kernel/tools/testing/selftests/bpf/verifier/loops1.c

{
	"bounded loop, count to 4",
	.insns = {
	BPF_MOV64_IMM(BPF_REG_0, 0),
	BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 1),
	BPF_JMP_IMM(BPF_JLT, BPF_REG_0, 4, -2),
	BPF_EXIT_INSN(),
	},
	.result = ACCEPT,
	.prog_type = BPF_PROG_TYPE_TRACEPOINT,
	.retval = 4,
},
{
	"bounded loop, count to 20",
	.insns = {
	BPF_MOV64_IMM(BPF_REG_0, 0),
	BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 3),
	BPF_JMP_IMM(BPF_JLT, BPF_REG_0, 20, -2),
	BPF_EXIT_INSN(),
	},
	.result = ACCEPT,
	.prog_type = BPF_PROG_TYPE_TRACEPOINT,
},
{
	"bounded loop, count from positive unknown to 4",
	.insns = {
	BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_get_prandom_u32),
	BPF_JMP_IMM(BPF_JSLT, BPF_REG_0, 0, 2),
	BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 1),
	BPF_JMP_IMM(BPF_JLT, BPF_REG_0, 4, -2),
	BPF_EXIT_INSN(),
	},
	.result = ACCEPT,
	.prog_type = BPF_PROG_TYPE_TRACEPOINT,
	.retval = 4,
},
{
	"bounded loop, count from totally unknown to 4",
	.insns = {
	BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_get_prandom_u32),
	BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 1),
	BPF_JMP_IMM(BPF_JLT, BPF_REG_0, 4, -2),
	BPF_EXIT_INSN(),
	},
	.result = ACCEPT,
	.prog_type = BPF_PROG_TYPE_TRACEPOINT,
},
{
	"bounded loop, count to 4 with equality",
	.insns = {
		BPF_MOV64_IMM(BPF_REG_0, 0),
		BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 1),
		BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 4, -2),
		BPF_EXIT_INSN(),
	},
	.result = ACCEPT,
	.prog_type = BPF_PROG_TYPE_TRACEPOINT,
},
{
	"bounded loop, start in the middle",
	.insns = {
		BPF_MOV64_IMM(BPF_REG_0, 0),
		BPF_JMP_A(1),
		BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 1),
		BPF_JMP_IMM(BPF_JLT, BPF_REG_0, 4, -2),
		BPF_EXIT_INSN(),
	},
	.result = REJECT,
	.errstr = "back-edge",
	.prog_type = BPF_PROG_TYPE_TRACEPOINT,
	.retval = 4,
},
{
	"bounded loop containing a forward jump",
	.insns = {
		BPF_MOV64_IMM(BPF_REG_0, 0),
		BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 1),
		BPF_JMP_REG(BPF_JEQ, BPF_REG_0, BPF_REG_0, 0),
		BPF_JMP_IMM(BPF_JLT, BPF_REG_0, 4, -3),
		BPF_EXIT_INSN(),
	},
	.result = ACCEPT,
	.prog_type = BPF_PROG_TYPE_TRACEPOINT,
	.retval = 4,
},
{
	"bounded loop that jumps out rather than in",
	.insns = {
	BPF_MOV64_IMM(BPF_REG_6, 0),
	BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
	BPF_JMP_IMM(BPF_JGT, BPF_REG_6, 10000, 2),
	BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_get_prandom_u32),
	BPF_JMP_A(-4),
	BPF_EXIT_INSN(),
	},
	.result = ACCEPT,
	.prog_type = BPF_PROG_TYPE_TRACEPOINT,
},
{
	"infinite loop after a conditional jump",
	.insns = {
	BPF_MOV64_IMM(BPF_REG_0, 5),
	BPF_JMP_IMM(BPF_JLT, BPF_REG_0, 4, 2),
	BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 1),
	BPF_JMP_A(-2),
	BPF_EXIT_INSN(),
	},
	.result = REJECT,
	.errstr = "program is too large",
	.prog_type = BPF_PROG_TYPE_TRACEPOINT,
},
{
	"bounded recursion",
	.insns = {
	BPF_MOV64_IMM(BPF_REG_1, 0),
	BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
	BPF_EXIT_INSN(),
	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 1),
	BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
	BPF_JMP_IMM(BPF_JLT, BPF_REG_1, 4, 1),
	BPF_EXIT_INSN(),
	BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, -5),
	BPF_EXIT_INSN(),
	},
	.result = REJECT,
	.errstr = "back-edge",
	.prog_type = BPF_PROG_TYPE_TRACEPOINT,
},
{
	"infinite loop in two jumps",
	.insns = {
	BPF_MOV64_IMM(BPF_REG_0, 0),
	BPF_JMP_A(0),
	BPF_JMP_IMM(BPF_JLT, BPF_REG_0, 4, -2),
	BPF_EXIT_INSN(),
	},
	.result = REJECT,
	.errstr = "loop detected",
	.prog_type = BPF_PROG_TYPE_TRACEPOINT,
},
{
	"infinite loop: three-jump trick",
	.insns = {
	BPF_MOV64_IMM(BPF_REG_0, 0),
	BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 1),
	BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 1),
	BPF_JMP_IMM(BPF_JLT, BPF_REG_0, 2, 1),
	BPF_EXIT_INSN(),
	BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 1),
	BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 1),
	BPF_JMP_IMM(BPF_JLT, BPF_REG_0, 2, 1),
	BPF_EXIT_INSN(),
	BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 1),
	BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 1),
	BPF_JMP_IMM(BPF_JLT, BPF_REG_0, 2, -11),
	BPF_EXIT_INSN(),
	},
	.result = REJECT,
	.errstr = "loop detected",
	.prog_type = BPF_PROG_TYPE_TRACEPOINT,
},
{
	"not-taken loop with back jump to 1st insn",
	.insns = {
	BPF_MOV64_IMM(BPF_REG_0, 123),
	BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 4, -2),
	BPF_EXIT_INSN(),
	},
	.result = ACCEPT,
	.prog_type = BPF_PROG_TYPE_XDP,
	.retval = 123,
},
{
	"taken loop with back jump to 1st insn",
	.insns = {
	BPF_MOV64_IMM(BPF_REG_1, 10),
	BPF_MOV64_IMM(BPF_REG_2, 0),
	BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
	BPF_EXIT_INSN(),
	BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_1),
	BPF_ALU64_IMM(BPF_SUB, BPF_REG_1, 1),
	BPF_JMP_IMM(BPF_JNE, BPF_REG_1, 0, -3),
	BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
	BPF_EXIT_INSN(),
	},
	.result = ACCEPT,
	.prog_type = BPF_PROG_TYPE_XDP,
	.retval = 55,
},
{
	"taken loop with back jump to 1st insn, 2",
	.insns = {
	BPF_MOV64_IMM(BPF_REG_1, 10),
	BPF_MOV64_IMM(BPF_REG_2, 0),
	BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
	BPF_EXIT_INSN(),
	BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_1),
	BPF_ALU64_IMM(BPF_SUB, BPF_REG_1, 1),
	BPF_JMP32_IMM(BPF_JNE, BPF_REG_1, 0, -3),
	BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
	BPF_EXIT_INSN(),
	},
	.result = ACCEPT,
	.prog_type = BPF_PROG_TYPE_XDP,
	.retval = 55,
},