forked from Minki/linux
selftests: bpf: break up the rest of test_verifier
Break up the rest of test_verifier tests into separate files. Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com> Acked-by: Jiong Wang <jiong.wang@netronome.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org>
This commit is contained in:
Jakub Kicinski
Alexei Starovoitov
parent
40f2fbd5a5
commit
4872922623
File diff suppressed because it is too large
Load Diff
@ -90,3 +90,45 @@
|
||||
},
|
||||
.result = ACCEPT,
|
||||
},
|
||||
{
|
||||
"invalid 64-bit BPF_END",
|
||||
.insns = {
|
||||
BPF_MOV32_IMM(BPF_REG_0, 0),
|
||||
{
|
||||
.code = BPF_ALU64 | BPF_END | BPF_TO_LE,
|
||||
.dst_reg = BPF_REG_0,
|
||||
.src_reg = 0,
|
||||
.off = 0,
|
||||
.imm = 32,
|
||||
},
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.errstr = "unknown opcode d7",
|
||||
.result = REJECT,
|
||||
},
|
||||
{
|
||||
"mov64 src == dst",
|
||||
.insns = {
|
||||
BPF_MOV64_IMM(BPF_REG_2, 0),
|
||||
BPF_MOV64_REG(BPF_REG_2, BPF_REG_2),
|
||||
// Check bounds are OK
|
||||
BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_2),
|
||||
BPF_MOV64_IMM(BPF_REG_0, 0),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
||||
.result = ACCEPT,
|
||||
},
|
||||
{
|
||||
"mov64 src != dst",
|
||||
.insns = {
|
||||
BPF_MOV64_IMM(BPF_REG_3, 0),
|
||||
BPF_MOV64_REG(BPF_REG_2, BPF_REG_3),
|
||||
// Check bounds are OK
|
||||
BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_2),
|
||||
BPF_MOV64_IMM(BPF_REG_0, 0),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
||||
.result = ACCEPT,
|
||||
},
|
||||
|
||||
124
tools/testing/selftests/bpf/verifier/bounds_deduction.c
Normal file
124
tools/testing/selftests/bpf/verifier/bounds_deduction.c
Normal file
@ -0,0 +1,124 @@
|
||||
{
|
||||
"check deducing bounds from const, 1",
|
||||
.insns = {
|
||||
BPF_MOV64_IMM(BPF_REG_0, 1),
|
||||
BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 1, 0),
|
||||
BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.result = REJECT,
|
||||
.errstr = "R0 tried to subtract pointer from scalar",
|
||||
},
|
||||
{
|
||||
"check deducing bounds from const, 2",
|
||||
.insns = {
|
||||
BPF_MOV64_IMM(BPF_REG_0, 1),
|
||||
BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 1, 1),
|
||||
BPF_EXIT_INSN(),
|
||||
BPF_JMP_IMM(BPF_JSLE, BPF_REG_0, 1, 1),
|
||||
BPF_EXIT_INSN(),
|
||||
BPF_ALU64_REG(BPF_SUB, BPF_REG_1, BPF_REG_0),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.result = ACCEPT,
|
||||
.retval = 1,
|
||||
},
|
||||
{
|
||||
"check deducing bounds from const, 3",
|
||||
.insns = {
|
||||
BPF_MOV64_IMM(BPF_REG_0, 0),
|
||||
BPF_JMP_IMM(BPF_JSLE, BPF_REG_0, 0, 0),
|
||||
BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.result = REJECT,
|
||||
.errstr = "R0 tried to subtract pointer from scalar",
|
||||
},
|
||||
{
|
||||
"check deducing bounds from const, 4",
|
||||
.insns = {
|
||||
BPF_MOV64_IMM(BPF_REG_0, 0),
|
||||
BPF_JMP_IMM(BPF_JSLE, BPF_REG_0, 0, 1),
|
||||
BPF_EXIT_INSN(),
|
||||
BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 0, 1),
|
||||
BPF_EXIT_INSN(),
|
||||
BPF_ALU64_REG(BPF_SUB, BPF_REG_1, BPF_REG_0),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.result = ACCEPT,
|
||||
},
|
||||
{
|
||||
"check deducing bounds from const, 5",
|
||||
.insns = {
|
||||
BPF_MOV64_IMM(BPF_REG_0, 0),
|
||||
BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 1, 1),
|
||||
BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.result = REJECT,
|
||||
.errstr = "R0 tried to subtract pointer from scalar",
|
||||
},
|
||||
{
|
||||
"check deducing bounds from const, 6",
|
||||
.insns = {
|
||||
BPF_MOV64_IMM(BPF_REG_0, 0),
|
||||
BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 0, 1),
|
||||
BPF_EXIT_INSN(),
|
||||
BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.result = REJECT,
|
||||
.errstr = "R0 tried to subtract pointer from scalar",
|
||||
},
|
||||
{
|
||||
"check deducing bounds from const, 7",
|
||||
.insns = {
|
||||
BPF_MOV64_IMM(BPF_REG_0, ~0),
|
||||
BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 0, 0),
|
||||
BPF_ALU64_REG(BPF_SUB, BPF_REG_1, BPF_REG_0),
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
|
||||
offsetof(struct __sk_buff, mark)),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.result = REJECT,
|
||||
.errstr = "dereference of modified ctx ptr",
|
||||
.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
|
||||
},
|
||||
{
|
||||
"check deducing bounds from const, 8",
|
||||
.insns = {
|
||||
BPF_MOV64_IMM(BPF_REG_0, ~0),
|
||||
BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 0, 1),
|
||||
BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_0),
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
|
||||
offsetof(struct __sk_buff, mark)),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.result = REJECT,
|
||||
.errstr = "dereference of modified ctx ptr",
|
||||
.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
|
||||
},
|
||||
{
|
||||
"check deducing bounds from const, 9",
|
||||
.insns = {
|
||||
BPF_MOV64_IMM(BPF_REG_0, 0),
|
||||
BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 0, 0),
|
||||
BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.result = REJECT,
|
||||
.errstr = "R0 tried to subtract pointer from scalar",
|
||||
},
|
||||
{
|
||||
"check deducing bounds from const, 10",
|
||||
.insns = {
|
||||
BPF_MOV64_IMM(BPF_REG_0, 0),
|
||||
BPF_JMP_IMM(BPF_JSLE, BPF_REG_0, 0, 0),
|
||||
/* Marks reg as unknown. */
|
||||
BPF_ALU64_IMM(BPF_NEG, BPF_REG_0, 0),
|
||||
BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.result = REJECT,
|
||||
.errstr = "math between ctx pointer and register with unbounded min value is not allowed",
|
||||
},
|
||||
44
