net: filter: fix length calculation in BPF testsuite

The current probe_filter_length() (the function that calculates the
length of a test BPF filter) behavior is to declare the end of the
filter as soon as it finds {0, *, *, 0}. This is actually a valid
insn ("ld #0"), so any filter with includes "BPF_STMT(BPF_LD | BPF_IMM, 0)"
fails (its length is cut short).

We are changing probe_filter_length() so as to start from the end, and
declare the end of the filter as the first instruction which is not
{0, *, *, 0}. This solution produces a simpler patch than the
alternative of using an explicit end-of-filter mark. It is technically
incorrect if your filter ends up with "ld #0", but that should not
happen anyway.

We also add a new test (LD_IMM_0) that includes ld #0 (does not work
without this patch).

Signed-off-by: Chema Gonzalez <chema@google.com>
Acked-by: Daniel Borkmann <dborkman@redhat.com>
Acked-by: Alexei Starovoitov <ast@plumgrid.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

1 files changed, 16 insertions, 5 deletions

diff --git a/lib/test_bpf.c b/lib/test_bpf.c
index f8d2b2a..ea60ad8 100644
--- a/lib/test_bpf.c
+++ b/lib/test_bpf.c
@@ -158,6 +158,18 @@ static struct bpf_test tests[] = {
 		{ { 0, 0x800000ff }, { 1, 0x800000ff } },
 	},
 	{
+		"LD_IMM_0",
+		.u.insns = {
+			BPF_STMT(BPF_LD | BPF_IMM, 0), /* ld #0 */
+			BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 0, 1, 0),
+			BPF_STMT(BPF_RET | BPF_K, 0),
+			BPF_STMT(BPF_RET | BPF_K, 1),
+		},
+		CLASSIC,
+		{ },
+		{ { 1, 1 } },
+	},
+	{
 		"LD_IND",
 		.u.insns = {
 			BPF_STMT(BPF_LDX | BPF_LEN, 0),
@@ -1734,12 +1746,11 @@ static int probe_filter_length(struct sock_filter *fp)
 {
 	int len = 0;
 
-	while (fp->code != 0 || fp->k != 0) {
-		fp++;
-		len++;
-	}
+	for (len = MAX_INSNS - 1; len > 0; --len)
+		if (fp[len].code != 0 || fp[len].k != 0)
+			break;
 
-	return len;
+	return len + 1;
 }
 
 static struct sk_filter *generate_filter(int which, int *err)