netdev - selftests/bpf: arm64: test_verifier 13 "FAIL retval 65507 != -29 (run 1/1)"

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20200226134458.GA65282@harukaze>
Date:   Wed, 26 Feb 2020 14:44:58 +0100
From:   Paolo Pisati <paolo.pisati@...onical.com>
To:     bpf@...r.kernel.org
Cc:     Daniel Borkmann <daniel@...earbox.net>,
        Alexei Starovoitov <ast@...nel.org>,
        Zi Shen Lim <zlim.lnx@...il.com>,
        Martin KaFai Lau <kafai@...com>,
        Song Liu <songliubraving@...com>, Yonghong Song <yhs@...com>,
        Andrii Nakryiko <andriin@...com>, netdev@...r.kernel.org
Subject: selftests/bpf: arm64: test_verifier 13 "FAIL retval 65507 != -29
 (run 1/1)"

This particular selftest fails on arm64 (x86-64 is fine):

$ sudo ./tools/testing/selftests/bpf/test_verifier -v 13
#13/p valid read map access into a read-only array 2 , verifier log:
0: (7a) *(u64 *)(r10 -8) = 0
1: (bf) r2 = r10
2: (07) r2 += -8
3: (18) r1 = 0xffff00becd0d8c00
5: (85) call bpf_map_lookup_elem#1
6: (15) if r0 == 0x0 goto pc+6
 R0_w=map_value(id=0,off=0,ks=4,vs=48,imm=0) R10=fp0 fp-8_w=mmmmmmmm
7: (bf) r1 = r0
8: (b7) r2 = 4
9: (b7) r3 = 0
10: (b7) r4 = 0
11: (b7) r5 = 0
12: (85) call bpf_csum_diff#28
 R0_w=map_value(id=0,off=0,ks=4,vs=48,imm=0)
R1_w=map_value(id=0,off=0,ks=4,vs=48,imm=0) R2_w=inv4 R3_w=inv0 R4_w=inv0
R5_w=inv0 R10=fp0 fp-8_w=mmmmmmmm
last_idx 12 first_idx 0
regs=4 stack=0 before 11: (b7) r5 = 0
regs=4 stack=0 before 10: (b7) r4 = 0
regs=4 stack=0 before 9: (b7) r3 = 0
regs=4 stack=0 before 8: (b7) r2 = 4
last_idx 12 first_idx 0
regs=10 stack=0 before 11: (b7) r5 = 0
regs=10 stack=0 before 10: (b7) r4 = 0
13: (95) exit

from 6 to 13: safe
processed 14 insns (limit 1000000) max_states_per_insn 0 total_states 1
peak_states 1 mark_read 1
FAIL retval 65507 != -29 (run 1/1) 
0: (7a) *(u64 *)(r10 -8) = 0
1: (bf) r2 = r10
2: (07) r2 += -8
3: (18) r1 = 0xffff00becd0d8c00
5: (85) call bpf_map_lookup_elem#1
6: (15) if r0 == 0x0 goto pc+6
 R0_w=map_value(id=0,off=0,ks=4,vs=48,imm=0) R10=fp0 fp-8_w=mmmmmmmm
7: (bf) r1 = r0
8: (b7) r2 = 4
9: (b7) r3 = 0
10: (b7) r4 = 0
11: (b7) r5 = 0
12: (85) call bpf_csum_diff#28
 R0_w=map_value(id=0,off=0,ks=4,vs=48,imm=0)
R1_w=map_value(id=0,off=0,ks=4,vs=48,imm=0) R2_w=inv4 R3_w=inv0 R4_w=inv0
R5_w=inv0 R10=fp0 fp-8_w=mmmmmmmm
last_idx 12 first_idx 0
regs=4 stack=0 before 11: (b7) r5 = 0
regs=4 stack=0 before 10: (b7) r4 = 0
regs=4 stack=0 before 9: (b7) r3 = 0
regs=4 stack=0 before 8: (b7) r2 = 4
last_idx 12 first_idx 0
regs=10 stack=0 before 11: (b7) r5 = 0
regs=10 stack=0 before 10: (b7) r4 = 0
13: (95) exit

from 6 to 13: safe
processed 14 insns (limit 1000000) max_states_per_insn 0 total_states 1
peak_states 1 mark_read 1
Summary: 0 PASSED, 0 SKIPPED, 1 FAILED

Above output without line wrapping: https://paste.ubuntu.com/p/qhCK8nJjKw/

Kernel version 5.4.21, config: https://paste.ubuntu.com/p/G3yxvvjRMS/

Anything i can do to help debug this?
-- 
bye,
p.