tools/testing/selftests/bpf/verifier/bpf_get_stack.c
Normal file
44
tools/testing/selftests/bpf/verifier/bpf_get_stack.c
Normal file
@ -0,0 +1,44 @@
|
||||
{
|
||||
"bpf_get_stack return R0 within range",
|
||||
.insns = {
|
||||
BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
|
||||
BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
|
||||
BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
|
||||
BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
|
||||
BPF_LD_MAP_FD(BPF_REG_1, 0),
|
||||
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
|
||||
BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 28),
|
||||
BPF_MOV64_REG(BPF_REG_7, BPF_REG_0),
|
||||
BPF_MOV64_IMM(BPF_REG_9, sizeof(struct test_val)),
|
||||
BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
|
||||
BPF_MOV64_REG(BPF_REG_2, BPF_REG_7),
|
||||
BPF_MOV64_IMM(BPF_REG_3, sizeof(struct test_val)),
|
||||
BPF_MOV64_IMM(BPF_REG_4, 256),
|
||||
BPF_EMIT_CALL(BPF_FUNC_get_stack),
|
||||
BPF_MOV64_IMM(BPF_REG_1, 0),
|
||||
BPF_MOV64_REG(BPF_REG_8, BPF_REG_0),
|
||||
BPF_ALU64_IMM(BPF_LSH, BPF_REG_8, 32),
|
||||
BPF_ALU64_IMM(BPF_ARSH, BPF_REG_8, 32),
|
||||
BPF_JMP_REG(BPF_JSLT, BPF_REG_1, BPF_REG_8, 16),
|
||||
BPF_ALU64_REG(BPF_SUB, BPF_REG_9, BPF_REG_8),
|
||||
BPF_MOV64_REG(BPF_REG_2, BPF_REG_7),
|
||||
BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_8),
|
||||
BPF_MOV64_REG(BPF_REG_1, BPF_REG_9),
|
||||
BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 32),
|
||||
BPF_ALU64_IMM(BPF_ARSH, BPF_REG_1, 32),
|
||||
BPF_MOV64_REG(BPF_REG_3, BPF_REG_2),
|
||||
BPF_ALU64_REG(BPF_ADD, BPF_REG_3, BPF_REG_1),
|
||||
BPF_MOV64_REG(BPF_REG_1, BPF_REG_7),
|
||||
BPF_MOV64_IMM(BPF_REG_5, sizeof(struct test_val)),
|
||||
BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_5),
|
||||
BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_1, 4),
|
||||
BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
|
||||
BPF_MOV64_REG(BPF_REG_3, BPF_REG_9),
|
||||
BPF_MOV64_IMM(BPF_REG_4, 0),
|
||||
BPF_EMIT_CALL(BPF_FUNC_get_stack),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.fixup_map_hash_48b = { 4 },
|
||||
.result = ACCEPT,
|
||||
.prog_type = BPF_PROG_TYPE_TRACEPOINT,
|
||||
},
|
||||
1942
tools/testing/selftests/bpf/verifier/calls.c
Normal file
1942
tools/testing/selftests/bpf/verifier/calls.c
Normal file
File diff suppressed because it is too large
Load Diff
72
tools/testing/selftests/bpf/verifier/cgroup_inv_retcode.c
Normal file
72
tools/testing/selftests/bpf/verifier/cgroup_inv_retcode.c
Normal file
@ -0,0 +1,72 @@
|
||||
{
|
||||
"bpf_exit with invalid return code. test1",
|
||||
.insns = {
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 0),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.errstr = "R0 has value (0x0; 0xffffffff)",
|
||||
.result = REJECT,
|
||||
.prog_type = BPF_PROG_TYPE_CGROUP_SOCK,
|
||||
},
|
||||
{
|
||||
"bpf_exit with invalid return code. test2",
|
||||
.insns = {
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 0),
|
||||
BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 1),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.result = ACCEPT,
|
||||
.prog_type = BPF_PROG_TYPE_CGROUP_SOCK,
|
||||
},
|
||||
{
|
||||
"bpf_exit with invalid return code. test3",
|
||||
.insns = {
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 0),
|
||||
BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 3),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.errstr = "R0 has value (0x0; 0x3)",
|
||||
.result = REJECT,
|
||||
.prog_type = BPF_PROG_TYPE_CGROUP_SOCK,
|
||||
},
|
||||
{
|
||||
"bpf_exit with invalid return code. test4",
|
||||
.insns = {
|
||||
BPF_MOV64_IMM(BPF_REG_0, 1),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.result = ACCEPT,
|
||||
.prog_type = BPF_PROG_TYPE_CGROUP_SOCK,
|
||||
},
|
||||
{
|
||||
"bpf_exit with invalid return code. test5",
|
||||
.insns = {
|
||||
BPF_MOV64_IMM(BPF_REG_0, 2),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.errstr = "R0 has value (0x2; 0x0)",
|
||||
.result = REJECT,
|
||||
.prog_type = BPF_PROG_TYPE_CGROUP_SOCK,
|
||||
},
|
||||
{
|
||||
"bpf_exit with invalid return code. test6",
|
||||
.insns = {
|
||||
BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.errstr = "R0 is not a known value (ctx)",
|
||||
.result = REJECT,
|
||||
.prog_type = BPF_PROG_TYPE_CGROUP_SOCK,
|
||||
},
|
||||
{
|
||||
"bpf_exit with invalid return code. test7",
|
||||
.insns = {
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 0),
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 4),
|
||||
BPF_ALU64_REG(BPF_MUL, BPF_REG_0, BPF_REG_2),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.errstr = "R0 has unknown scalar value",
|
||||
.result = REJECT,
|
||||
.prog_type = BPF_PROG_TYPE_CGROUP_SOCK,
|
||||
},
|
||||
@ -21,3 +21,73 @@
|
||||
.result = REJECT,
|
||||
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
||||
},
|
||||
{
|
||||
"arithmetic ops make PTR_TO_CTX unusable",
|
||||
.insns = {
|
||||
BPF_ALU64_IMM(BPF_ADD, BPF_REG_1,
|
||||
offsetof(struct __sk_buff, data) -
|
||||
offsetof(struct __sk_buff, mark)),
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
|
||||
offsetof(struct __sk_buff, mark)),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.errstr = "dereference of modified ctx ptr",
|
||||
.result = REJECT,
|
||||
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
||||
},
|
||||
{
|
||||
"pass unmodified ctx pointer to helper",
|
||||
.insns = {
|
||||
BPF_MOV64_IMM(BPF_REG_2, 0),
|
||||
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
|
||||
BPF_FUNC_csum_update),
|
||||
BPF_MOV64_IMM(BPF_REG_0, 0),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
||||
.result = ACCEPT,
|
||||
},
|
