13 failures reported in test_verifier from ubuntu_bpf with Mantic 6.5 AMD64/ARM64/s390x

[Po-Hsu Lin]

Issue found with Mantic 6.5 AMD64/ARM64/s390x

This is not a regression, it's just that we don't have a bug report for this.

There are 13 failures reported in this test_verifier test:
#118/p calls: invalid kfunc call: ptr_to_mem to struct with non-scalar FAIL
Unexpected verifier log!
EXP: arg#0 pointer type STRUCT prog_test_fail1 must point to scalar
RES:
FAIL
Unexpected error message!
    EXP: arg#0 pointer type STRUCT prog_test_fail1 must point to scalar
    RES: R0 !read_ok
verification time 26 usec
stack depth 0
processed 4 insns (limit 1000000) max_states_per_insn 0 total_states 0 peak_states 0 mark_read 0

R0 !read_ok
verification time 26 usec
stack depth 0
processed 4 insns (limit 1000000) max_states_per_insn 0 total_states 0 peak_states 0 mark_read 0

#119/p calls: invalid kfunc call: ptr_to_mem to struct with nesting depth > 4 FAIL
Unexpected verifier log!
EXP: max struct nesting depth exceeded
arg#0 pointer type STRUCT prog_test_fail2
RES:
FAIL
Unexpected error message!
    EXP: max struct nesting depth exceeded
arg#0 pointer type STRUCT prog_test_fail2
    RES: R0 !read_ok
verification time 18 usec
stack depth 0
processed 4 insns (limit 1000000) max_states_per_insn 0 total_states 0 peak_states 0 mark_read 0

R0 !read_ok
verification time 18 usec
stack depth 0
processed 4 insns (limit 1000000) max_states_per_insn 0 total_states 0 peak_states 0 mark_read 0

#120/p calls: invalid kfunc call: ptr_to_mem to struct with FAM FAIL
Unexpected verifier log!
EXP: arg#0 pointer type STRUCT prog_test_fail3 must point to scalar
RES:
FAIL
Unexpected error message!
    EXP: arg#0 pointer type STRUCT prog_test_fail3 must point to scalar
    RES: R0 !read_ok
verification time 18 usec
stack depth 0
processed 4 insns (limit 1000000) max_states_per_insn 0 total_states 0 peak_states 0 mark_read 0

R0 !read_ok
verification time 18 usec
stack depth 0
processed 4 insns (limit 1000000) max_states_per_insn 0 total_states 0 peak_states 0 mark_read 0

#121/p calls: invalid kfunc call: reg->type != PTR_TO_CTX FAIL
Unexpected verifier log!
EXP: R1 must have zero offset when passed to release func or trusted arg to kfunc
RES:
FAIL
Unexpected error message!
    EXP: R1 must have zero offset when passed to release func or trusted arg to kfunc
    RES: R0 !read_ok
verification time 13 usec
stack depth 0
processed 4 insns (limit 1000000) max_states_per_insn 0 total_states 0 peak_states 0 mark_read 0

R0 !read_ok
verification time 13 usec
stack depth 0
processed 4 insns (limit 1000000) max_states_per_insn 0 total_states 0 peak_states 0 mark_read 0

#122/p calls: invalid kfunc call: void * not allowed in func proto without mem size arg FAIL
Unexpected verifier log!
EXP: arg#0 pointer type UNKNOWN must point to scalar
RES:
FAIL
Unexpected error message!
    EXP: arg#0 pointer type UNKNOWN must point to scalar
    RES: R0 !read_ok
verification time 12 usec
stack depth 0
processed 4 insns (limit 1000000) max_states_per_insn 0 total_states 0 peak_states 0 mark_read 0

R0 !read_ok
verification time 12 usec
stack depth 0
processed 4 insns (limit 1000000) max_states_per_insn 0 total_states 0 peak_states 0 mark_read 0

#123/p calls: trigger reg2btf_ids[reg->type] for reg->type > __BPF_REG_TYPE_MAX FAIL
Unexpected verifier log!
EXP: Possibly NULL pointer passed to trusted arg0
RES:
FAIL
Unexpected error message!
    EXP: Possibly NULL pointer passed to trusted arg0
    RES: R0 !read_ok
verification time 51 usec
stack depth 8
processed 5 insns (limit 1000000) max_states_per_insn 0 total_states 0 peak_states 0 mark_read 0

R0 !read_ok
verification time 51 usec
stack depth 8
processed 5 insns (limit 1000000) max_states_per_insn 0 total_states 0 peak_states 0 mark_read 0

