diff options
| author | Jean-Philippe Brucker <jean-philippe@linaro.org> | 2020-12-08 19:01:52 +0100 |
|---|---|---|
| committer | Alexei Starovoitov <ast@kernel.org> | 2020-12-10 13:11:30 -0800 |
| commit | 511a76bcb0ce242a19153658b25437906cc6070e (patch) | |
| tree | 68a8f3490dea0d331566cf6db307ca05d8b0b41a /tools/testing/selftests/bpf/verifier/array_access.c | |
| parent | b02709587ea3d699a608568ee8157d8db4fd8cae (diff) | |
| download | linux-511a76bcb0ce242a19153658b25437906cc6070e.tar.gz linux-511a76bcb0ce242a19153658b25437906cc6070e.tar.bz2 linux-511a76bcb0ce242a19153658b25437906cc6070e.zip | |
selftests/bpf: Add test for signed 32-bit bound check bug
After a 32-bit load followed by a branch, the verifier would reduce the
maximum bound of the register to 0x7fffffff, allowing a user to bypass
bound checks. Ensure such a program is rejected.
In the second test, the 64-bit compare should not sufficient to
determine whether the signed 32-bit lower bound is 0, so the verifier
should reject the second branch.
Signed-off-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
Acked-by: John Fastabend <john.fastabend@gmail.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Diffstat (limited to 'tools/testing/selftests/bpf/verifier/array_access.c')
0 files changed, 0 insertions, 0 deletions