||||
{
|
||||
"pass modified ctx pointer to helper, 1",
|
||||
.insns = {
|
||||
BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -612),
|
||||
BPF_MOV64_IMM(BPF_REG_2, 0),
|
||||
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
|
||||
BPF_FUNC_csum_update),
|
||||
BPF_MOV64_IMM(BPF_REG_0, 0),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
||||
.result = REJECT,
|
||||
.errstr = "dereference of modified ctx ptr",
|
||||
},
|
||||
{
|
||||
"pass modified ctx pointer to helper, 2",
|
||||
.insns = {
|
||||
BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -612),
|
||||
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
|
||||
BPF_FUNC_get_socket_cookie),
|
||||
BPF_MOV64_IMM(BPF_REG_0, 0),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.result_unpriv = REJECT,
|
||||
.result = REJECT,
|
||||
.errstr_unpriv = "dereference of modified ctx ptr",
|
||||
.errstr = "dereference of modified ctx ptr",
|
||||
},
|
||||
{
|
||||
"pass modified ctx pointer to helper, 3",
|
||||
.insns = {
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, 0),
|
||||
BPF_ALU64_IMM(BPF_AND, BPF_REG_3, 4),
|
||||
BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
|
||||
BPF_MOV64_IMM(BPF_REG_2, 0),
|
||||
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
|
||||
BPF_FUNC_csum_update),
|
||||
BPF_MOV64_IMM(BPF_REG_0, 0),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
||||
.result = REJECT,
|
||||
.errstr = "variable ctx access var_off=(0x0; 0x4)",
|
||||
},
|
||||
|
||||
@ -999,3 +999,35 @@
|
||||
.result = ACCEPT,
|
||||
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
||||
},
|
||||
{
|
||||
"check wire_len is not readable by sockets",
|
||||
.insns = {
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
|
||||
offsetof(struct __sk_buff, wire_len)),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.errstr = "invalid bpf_context access",
|
||||
.result = REJECT,
|
||||
},
|
||||
{
|
||||
"check wire_len is readable by tc classifier",
|
||||
.insns = {
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
|
||||
offsetof(struct __sk_buff, wire_len)),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
||||
.result = ACCEPT,
|
||||
},
|
||||
{
|
||||
"check wire_len is not writable by tc classifier",
|
||||
.insns = {
|
||||
BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
|
||||
offsetof(struct __sk_buff, wire_len)),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
||||
.errstr = "invalid bpf_context access",
|
||||
.errstr_unpriv = "R1 leaks addr",
|
||||
.result = REJECT,
|
||||
},
|
||||
|
||||
159
tools/testing/selftests/bpf/verifier/dead_code.c
Normal file
159
tools/testing/selftests/bpf/verifier/dead_code.c
Normal file
@ -0,0 +1,159 @@
|
||||
{
|
||||
"dead code: start",
|
||||
.insns = {
|
||||
BPF_JMP_IMM(BPF_JA, 0, 0, 2),
|
||||
BPF_LDX_MEM(BPF_B, BPF_REG_8, BPF_REG_9, 0),
|
||||
BPF_JMP_IMM(BPF_JA, 0, 0, 2),
|
||||
BPF_MOV64_IMM(BPF_REG_0, 7),
|
||||
BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 10, -4),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.result = ACCEPT,
|
||||
.retval = 7,
|
||||
},
|
||||
{
|
||||
"dead code: mid 1",
|
||||
.insns = {
|
||||
BPF_MOV64_IMM(BPF_REG_0, 7),
|
||||
BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 1),
|
||||
BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 10, 0),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.result = ACCEPT,
|
||||
.retval = 7,
|
||||
},
|
||||
{
|
||||
"dead code: mid 2",
|
||||
.insns = {
|
||||
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_get_prandom_u32),
|
||||
BPF_JMP_IMM(BPF_JSET, BPF_REG_0, 1, 4),
|
||||
BPF_JMP_IMM(BPF_JSET, BPF_REG_0, 1, 1),
|
||||
BPF_JMP_IMM(BPF_JA, 0, 0, 2),
|
||||
BPF_MOV64_IMM(BPF_REG_0, 7),
|
||||
BPF_EXIT_INSN(),
|
||||
BPF_MOV64_IMM(BPF_REG_0, 1),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.result = ACCEPT,
|
||||
.retval = 1,
|
||||
},
|
||||
{
|
||||
"dead code: end 1",
|
||||
.insns = {
|
||||
BPF_MOV64_IMM(BPF_REG_0, 7),
|
||||
BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 10, 1),
|
||||
BPF_EXIT_INSN(),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.result = ACCEPT,
|
||||
.retval = 7,
|
||||
},
|
||||
{
|
||||
"dead code: end 2",
|
||||
.insns = {
|
||||
BPF_MOV64_IMM(BPF_REG_0, 7),
|
||||
BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 10, 1),
|
||||
BPF_EXIT_INSN(),
|
||||
BPF_MOV64_IMM(BPF_REG_0, 12),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.result = ACCEPT,
|
||||
.retval = 7,
|
||||
},
|
||||
{
|
||||
"dead code: end 3",
|
||||
.insns = {
|
||||
BPF_MOV64_IMM(BPF_REG_0, 7),
|
||||
BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 8, 1),
|
||||
BPF_EXIT_INSN(),
|
||||
BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 10, 1),
|
||||
BPF_JMP_IMM(BPF_JA, 0, 0, 1),
|
||||
BPF_MOV64_IMM(BPF_REG_0, 12),
|
||||
BPF_JMP_IMM(BPF_JA, 0, 0, -5),
|
||||
},
|
||||
.result = ACCEPT,
|
||||
.retval = 7,
|
||||
},
|
||||
{
|
||||
"dead code: tail of main + func",
|
||||
.insns = {
|
||||
BPF_MOV64_IMM(BPF_REG_0, 7),
|
||||
BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 8, 1),
|
||||
BPF_EXIT_INSN(),
|
||||
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
|
||||
BPF_EXIT_INSN(),
|
||||
BPF_MOV64_IMM(BPF_REG_0, 12),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.errstr_unpriv = "function calls to other bpf functions are allowed for root only",
|
||||
.result_unpriv = REJECT,
|
||||
.result = ACCEPT,
|
||||
.retval = 7,
|
||||
},
|
||||
{
|
||||
"dead code: tail of main + two functions",
|
||||
.insns = {
|
||||
BPF_MOV64_IMM(BPF_REG_0, 7),
|
||||
BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 8, 1),
|
||||
BPF_EXIT_INSN(),
|
||||
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
