selftests/bpf: Verifier test on refill from a smaller spill

This patch adds a verifier test to ensure the verifier can read 8 bytes
from the stack after two 32bit write at fp-4 and fp-8. The test is similar
to the reported case from bcc [0].

  [0] https://github.com/iovisor/bcc/pull/3683

Signed-off-by: Martin KaFai Lau <kafai@fb.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Yonghong Song <yhs@fb.com>
Link: https://lore.kernel.org/bpf/20211102064541.316414-1-kafai@fb.com

diff --git a/tools/testing/selftests/bpf/verifier/spill_fill.c b/tools/testing/selftests/bpf/verifier/spill_fill.c
index c9991c3..7ab3de1 100644 (file)
--- a/tools/testing/selftests/bpf/verifier/spill_fill.c
+++ b/tools/testing/selftests/bpf/verifier/spill_fill.c
@@ -265,3 +265,20 @@
        .result = ACCEPT,
        .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 },
+{
+       "Spill a u32 scalar at fp-4 and then at fp-8",
+       .insns = {
+       /* r4 = 4321 */
+       BPF_MOV32_IMM(BPF_REG_4, 4321),
+       /* *(u32 *)(r10 -4) = r4 */
+       BPF_STX_MEM(BPF_W, BPF_REG_10, BPF_REG_4, -4),
+       /* *(u32 *)(r10 -8) = r4 */
+       BPF_STX_MEM(BPF_W, BPF_REG_10, BPF_REG_4, -8),
+       /* r4 = *(u64 *)(r10 -8) */
+       BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_10, -8),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .result = ACCEPT,
+       .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+},