Google Git
Sign in
nest-open-source / manifest_repos / kernel / 9398cc34ac0688d293c2dff535a4025e4140b0b1 / . / tools / testing / selftests / bpf / verifier / search_pruning.c
blob: 7e50cb80873a5b7c08f607fe27006bda2afc6bf5 [file] [log] [blame]
Googler9398cc32022-12-02 17:21:52 +0800[diff] [blame^]1{
2 "pointer/scalar confusion in state equality check (way 1)",
3 .insns = {
4 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
5 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7 BPF_LD_MAP_FD(BPF_REG_1, 0),
8 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
9 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
10 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 0),
11 BPF_JMP_A(1),
12 BPF_MOV64_REG(BPF_REG_0, BPF_REG_10),
13 BPF_JMP_A(0),
14 BPF_EXIT_INSN(),
15 },
16 .fixup_map_hash_8b = { 3 },
17 .result = ACCEPT,
18 .retval = POINTER_VALUE,
19 .result_unpriv = REJECT,
20 .errstr_unpriv = "R0 leaks addr as return value"
21},
22{
23 "pointer/scalar confusion in state equality check (way 2)",
24 .insns = {
25 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
26 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
27 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
28 BPF_LD_MAP_FD(BPF_REG_1, 0),
29 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
30 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
31 BPF_MOV64_REG(BPF_REG_0, BPF_REG_10),
32 BPF_JMP_A(1),
33 BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 0),
34 BPF_EXIT_INSN(),
35 },
36 .fixup_map_hash_8b = { 3 },
37 .result = ACCEPT,
38 .retval = POINTER_VALUE,
39 .result_unpriv = REJECT,
40 .errstr_unpriv = "R0 leaks addr as return value"
41},
42{
43 "liveness pruning and write screening",
44 .insns = {
45 /* Get an unknown value */
46 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 0),
47 /* branch conditions teach us nothing about R2 */
48 BPF_JMP_IMM(BPF_JGE, BPF_REG_2, 0, 1),
49 BPF_MOV64_IMM(BPF_REG_0, 0),
50 BPF_JMP_IMM(BPF_JGE, BPF_REG_2, 0, 1),
51 BPF_MOV64_IMM(BPF_REG_0, 0),
52 BPF_EXIT_INSN(),
53 },
54 .errstr = "R0 !read_ok",
55 .result = REJECT,
56 .prog_type = BPF_PROG_TYPE_LWT_IN,
57},
58{
59 "varlen_map_value_access pruning",
60 .insns = {
61 BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
62 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
63 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
64 BPF_LD_MAP_FD(BPF_REG_1, 0),
65 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
66 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 8),
67 BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, 0),
68 BPF_MOV32_IMM(BPF_REG_2, MAX_ENTRIES),
69 BPF_JMP_REG(BPF_JSGT, BPF_REG_2, BPF_REG_1, 1),
70 BPF_MOV32_IMM(BPF_REG_1, 0),
71 BPF_ALU32_IMM(BPF_LSH, BPF_REG_1, 2),
72 BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
73 BPF_JMP_IMM(BPF_JA, 0, 0, 0),
74 BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, offsetof(struct test_val, foo)),
75 BPF_EXIT_INSN(),
76 },
77 .fixup_map_hash_48b = { 3 },
78 .errstr_unpriv = "R0 leaks addr",
79 .errstr = "R0 unbounded memory access",
80 .result_unpriv = REJECT,
81 .result = REJECT,
82 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
83},
84{
85 "search pruning: all branches should be verified (nop operation)",
86 .insns = {
87 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
88 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
89 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
90 BPF_LD_MAP_FD(BPF_REG_1, 0),
91 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
92 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 11),
93 BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_0, 0),
94 BPF_JMP_IMM(BPF_JEQ, BPF_REG_3, 0xbeef, 2),
95 BPF_MOV64_IMM(BPF_REG_4, 0),
96 BPF_JMP_A(1),
97 BPF_MOV64_IMM(BPF_REG_4, 1),
98 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_4, -16),
99 BPF_EMIT_CALL(BPF_FUNC_ktime_get_ns),
100 BPF_LDX_MEM(BPF_DW, BPF_REG_5, BPF_REG_10, -16),
101 BPF_JMP_IMM(BPF_JEQ, BPF_REG_5, 0, 2),
102 BPF_MOV64_IMM(BPF_REG_6, 0),
103 BPF_ST_MEM(BPF_DW, BPF_REG_6, 0, 0xdead),
104 BPF_EXIT_INSN(),
105 },
106 .fixup_map_hash_8b = { 3 },
107 .errstr = "R6 invalid mem access 'inv'",
108 .result = REJECT,
109 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
110},
111{
112 "search pruning: all branches should be verified (invalid stack access)",
113 .insns = {
114 BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
115 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
116 BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
117 BPF_LD_MAP_FD(BPF_REG_1, 0),
118 BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
119 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 8),
120 BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_0, 0),
121 BPF_MOV64_IMM(BPF_REG_4, 0),
122 BPF_JMP_IMM(BPF_JEQ, BPF_REG_3, 0xbeef, 2),
123 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_4, -16),
124 BPF_JMP_A(1),
125 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_4, -24),
126 BPF_EMIT_CALL(BPF_FUNC_ktime_get_ns),
127 BPF_LDX_MEM(BPF_DW, BPF_REG_5, BPF_REG_10, -16),
128 BPF_EXIT_INSN(),
129 },
130 .fixup_map_hash_8b = { 3 },
131 .errstr = "invalid read from stack off -16+0 size 8",
132 .result = REJECT,
133 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
134},
135{
136 "allocated_stack",
137 .insns = {
138 BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_1),
139 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_get_prandom_u32),
140 BPF_ALU64_REG(BPF_MOV, BPF_REG_7, BPF_REG_0),
141 BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
142 BPF_MOV64_IMM(BPF_REG_0, 0),
143 BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_6, -8),
144 BPF_LDX_MEM(BPF_DW, BPF_REG_6, BPF_REG_10, -8),
145 BPF_STX_MEM(BPF_B, BPF_REG_10, BPF_REG_7, -9),
146 BPF_LDX_MEM(BPF_B, BPF_REG_7, BPF_REG_10, -9),
147 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 0),
148 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 0),
149 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 0),
150 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 0),
151 BPF_EXIT_INSN(),
152 },
153 .result = ACCEPT,
154 .result_unpriv = ACCEPT,
155 .insn_processed = 15,
156},