|
||||
BPF_EXIT_INSN(),
|
||||
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
|
||||
BPF_EXIT_INSN(),
|
||||
BPF_MOV64_IMM(BPF_REG_0, 12),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.errstr_unpriv = "function calls to other bpf functions are allowed for root only",
|
||||
.result_unpriv = REJECT,
|
||||
.result = ACCEPT,
|
||||
.retval = 7,
|
||||
},
|
||||
{
|
||||
"dead code: function in the middle and mid of another func",
|
||||
.insns = {
|
||||
BPF_MOV64_IMM(BPF_REG_1, 7),
|
||||
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
|
||||
BPF_EXIT_INSN(),
|
||||
BPF_MOV64_IMM(BPF_REG_0, 12),
|
||||
BPF_EXIT_INSN(),
|
||||
BPF_MOV64_IMM(BPF_REG_0, 7),
|
||||
BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 7, 1),
|
||||
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, -5),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.errstr_unpriv = "function calls to other bpf functions are allowed for root only",
|
||||
.result_unpriv = REJECT,
|
||||
.result = ACCEPT,
|
||||
.retval = 7,
|
||||
},
|
||||
{
|
||||
"dead code: middle of main before call",
|
||||
.insns = {
|
||||
BPF_MOV64_IMM(BPF_REG_1, 2),
|
||||
BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 2, 1),
|
||||
BPF_MOV64_IMM(BPF_REG_1, 5),
|
||||
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
|
||||
BPF_EXIT_INSN(),
|
||||
BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.errstr_unpriv = "function calls to other bpf functions are allowed for root only",
|
||||
.result_unpriv = REJECT,
|
||||
.result = ACCEPT,
|
||||
.retval = 2,
|
||||
},
|
||||
{
|
||||
"dead code: start of a function",
|
||||
.insns = {
|
||||
BPF_MOV64_IMM(BPF_REG_1, 2),
|
||||
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
|
||||
BPF_EXIT_INSN(),
|
||||
BPF_JMP_IMM(BPF_JA, 0, 0, 0),
|
||||
BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.errstr_unpriv = "function calls to other bpf functions are allowed for root only",
|
||||
.result_unpriv = REJECT,
|
||||
.result = ACCEPT,
|
||||
.retval = 2,
|
||||
},
|
||||
@ -1,3 +1,17 @@
|
||||
{
|
||||
"pkt_end - pkt_start is allowed",
|
||||
.insns = {
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
|
||||
offsetof(struct __sk_buff, data_end)),
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
|
||||
offsetof(struct __sk_buff, data)),
|
||||
BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_2),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.result = ACCEPT,
|
||||
.retval = TEST_DATA_LEN,
|
||||
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
||||
},
|
||||
{
|
||||
"direct packet access: test1",
|
||||
.insns = {
|
||||
|
||||
88
tools/testing/selftests/bpf/verifier/jit.c
Normal file
88
tools/testing/selftests/bpf/verifier/jit.c
Normal file
@ -0,0 +1,88 @@
|
||||
{
|
||||
"jit: lsh, rsh, arsh by 1",
|
||||
.insns = {
|
||||
BPF_MOV64_IMM(BPF_REG_0, 1),
|
||||
BPF_MOV64_IMM(BPF_REG_1, 0xff),
|
||||
BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 1),
|
||||
BPF_ALU32_IMM(BPF_LSH, BPF_REG_1, 1),
|
||||
BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0x3fc, 1),
|
||||
BPF_EXIT_INSN(),
|
||||
BPF_ALU64_IMM(BPF_RSH, BPF_REG_1, 1),
|
||||
BPF_ALU32_IMM(BPF_RSH, BPF_REG_1, 1),
|
||||
BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0xff, 1),
|
||||
BPF_EXIT_INSN(),
|
||||
BPF_ALU64_IMM(BPF_ARSH, BPF_REG_1, 1),
|
||||
BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0x7f, 1),
|
||||
BPF_EXIT_INSN(),
|
||||
BPF_MOV64_IMM(BPF_REG_0, 2),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.result = ACCEPT,
|
||||
.retval = 2,
|
||||
},
|
||||
{
|
||||
"jit: mov32 for ldimm64, 1",
|
||||
.insns = {
|
||||
BPF_MOV64_IMM(BPF_REG_0, 2),
|
||||
BPF_LD_IMM64(BPF_REG_1, 0xfeffffffffffffffULL),
|
||||
BPF_ALU64_IMM(BPF_RSH, BPF_REG_1, 32),
|
||||
BPF_LD_IMM64(BPF_REG_2, 0xfeffffffULL),
|
||||
BPF_JMP_REG(BPF_JEQ, BPF_REG_1, BPF_REG_2, 1),
|
||||
BPF_MOV64_IMM(BPF_REG_0, 1),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.result = ACCEPT,
|
||||
.retval = 2,
|
||||
},
|
||||
{
|
||||
"jit: mov32 for ldimm64, 2",
|
||||
.insns = {
|
||||
BPF_MOV64_IMM(BPF_REG_0, 1),
|
||||
BPF_LD_IMM64(BPF_REG_1, 0x1ffffffffULL),
|
||||
BPF_LD_IMM64(BPF_REG_2, 0xffffffffULL),
|
||||
BPF_JMP_REG(BPF_JEQ, BPF_REG_1, BPF_REG_2, 1),
|
||||
BPF_MOV64_IMM(BPF_REG_0, 2),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.result = ACCEPT,
|
||||
.retval = 2,
|
||||
},
|
||||
{
|
||||
"jit: various mul tests",
|
||||
.insns = {
|
||||
BPF_LD_IMM64(BPF_REG_2, 0xeeff0d413122ULL),
|
||||
BPF_LD_IMM64(BPF_REG_0, 0xfefefeULL),
|
||||
BPF_LD_IMM64(BPF_REG_1, 0xefefefULL),
|
||||
BPF_ALU64_REG(BPF_MUL, BPF_REG_0, BPF_REG_1),
|
||||
BPF_JMP_REG(BPF_JEQ, BPF_REG_0, BPF_REG_2, 2),
|
||||
BPF_MOV64_IMM(BPF_REG_0, 1),
|
||||
BPF_EXIT_INSN(),
|
||||
BPF_LD_IMM64(BPF_REG_3, 0xfefefeULL),
|
||||
BPF_ALU64_REG(BPF_MUL, BPF_REG_3, BPF_REG_1),
|
||||
BPF_JMP_REG(BPF_JEQ, BPF_REG_3, BPF_REG_2, 2),
|
||||
BPF_MOV64_IMM(BPF_REG_0, 1),
|
||||
BPF_EXIT_INSN(),
|
||||
BPF_MOV32_REG(BPF_REG_2, BPF_REG_2),
|
||||
BPF_LD_IMM64(BPF_REG_0, 0xfefefeULL),
|
||||
BPF_ALU32_REG(BPF_MUL, BPF_REG_0, BPF_REG_1),
|
||||
BPF_JMP_REG(BPF_JEQ, BPF_REG_0, BPF_REG_2, 2),
|
||||
BPF_MOV64_IMM(BPF_REG_0, 1),
|
||||
BPF_EXIT_INSN(),
|
||||
BPF_LD_IMM64(BPF_REG_3, 0xfefefeULL),
|
||||
BPF_ALU32_REG(BPF_MUL, BPF_REG_3, BPF_REG_1),
|
||||
BPF_JMP_REG(BPF_JEQ, BPF_REG_3, BPF_REG_2, 2),
|
||||
BPF_MOV64_IMM(BPF_REG_0, 1),
|
||||
BPF_EXIT_INSN(),
|
||||
BPF_LD_IMM64(BPF_REG_0, 0x952a7bbcULL),
|
||||
BPF_LD_IMM64(BPF_REG_1, 0xfefefeULL),
|
||||
BPF_LD_IMM64(BPF_REG_2, 0xeeff0d413122ULL),
|
||||
BPF_ALU32_REG(BPF_MUL, BPF_REG_2, BPF_REG_1),
|
||||
BPF_JMP_REG(BPF_JEQ, BPF_REG_2, BPF_REG_0, 2),
|
||||