#124/p calls: invalid kfunc call: reg->off must be zero when passed to release kfunc FAIL
Unexpected verifier log!
EXP: R1 must have zero offset when passed to release func
RES:
FAIL
Unexpected error message!
    EXP: R1 must have zero offset when passed to release func
    RES: R0 !read_ok
verification time 44 usec
stack depth 8
processed 5 insns (limit 1000000) max_states_per_insn 0 total_states 0 peak_states 0 mark_read 0

R0 !read_ok
verification time 44 usec
stack depth 8
processed 5 insns (limit 1000000) max_states_per_insn 0 total_states 0 peak_states 0 mark_read 0

#125/p calls: invalid kfunc call: don't match first member type when passed to release kfunc FAIL
Unexpected verifier log!
EXP: kernel function bpf_kfunc_call_memb1_release args#0 expected pointer
RES:
FAIL
Unexpected error message!
    EXP: kernel function bpf_kfunc_call_memb1_release args#0 expected pointer
    RES: invalid kernel function call not eliminated in verifier pass
verification time 52 usec
stack depth 0
processed 4 insns (limit 1000000) max_states_per_insn 0 total_states 0 peak_states 0 mark_read 0

invalid kernel function call not eliminated in verifier pass
verification time 52 usec
stack depth 0
processed 4 insns (limit 1000000) max_states_per_insn 0 total_states 0 peak_states 0 mark_read 0

#126/p calls: invalid kfunc call: PTR_TO_BTF_ID with negative offset FAIL
Unexpected verifier log!
EXP: ptr R1 off=-4 disallowed
RES:
FAIL
Unexpected error message!
    EXP: ptr R1 off=-4 disallowed
    RES: R0 !read_ok
verification time 37 usec
stack depth 8
processed 5 insns (limit 1000000) max_states_per_insn 0 total_states 0 peak_states 0 mark_read 0

R0 !read_ok
verification time 37 usec
stack depth 8
processed 5 insns (limit 1000000) max_states_per_insn 0 total_states 0 peak_states 0 mark_read 0

#127/p calls: invalid kfunc call: PTR_TO_BTF_ID with variable offset FAIL
Unexpected verifier log!
EXP: variable ptr_ access var_off=(0x0; 0x7) disallowed
RES:
FAIL
Unexpected error message!
    EXP: variable ptr_ access var_off=(0x0; 0x7) disallowed
    RES: R0 !read_ok
verification time 49 usec
stack depth 8
processed 5 insns (limit 1000000) max_states_per_insn 0 total_states 0 peak_states 0 mark_read 0

R0 !read_ok
verification time 49 usec
stack depth 8
processed 5 insns (limit 1000000) max_states_per_insn 0 total_states 0 peak_states 0 mark_read 0

#128/p calls: invalid kfunc call: referenced arg needs refcounted PTR_TO_BTF_ID FAIL
Unexpected verifier log!
EXP: R1 must be
RES:
FAIL
Unexpected error message!
    EXP: R1 must be
    RES: R0 !read_ok
verification time 28 usec
stack depth 8
processed 5 insns (limit 1000000) max_states_per_insn 0 total_states 0 peak_states 0 mark_read 0

R0 !read_ok
verification time 28 usec
stack depth 8
processed 5 insns (limit 1000000) max_states_per_insn 0 total_states 0 peak_states 0 mark_read 0

#129/p calls: valid kfunc call: referenced arg needs refcounted PTR_TO_BTF_ID FAIL
Failed to load prog 'Permission denied'!
R0 !read_ok
verification time 44 usec
stack depth 8
processed 5 insns (limit 1000000) max_states_per_insn 0 total_states 0 peak_states 0 mark_read 0

#485/p map_kptr: ref: reference state created and released on xchg FAIL
Unexpected verifier log!
EXP: Unreleased reference id=5 alloc_insn=20
RES:
FAIL
Unexpected error message!
    EXP: Unreleased reference id=5 alloc_insn=20
    RES: R2 type=map_value expected=ptr_, trusted_ptr_, rcu_ptr_
verification time 31 usec
stack depth 8
processed 19 insns (limit 1000000) max_states_per_insn 0 total_states 1 peak_states 1 mark_read 1

R2 type=map_value expected=ptr_, trusted_ptr_, rcu_ptr_
verification time 31 usec
stack depth 8
processed 19 insns (limit 1000000) max_states_per_insn 0 total_states 1 peak_states 1 mark_read 1

Summary: 777 PASSED, 0 SKIPPED, 13 FAILED

[Po-Hsu Lin (cypressyew)]

This issue can be found on ARM64 as well, title and content updated accordingly.

[Po-Hsu Lin (cypressyew)]

This issue can be found on openstack s390x as well, title and content updated accordingly. (PowerPC works fine)