selftests/bpf: Test tracking spilled unbounded scalars

The previous commit added tracking for unbounded scalars on spill. Add
the test case to check the new functionality.

Signed-off-by: Maxim Mikityanskiy <maxim@isovalent.com>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Acked-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://lore.kernel.org/bpf/20240127175237.526726-3-maxtram95@gmail.com

diff --git a/tools/testing/selftests/bpf/progs/verifier_spill_fill.c b/tools/testing/selftests/bpf/progs/verifier_spill_fill.c
index 317806451762697b5cb5a6b76dc787792b82b7d4..f9803005e1c0b6300999ebeab2332159c4a49653 100644 (file)
--- a/tools/testing/selftests/bpf/progs/verifier_spill_fill.c
+++ b/tools/testing/selftests/bpf/progs/verifier_spill_fill.c
@@ -940,4 +940,31 @@ l0_%=:     r0 = 0;                                         \
        : __clobber_all);
 }
 
+SEC("xdp")
+__description("spill unbounded reg, then range check src")
+__success __retval(0)
+__naked void spill_unbounded(void)
+{
+       asm volatile ("                                 \
+       /* Produce an unbounded scalar. */              \
+       call %[bpf_get_prandom_u32];                    \
+       /* Spill r0 to stack. */                        \
+       *(u64*)(r10 - 8) = r0;                          \
+       /* Boundary check on r0. */                     \
+       if r0 > 16 goto l0_%=;                          \
+       /* Fill r0 from stack. */                       \
+       r0 = *(u64*)(r10 - 8);                          \
+       /* Boundary check on r0 with predetermined result. */\
+       if r0 <= 16 goto l0_%=;                         \
+       /* Dead branch: the verifier should prune it. Do an invalid memory\
+        * access if the verifier follows it.           \
+        */                                             \
+       r0 = *(u64*)(r9 + 0);                           \
+l0_%=: r0 = 0;                                         \
+       exit;                                           \
+"      :
+       : __imm(bpf_get_prandom_u32)
+       : __clobber_all);
+}
+
 char _license[] SEC("license") = "GPL";