BPF_MOV64_IMM(BPF_REG_0, 1),
|
||||
BPF_EXIT_INSN(),
|
||||
BPF_MOV64_IMM(BPF_REG_0, 2),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.result = ACCEPT,
|
||||
.retval = 2,
|
||||
},
|
||||
724
tools/testing/selftests/bpf/verifier/jmp32.c
Normal file
724
tools/testing/selftests/bpf/verifier/jmp32.c
Normal file
@ -0,0 +1,724 @@
|
||||
{
|
||||
"jset32: BPF_K",
|
||||
.insns = {
|
||||
BPF_DIRECT_PKT_R2,
|
||||
BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_2, 0),
|
||||
/* reg, high bits shouldn't be tested */
|
||||
BPF_JMP32_IMM(BPF_JSET, BPF_REG_7, -2, 1),
|
||||
BPF_JMP_IMM(BPF_JA, 0, 0, 1),
|
||||
BPF_EXIT_INSN(),
|
||||
|
||||
BPF_JMP32_IMM(BPF_JSET, BPF_REG_7, 1, 1),
|
||||
BPF_EXIT_INSN(),
|
||||
BPF_MOV64_IMM(BPF_REG_0, 2),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
||||
.result = ACCEPT,
|
||||
.runs = 3,
|
||||
.retvals = {
|
||||
{ .retval = 0,
|
||||
.data64 = { 1ULL << 63, }
|
||||
},
|
||||
{ .retval = 2,
|
||||
.data64 = { 1, }
|
||||
},
|
||||
{ .retval = 2,
|
||||
.data64 = { 1ULL << 63 | 1, }
|
||||
},
|
||||
},
|
||||
},
|
||||
{
|
||||
"jset32: BPF_X",
|
||||
.insns = {
|
||||
BPF_DIRECT_PKT_R2,
|
||||
BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_2, 0),
|
||||
BPF_LD_IMM64(BPF_REG_8, 0x8000000000000000),
|
||||
BPF_JMP32_REG(BPF_JSET, BPF_REG_7, BPF_REG_8, 1),
|
||||
BPF_JMP_IMM(BPF_JA, 0, 0, 1),
|
||||
BPF_EXIT_INSN(),
|
||||
|
||||
BPF_LD_IMM64(BPF_REG_8, 0x8000000000000001),
|
||||
BPF_JMP32_REG(BPF_JSET, BPF_REG_7, BPF_REG_8, 1),
|
||||
BPF_EXIT_INSN(),
|
||||
BPF_MOV64_IMM(BPF_REG_0, 2),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
||||
.result = ACCEPT,
|
||||
.runs = 3,
|
||||
.retvals = {
|
||||
{ .retval = 0,
|
||||
.data64 = { 1ULL << 63, }
|
||||
},
|
||||
{ .retval = 2,
|
||||
.data64 = { 1, }
|
||||
},
|
||||
{ .retval = 2,
|
||||
.data64 = { 1ULL << 63 | 1, }
|
||||
},
|
||||
},
|
||||
},
|
||||
{
|
||||
"jset32: min/max deduction",
|
||||
.insns = {
|
||||
BPF_RAND_UEXT_R7,
|
||||
BPF_MOV64_IMM(BPF_REG_0, 0),
|
||||
BPF_JMP32_IMM(BPF_JSET, BPF_REG_7, 0x10, 1),
|
||||
BPF_EXIT_INSN(),
|
||||
BPF_JMP32_IMM(BPF_JGE, BPF_REG_7, 0x10, 1),
|
||||
BPF_LDX_MEM(BPF_B, BPF_REG_8, BPF_REG_9, 0),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.result = ACCEPT,
|
||||
},
|
||||
{
|
||||
"jeq32: BPF_K",
|
||||
.insns = {
|
||||
BPF_DIRECT_PKT_R2,
|
||||
BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_2, 0),
|
||||
BPF_JMP32_IMM(BPF_JEQ, BPF_REG_7, -1, 1),
|
||||
BPF_EXIT_INSN(),
|
||||
BPF_MOV64_IMM(BPF_REG_0, 2),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
||||
.result = ACCEPT,
|
||||
.runs = 2,
|
||||
.retvals = {
|
||||
{ .retval = 0,
|
||||
.data64 = { -2, }
|
||||
},
|
||||
{ .retval = 2,
|
||||
.data64 = { -1, }
|
||||
},
|
||||
},
|
||||
},
|
||||
{
|
||||
"jeq32: BPF_X",
|
||||
.insns = {
|
||||
BPF_DIRECT_PKT_R2,
|
||||
BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_2, 0),
|
||||
BPF_LD_IMM64(BPF_REG_8, 0x7000000000000001),
|
||||
BPF_JMP32_REG(BPF_JEQ, BPF_REG_7, BPF_REG_8, 1),
|
||||
BPF_EXIT_INSN(),
|
||||
BPF_MOV64_IMM(BPF_REG_0, 2),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
||||
.result = ACCEPT,
|
||||
.runs = 3,
|
||||
.retvals = {
|
||||
{ .retval = 0,
|
||||
.data64 = { 2, }
|
||||
},
|
||||
{ .retval = 2,
|
||||
.data64 = { 1, }
|
||||
},
|
||||
{ .retval = 2,
|
||||
.data64 = { 1ULL << 63 | 1, }
|
||||
},
|
||||
},
|
||||
},
|
||||
{
|
||||
"jeq32: min/max deduction",
|
||||
.insns = {
|
||||
BPF_RAND_UEXT_R7,
|
||||
BPF_MOV64_IMM(BPF_REG_0, 0),
|
||||
BPF_JMP32_IMM(BPF_JEQ, BPF_REG_7, 0x10, 1),
|
||||
BPF_EXIT_INSN(),
|
||||
BPF_JMP32_IMM(BPF_JSGE, BPF_REG_7, 0xf, 1),
|
||||
BPF_LDX_MEM(BPF_B, BPF_REG_8, BPF_REG_9, 0),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.result = ACCEPT,
|
||||
},
|
||||
{
|
||||
"jne32: BPF_K",
|
||||
.insns = {
|
||||
BPF_DIRECT_PKT_R2,
|
||||
BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_2, 0),
|
||||
BPF_JMP32_IMM(BPF_JNE, BPF_REG_7, -1, 1),
|
||||
BPF_EXIT_INSN(),
|
||||
BPF_MOV64_IMM(BPF_REG_0, 2),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
||||
.result = ACCEPT,
|
||||
.runs = 2,
|
||||
.retvals = {
|
||||
{ .retval = 2,
|
||||
.data64 = { 1, }
|
||||
},
|
||||
{ .retval = 0,
|
||||
.data64 = { -1, }
|
||||
},
|
||||
},
|
||||
},
|
||||
{
|
||||
"jne32: BPF_X",
|
||||
.insns = {
|
||||
BPF_DIRECT_PKT_R2,
|
||||
BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_2, 0),
|
||||
BPF_LD_IMM64(BPF_REG_8, 0x8000000000000001),
|
||||
BPF_JMP32_REG(BPF_JNE, BPF_REG_7, BPF_REG_8, 1),
|
||||
BPF_EXIT_INSN(),
|
||||
BPF_MOV64_IMM(BPF_REG_0, 2),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
||||
.result = ACCEPT,
|
||||
.runs = 3,
|
||||
.retvals = {
|
||||
{ .retval = 0,
|
||||
.data64 = { 1, }
|
||||
},
|
||||
{ .retval = 2,
|
||||
.data64 = { 2, }
|
||||
},
|
||||
{ .retval = 2,
|
||||
.data64 = { 1ULL << 63 | 2, }
|
||||
},
|
||||
},
|
||||
},
|
||||
{
|
||||
"jne32: min/max deduction",
|
||||
.insns = {
|
||||
BPF_RAND_UEXT_R7,
|
||||
BPF_MOV64_IMM(BPF_REG_0, 0),
|
||||
BPF_JMP32_IMM(BPF_JNE, BPF_REG_7, 0x10, 1),
|
||||
BPF_JMP_IMM(BPF_JNE, BPF_REG_7, 0x10, 1),
|
||||
BPF_EXIT_INSN(),
|
||||
BPF_LDX_MEM(BPF_B, BPF_REG_8, BPF_REG_9, 0),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.result = ACCEPT,
|
||||
},
|
||||
{
|
||||
"jge32: BPF_K",
|
||||
.insns = {
|
||||
BPF_DIRECT_PKT_R2,
|
||||
BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_2, 0),
|
||||
BPF_JMP32_IMM(BPF_JGE, BPF_REG_7, UINT_MAX - 1, 1),
|
||||
BPF_EXIT_INSN(),
|
||||
BPF_ALU32_IMM(BPF_MOV, BPF_REG_0, 2),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
||||
.result = ACCEPT,
|
||||
.runs = 3,
|
||||
.retvals = {
|
||||
{ .retval = 2,
|
||||
.data64 = { UINT_MAX, }
