Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Verifier fails to detect infinite loops on conditional jumps #744

Closed
Alan-Jowett opened this issue Oct 18, 2024 · 2 comments
Closed

Verifier fails to detect infinite loops on conditional jumps #744

Alan-Jowett opened this issue Oct 18, 2024 · 2 comments

Comments

@Alan-Jowett
Copy link
Contributor

All these tests should fail, but currently pass:

---
test-case: simple infinite loop, less than
options: ["termination"]

pre: []

code:
  <start>: |
    r0 = 0
    if r0 < 1 goto <start>
    exit

post: []

messages:
  - "1:2: Code is unreachable after 1:2"
# Message that should be generated by the verifier, but isn't:
#  - "Could not prove termination."
---
test-case: simple infinite loop, less than or equal
options: ["termination"]

pre: []

code:
  <start>: |
    r0 = 0
    if r0 <= 1 goto <start>
    exit

post: []

messages:
  - "1:2: Code is unreachable after 1:2"
# Message that should be generated by the verifier, but isn't:
#  - "Could not prove termination."

---
test-case: simple infinite loop, equal
options: ["termination"]

pre: []

code:
  <start>: |
    r0 = 0
    if r0 == 0 goto <start>
    exit

post: []

messages:
  - "1:2: Code is unreachable after 1:2"
# Message that should be generated by the verifier, but isn't:
#  - "Could not prove termination."

---
test-case: simple infinite loop, greater than
options: ["termination"]

pre: []

code:
  <start>: |
    r0 = 1
    if r0 > 0 goto <start>
    exit

post: []

messages:
  - "1:2: Code is unreachable after 1:2"
# Message that should be generated by the verifier, but isn't:
#  - "Could not prove termination."

---
test-case: simple infinite loop, greater than or equal
options: ["termination"]

pre: []

code:
  <start>: |
    r0 = 1
    if r0 >= 0 goto <start>
    exit

post: []

messages:
  - "1:2: Code is unreachable after 1:2"
# Message that should be generated by the verifier, but isn't:
#  - "Could not prove termination."
@Alan-Jowett
Copy link
Contributor Author

I think the bug is here:
https://github.com/vbpf/ebpf-verifier/blob/9f25cee94f74108c19fa1cc88bc32c01d7ad758a/src/crab_verifier.cpp#L97C1-L100C6

The exit instruction is unreachable, and hence has a loop count of 0.

@Alan-Jowett
Copy link
Contributor Author

Resolved by #745

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant