BPF_REG_0, -1),
+       BPF_MOV64_REG(BPF_REG_6, BPF_REG_0),
+       BPF_MOV64_REG(BPF_REG_8, BPF_REG_6),
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_8, BPF_REG_7),
+       BPF_MOV64_REG(BPF_REG_0, BPF_REG_8),
+       BPF_EXIT_INSN(),
+       },
+       .result = ACCEPT,
+       .retval = -EINVAL * 2,
+},
+{
        "map access: value_ptr += known scalar, upper oob arith, test 1",
        .insns = {
        BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),