|
||||
},
|
||||
{ .retval = 2,
|
||||
.data64 = { UINT_MAX - 1, }
|
||||
},
|
||||
{ .retval = 0,
|
||||
.data64 = { 0, }
|
||||
},
|
||||
},
|
||||
},
|
||||
{
|
||||
"jge32: BPF_X",
|
||||
.insns = {
|
||||
BPF_DIRECT_PKT_R2,
|
||||
BPF_LD_IMM64(BPF_REG_8, UINT_MAX | 1ULL << 32),
|
||||
BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_2, 0),
|
||||
BPF_JMP32_REG(BPF_JGE, BPF_REG_7, BPF_REG_8, 1),
|
||||
BPF_EXIT_INSN(),
|
||||
BPF_ALU32_IMM(BPF_MOV, BPF_REG_0, 2),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
||||
.result = ACCEPT,
|
||||
.runs = 3,
|
||||
.retvals = {
|
||||
{ .retval = 2,
|
||||
.data64 = { UINT_MAX, }
|
||||
},
|
||||
{ .retval = 0,
|
||||
.data64 = { INT_MAX, }
|
||||
},
|
||||
{ .retval = 0,
|
||||
.data64 = { (UINT_MAX - 1) | 2ULL << 32, }
|
||||
},
|
||||
},
|
||||
},
|
||||
{
|
||||
"jge32: min/max deduction",
|
||||
.insns = {
|
||||
BPF_RAND_UEXT_R7,
|
||||
BPF_ALU32_IMM(BPF_MOV, BPF_REG_0, 2),
|
||||
BPF_LD_IMM64(BPF_REG_8, 0x7ffffff0 | 1ULL << 32),
|
||||
BPF_JMP32_REG(BPF_JGE, BPF_REG_7, BPF_REG_8, 1),
|
||||
BPF_EXIT_INSN(),
|
||||
BPF_JMP32_IMM(BPF_JGE, BPF_REG_7, 0x7ffffff0, 1),
|
||||
BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 0),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.result = ACCEPT,
|
||||
.retval = 2,
|
||||
},
|
||||
{
|
||||
"jgt32: BPF_K",
|
||||
.insns = {
|
||||
BPF_DIRECT_PKT_R2,
|
||||
BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_2, 0),
|
||||
BPF_JMP32_IMM(BPF_JGT, BPF_REG_7, UINT_MAX - 1, 1),
|
||||
BPF_EXIT_INSN(),
|
||||
BPF_ALU32_IMM(BPF_MOV, BPF_REG_0, 2),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
||||
.result = ACCEPT,
|
||||
.runs = 3,
|
||||
.retvals = {
|
||||
{ .retval = 2,
|
||||
.data64 = { UINT_MAX, }
|
||||
},
|
||||
{ .retval = 0,
|
||||
.data64 = { UINT_MAX - 1, }
|
||||
},
|
||||
{ .retval = 0,
|
||||
.data64 = { 0, }
|
||||
},
|
||||
},
|
||||
},
|
||||
{
|
||||
"jgt32: BPF_X",
|
||||
.insns = {
|
||||
BPF_DIRECT_PKT_R2,
|
||||
BPF_LD_IMM64(BPF_REG_8, (UINT_MAX - 1) | 1ULL << 32),
|
||||
BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_2, 0),
|
||||
BPF_JMP32_REG(BPF_JGT, BPF_REG_7, BPF_REG_8, 1),
|
||||
BPF_EXIT_INSN(),
|
||||
BPF_ALU32_IMM(BPF_MOV, BPF_REG_0, 2),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
||||
.result = ACCEPT,
|
||||
.runs = 3,
|
||||
.retvals = {
|
||||
{ .retval = 2,
|
||||
.data64 = { UINT_MAX, }
|
||||
},
|
||||
{ .retval = 0,
|
||||
.data64 = { UINT_MAX - 1, }
|
||||
},
|
||||
{ .retval = 0,
|
||||
.data64 = { (UINT_MAX - 1) | 2ULL << 32, }
|
||||
},
|
||||
},
|
||||
},
|
||||
{
|
||||
"jgt32: min/max deduction",
|
||||
.insns = {
|
||||
BPF_RAND_UEXT_R7,
|
||||
BPF_ALU32_IMM(BPF_MOV, BPF_REG_0, 2),
|
||||
BPF_LD_IMM64(BPF_REG_8, 0x7ffffff0 | 1ULL << 32),
|
||||
BPF_JMP32_REG(BPF_JGT, BPF_REG_7, BPF_REG_8, 1),
|
||||
BPF_EXIT_INSN(),
|
||||
BPF_JMP_IMM(BPF_JGT, BPF_REG_7, 0x7ffffff0, 1),
|
||||
BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 0),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.result = ACCEPT,
|
||||
.retval = 2,
|
||||
},
|
||||
{
|
||||
"jle32: BPF_K",
|
||||
.insns = {
|
||||
BPF_DIRECT_PKT_R2,
|
||||
BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_2, 0),
|
||||
BPF_JMP32_IMM(BPF_JLE, BPF_REG_7, INT_MAX, 1),
|
||||
BPF_EXIT_INSN(),
|
||||
BPF_ALU32_IMM(BPF_MOV, BPF_REG_0, 2),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
||||
.result = ACCEPT,
|
||||
.runs = 3,
|
||||
.retvals = {
|
||||
{ .retval = 2,
|
||||
.data64 = { INT_MAX - 1, }
|
||||
},
|
||||
{ .retval = 0,
|
||||
.data64 = { UINT_MAX, }
|
||||
},
|
||||
{ .retval = 2,
|
||||
.data64 = { INT_MAX, }
|
||||
},
|
||||
},
|
||||
},
|
||||
{
|
||||
"jle32: BPF_X",
|
||||
.insns = {
|
||||
BPF_DIRECT_PKT_R2,
|
||||
BPF_LD_IMM64(BPF_REG_8, (INT_MAX - 1) | 2ULL << 32),
|
||||
BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_2, 0),
|
||||
BPF_JMP32_REG(BPF_JLE, BPF_REG_7, BPF_REG_8, 1),
|
||||
BPF_EXIT_INSN(),
|
||||
BPF_ALU32_IMM(BPF_MOV, BPF_REG_0, 2),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
||||
.result = ACCEPT,
|
||||
.runs = 3,
|
||||
.retvals = {
|
||||
{ .retval = 0,
|
||||
.data64 = { INT_MAX | 1ULL << 32, }
|
||||
},
|
||||
{ .retval = 2,
|
||||
.data64 = { INT_MAX - 2, }
|
||||
},
|
||||
{ .retval = 0,
|
||||
.data64 = { UINT_MAX, }
|
||||
},
|
||||
},
|
||||
},
|
||||
{
|
||||
"jle32: min/max deduction",
|
||||
.insns = {
|
||||
BPF_RAND_UEXT_R7,
|
||||
BPF_ALU32_IMM(BPF_MOV, BPF_REG_0, 2),
|
||||
BPF_LD_IMM64(BPF_REG_8, 0x7ffffff0 | 1ULL << 32),
|
||||
BPF_JMP32_REG(BPF_JLE, BPF_REG_7, BPF_REG_8, 1),
|
||||
BPF_EXIT_INSN(),
|
||||
BPF_JMP32_IMM(BPF_JLE, BPF_REG_7, 0x7ffffff0, 1),
|
||||
BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 0),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.result = ACCEPT,
|
||||
.retval = 2,
|
||||
},
|
||||
{
|
||||
"jlt32: BPF_K",
|
||||
.insns = {
|
||||
BPF_DIRECT_PKT_R2,
|
||||
BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_2, 0),
|
||||
BPF_JMP32_IMM(BPF_JLT, BPF_REG_7, INT_MAX, 1),
|
||||
BPF_EXIT_INSN(),
|
||||
BPF_ALU32_IMM(BPF_MOV, BPF_REG_0, 2),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
||||
.result = ACCEPT,
|
||||
.runs = 3,
|
||||
.retvals = {
|
||||
{ .retval = 0,
|
||||
.data64 = { INT_MAX, }
|
||||
},
|
||||
{ .retval = 0,
|
||||
.data64 = { UINT_MAX, }
|
||||
},
|
||||
{ .retval = 2,
|
||||
.data64 = { INT_MAX - 1, }
|
||||
},
|
||||
},
|
||||
},
|
||||
{
|
||||
"jlt32: BPF_X",
|
||||
.insns = {
|
||||
BPF_DIRECT_PKT_R2,
|
||||
BPF_LD_IMM64(BPF_REG_8, INT_MAX | 2ULL << 32),
|
||||
BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_2, 0),
|
||||
BPF_JMP32_REG(BPF_JLT, BPF_REG_7, BPF_REG_8, 1),
|
||||
BPF_EXIT_INSN(),
|
||||
BPF_ALU32_IMM(BPF_MOV, BPF_REG_0, 2),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
||||
.result = ACCEPT,
|
||||
.runs = 3,
|
||||
.retvals = {
|
||||
{ .retval = 0,
|
||||
.data64 = { INT_MAX | 1ULL << 32, }
|
||||
},
|
||||
{ .retval = 0,
|
||||
.data64 = { UINT_MAX, }
|
||||
},
|
||||
{ .retval = 2,
|
||||
.data64 = { (INT_MAX - 1) | 3ULL << 32, }
|
||||
},
|
||||
},
|
||||
},
|
||||
{
|
||||
"jlt32: min/max deduction",
|
||||
.insns = {
|
||||
BPF_RAND_UEXT_R7,
|
||||
BPF_ALU32_IMM(BPF_MOV, BPF_REG_0, 2),
|
||||
BPF_LD_IMM64(BPF_REG_8, 0x7ffffff0 | 1ULL << 32),
|
||||
BPF_JMP32_REG(BPF_JLT, BPF_REG_7, BPF_REG_8, 1),
|
||||
BPF_EXIT_INSN(),
|
||||
BPF_JMP_IMM(BPF_JSLT, BPF_REG_7, 0x7ffffff0, 1),
|
||||
BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 0),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.result = ACCEPT,
|
||||
.retval = 2,
|
||||
},
|
||||
{
|
||||
"jsge32: BPF_K",
|
||||
.insns = {
|
||||
BPF_DIRECT_PKT_R2,
|
||||
BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_2, 0),
|
||||
BPF_JMP32_IMM(BPF_JSGE, BPF_REG_7, -1, 1),
|
||||
BPF_EXIT_INSN(),
|
||||
BPF_ALU32_IMM(BPF_MOV, BPF_REG_0, 2),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
||||
.result = ACCEPT,
|
||||
.runs = 3,
|
||||
.retvals = {
|
||||
{ .retval = 2,
|
||||
.data64 = { 0, }
|
||||
},
|
||||
{ .retval = 2,
|
||||
.data64 = { -1, }
|
||||
},
|
||||
{ .retval = 0,
|
||||
.data64 = { -2, }
|
||||
},
|
||||
},
|
||||
},
|
||||
{
|
||||
"jsge32: BPF_X",
|
||||
.insns = {
|
||||
BPF_DIRECT_PKT_R2,
|
||||
BPF_LD_IMM64(BPF_REG_8, (__u32)-1 | 2ULL << 32),
|
||||
BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_2, 0),
|
||||
BPF_JMP32_REG(BPF_JSGE, BPF_REG_7, BPF_REG_8, 1),
|
||||
BPF_EXIT_INSN(),
|
||||
BPF_ALU32_IMM(BPF_MOV, BPF_REG_0, 2),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
||||
.result = ACCEPT,
|
||||
.runs = 3,
|
||||
.retvals = {
|
||||
{ .retval = 2,
|
||||
.data64 = { -1, }
|
||||
},
|
||||
{ .retval = 2,
|
||||
.data64 = { 0x7fffffff | 1ULL << 32, }
|
||||
},
|
||||
{ .retval = 0,
|
||||
.data64 = { -2, }
|
||||
},
|
||||
},
|
||||
},
|
||||
{
|
||||
"jsge32: min/max deduction",
|
||||
.insns = {
|
||||
BPF_RAND_UEXT_R7,
|
||||
BPF_ALU32_IMM(BPF_MOV, BPF_REG_0, 2),
|
||||
BPF_LD_IMM64(BPF_REG_8, 0x7ffffff0 | 1ULL << 32),
|
||||
BPF_JMP32_REG(BPF_JSGE, BPF_REG_7, BPF_REG_8, 1),
|
||||
BPF_EXIT_INSN(),
|
||||
BPF_JMP_IMM(BPF_JSGE, BPF_REG_7, 0x7ffffff0, 1),
|
||||
BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 0),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.result = ACCEPT,
|
||||
.retval = 2,
|
||||
},
|
||||
{
|
||||
"jsgt32: BPF_K",
|
||||
.insns = {
|
||||
BPF_DIRECT_PKT_R2,
|
||||
BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_2, 0),
|
||||
BPF_JMP32_IMM(BPF_JSGT, BPF_REG_7, -1, 1),
|
||||
BPF_EXIT_INSN(),
|
||||
BPF_ALU32_IMM(BPF_MOV, BPF_REG_0, 2),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
||||
.result = ACCEPT,
|
||||
.runs = 3,
|
||||
.retvals = {
|
||||
{ .retval = 0,
|
||||
.data64 = { (__u32)-2, }
|
||||
},
|
||||
{ .retval = 0,
|
||||
.data64 = { -1, }
|
||||
},
|
||||
{ .retval = 2,
|
||||
.data64 = { 1, }
|
||||
},
|
||||
},
|
||||
},
|
||||
{
|
||||
"jsgt32: BPF_X",
|
||||
.insns = {
|
||||
BPF_DIRECT_PKT_R2,
|
||||
BPF_LD_IMM64(BPF_REG_8, 0x7ffffffe | 1ULL << 32),
|
||||
BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_2, 0),
|
||||
BPF_JMP32_REG(BPF_JSGT, BPF_REG_7, BPF_REG_8, 1),
|
||||
BPF_EXIT_INSN(),
|
||||
BPF_ALU32_IMM(BPF_MOV, BPF_REG_0, 2),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
||||
.result = ACCEPT,
|
||||
.runs = 3,
|
||||
.retvals = {
|
||||
{ .retval = 0,
|
||||
.data64 = { 0x7ffffffe, }
|
||||
},
|
||||
{ .retval = 0,
|
||||
.data64 = { 0x1ffffffffULL, }
|
||||
},
|
||||
{ .retval = 2,
|
||||
.data64 = { 0x7fffffff, }
|
||||
},
|
||||
},
|
||||
},
|
||||
{
|
||||
"jsgt32: min/max deduction",
|
||||
.insns = {
|
||||
BPF_RAND_SEXT_R7,
|
||||
BPF_ALU32_IMM(BPF_MOV, BPF_REG_0, 2),
|
||||
BPF_LD_IMM64(BPF_REG_8, (__u32)(-2) | 1ULL << 32),
|
||||
BPF_JMP32_REG(BPF_JSGT, BPF_REG_7, BPF_REG_8, 1),
|
||||
BPF_EXIT_INSN(),
|
||||
BPF_JMP_IMM(BPF_JSGT, BPF_REG_7, -2, 1),
|
||||
BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 0),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.result = ACCEPT,
|
||||
.retval = 2,
|
||||
},
|
||||
{
|
||||
"jsle32: BPF_K",
|
||||
.insns = {
|
||||
BPF_DIRECT_PKT_R2,
|
||||
BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_2, 0),
|
||||
BPF_JMP32_IMM(BPF_JSLE, BPF_REG_7, -1, 1),
|
||||
BPF_EXIT_INSN(),
|
||||
BPF_ALU32_IMM(BPF_MOV, BPF_REG_0, 2),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
||||
.result = ACCEPT,
|
||||
.runs = 3,
|
||||
.retvals = {
|
||||
{ .retval = 2,
|
||||
.data64 = { (__u32)-2, }
|
||||
},
|
||||
{ .retval = 2,
|
||||
.data64 = { -1, }
|
||||
},
|
||||
{ .retval = 0,
|
||||
.data64 = { 1, }
|
||||
},
|
||||
},
|
||||
},
|
||||
{
|
||||
"jsle32: BPF_X",
|
||||
.insns = {
|
||||
BPF_DIRECT_PKT_R2,
|
||||
BPF_LD_IMM64(BPF_REG_8, 0x7ffffffe | 1ULL << 32),
|
||||
BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_2, 0),
|
||||
BPF_JMP32_REG(BPF_JSLE, BPF_REG_7, BPF_REG_8, 1),
|
||||
BPF_EXIT_INSN(),
|
||||
BPF_ALU32_IMM(BPF_MOV, BPF_REG_0, 2),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
||||
.result = ACCEPT,
|
||||
.runs = 3,
|
||||
.retvals = {
|
||||
{ .retval = 2,
|
||||
.data64 = { 0x7ffffffe, }
|
||||
},
|
||||
{ .retval = 2,
|
||||
.data64 = { (__u32)-1, }
|
||||
},
|
||||
{ .retval = 0,
|
||||
.data64 = { 0x7fffffff | 2ULL << 32, }
|
||||
},
|
||||
},
|
||||
},
|
||||
{
|
||||
"jsle32: min/max deduction",
|
||||
.insns = {
|
||||
BPF_RAND_UEXT_R7,
|
||||
BPF_ALU32_IMM(BPF_MOV, BPF_REG_0, 2),
|
||||
BPF_LD_IMM64(BPF_REG_8, 0x7ffffff0 | 1ULL << 32),
|
||||
BPF_JMP32_REG(BPF_JSLE, BPF_REG_7, BPF_REG_8, 1),
|
||||
BPF_EXIT_INSN(),
|
||||
BPF_JMP_IMM(BPF_JSLE, BPF_REG_7, 0x7ffffff0, 1),
|
||||
BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 0),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.result = ACCEPT,
|
||||
.retval = 2,
|
||||
},
|
||||
{
|
||||
"jslt32: BPF_K",
|
||||
.insns = {
|
||||
BPF_DIRECT_PKT_R2,
|
||||
BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_2, 0),
|
||||
BPF_JMP32_IMM(BPF_JSLT, BPF_REG_7, -1, 1),
|
||||
BPF_EXIT_INSN(),
|
||||
BPF_ALU32_IMM(BPF_MOV, BPF_REG_0, 2),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
||||
.result = ACCEPT,
|
||||
.runs = 3,
|
||||
.retvals = {
|
||||
{ .retval = 2,
|
||||
.data64 = { (__u32)-2, }
|
||||
},
|
||||
{ .retval = 0,
|
||||
.data64 = { -1, }
|
||||
},
|
||||
{ .retval = 0,
|
||||
.data64 = { 1, }
|
||||
},
|
||||
},
|
||||
},
|
||||
{
|
||||
"jslt32: BPF_X",
|
||||
.insns = {
|
||||
BPF_DIRECT_PKT_R2,
|
||||
BPF_LD_IMM64(BPF_REG_8, 0x7fffffff | 1ULL << 32),
|
||||
BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_2, 0),
|
||||
BPF_JMP32_REG(BPF_JSLT, BPF_REG_7, BPF_REG_8, 1),
|
||||
BPF_EXIT_INSN(),
|
||||
BPF_ALU32_IMM(BPF_MOV, BPF_REG_0, 2),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
||||
.result = ACCEPT,
|
||||
.runs = 3,
|
||||
.retvals = {
|
||||
{ .retval = 2,
|
||||
.data64 = { 0x7ffffffe, }
|
||||
},
|
||||
{ .retval = 2,
|
||||
.data64 = { 0xffffffff, }
|
||||
},
|
||||
{ .retval = 0,
|
||||
.data64 = { 0x7fffffff | 2ULL << 32, }
|
||||
},
|
||||
},
|
||||
},
|
||||
{
|
||||
"jslt32: min/max deduction",
|
||||
.insns = {
|
||||
BPF_RAND_SEXT_R7,
|
||||
BPF_ALU32_IMM(BPF_MOV, BPF_REG_0, 2),
|
||||
BPF_LD_IMM64(BPF_REG_8, (__u32)(-1) | 1ULL << 32),
|
||||
BPF_JMP32_REG(BPF_JSLT, BPF_REG_7, BPF_REG_8, 1),
|
||||
BPF_EXIT_INSN(),
|
||||
BPF_JMP32_IMM(BPF_JSLT, BPF_REG_7, -1, 1),
|
||||
BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 0),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.result = ACCEPT,
|
||||
.retval = 2,
|
||||
},
|
||||
165
tools/testing/selftests/bpf/verifier/jset.c
Normal file
165
tools/testing/selftests/bpf/verifier/jset.c
Normal file
@ -0,0 +1,165 @@
|
||||
{
|
||||
"jset: functional",
|
||||
.insns = {
|
||||
BPF_DIRECT_PKT_R2,
|
||||
BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_2, 0),
|
||||
|
||||
/* reg, bit 63 or bit 0 set, taken */
|
||||
BPF_LD_IMM64(BPF_REG_8, 0x8000000000000001),
|
||||
BPF_JMP_REG(BPF_JSET, BPF_REG_7, BPF_REG_8, 1),
|
||||
BPF_EXIT_INSN(),
|
||||
|
||||
/* reg, bit 62, not taken */
|
||||
BPF_LD_IMM64(BPF_REG_8, 0x4000000000000000),
|
||||
BPF_JMP_REG(BPF_JSET, BPF_REG_7, BPF_REG_8, 1),
|
||||
BPF_JMP_IMM(BPF_JA, 0, 0, 1),
|
||||
BPF_EXIT_INSN(),
|
||||
|
||||
/* imm, any bit set, taken */
|
||||
BPF_JMP_IMM(BPF_JSET, BPF_REG_7, -1, 1),
|
||||
BPF_EXIT_INSN(),
|
||||
|
||||
/* imm, bit 31 set, taken */
|
||||
BPF_JMP_IMM(BPF_JSET, BPF_REG_7, 0x80000000, 1),
|
||||
BPF_EXIT_INSN(),
|
||||
|
||||
/* all good - return r0 == 2 */
|
||||
BPF_MOV64_IMM(BPF_REG_0, 2),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
||||
.result = ACCEPT,
|
||||
.runs = 7,
|
||||
.retvals = {
|
||||
{ .retval = 2,
|
||||
.data64 = { (1ULL << 63) | (1U << 31) | (1U << 0), }
|
||||
},
|
||||
{ .retval = 2,
|
||||
.data64 = { (1ULL << 63) | (1U << 31), }
|
||||
},
|
||||
{ .retval = 2,
|
||||
.data64 = { (1ULL << 31) | (1U << 0), }
|
||||
},
|
||||
{ .retval = 2,
|
||||
.data64 = { (__u32)-1, }
|
||||
},
|
||||
{ .retval = 2,
|
||||
.data64 = { ~0x4000000000000000ULL, }
|
||||
},
|
||||
{ .retval = 0,
|
||||
.data64 = { 0, }
|
||||
},
|
||||
{ .retval = 0,
|
||||
.data64 = { ~0ULL, }
|
||||
},
|
||||
},
|
||||
},
|
||||
{
|
||||
"jset: sign-extend",
|
||||
.insns = {
|
||||
BPF_DIRECT_PKT_R2,
|
||||
BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_2, 0),
|
||||
|
||||
BPF_JMP_IMM(BPF_JSET, BPF_REG_7, 0x80000000, 1),
|
||||
BPF_EXIT_INSN(),
|
||||
|
||||
BPF_MOV64_IMM(BPF_REG_0, 2),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
||||
.result = ACCEPT,
|
||||
.retval = 2,
|
||||
.data = { 1, 0, 0, 0, 0, 0, 0, 1, },
|
||||
},
|
||||
{
|
||||
"jset: known const compare",
|
||||
.insns = {
|
||||
BPF_MOV64_IMM(BPF_REG_0, 1),
|
||||
BPF_JMP_IMM(BPF_JSET, BPF_REG_0, 1, 1),
|
||||
BPF_LDX_MEM(BPF_B, BPF_REG_8, BPF_REG_9, 0),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.prog_type = BPF_PROG_TYPE_SOCKET_FILTER,
|
||||
.retval_unpriv = 1,
|
||||
.result_unpriv = ACCEPT,
|
||||
.retval = 1,
|
||||
.result = ACCEPT,
|
||||
},
|
||||
{
|
||||
"jset: known const compare bad",
|
||||
.insns = {
|
||||
BPF_MOV64_IMM(BPF_REG_0, 0),
|
||||
BPF_JMP_IMM(BPF_JSET, BPF_REG_0, 1, 1),
|
||||
BPF_LDX_MEM(BPF_B, BPF_REG_8, BPF_REG_9, 0),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.prog_type = BPF_PROG_TYPE_SOCKET_FILTER,
|
||||
.errstr_unpriv = "!read_ok",
|
||||
.result_unpriv = REJECT,
|
||||
.errstr = "!read_ok",
|
||||
.result = REJECT,
|
||||
},
|
||||
{
|
||||
"jset: unknown const compare taken",
|
||||
.insns = {
|
||||
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_get_prandom_u32),
|
||||
BPF_JMP_IMM(BPF_JSET, BPF_REG_0, 1, 1),
|
||||
BPF_JMP_IMM(BPF_JA, 0, 0, 1),
|
||||
BPF_LDX_MEM(BPF_B, BPF_REG_8, BPF_REG_9, 0),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.prog_type = BPF_PROG_TYPE_SOCKET_FILTER,
|
||||
.errstr_unpriv = "!read_ok",
|
||||
.result_unpriv = REJECT,
|
||||
.errstr = "!read_ok",
|
||||
.result = REJECT,
|
||||
},
|
||||
{
|
||||
"jset: unknown const compare not taken",
|
||||
.insns = {
|
||||
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_get_prandom_u32),
|
||||
BPF_JMP_IMM(BPF_JSET, BPF_REG_0, 1, 1),
|
||||
BPF_LDX_MEM(BPF_B, BPF_REG_8, BPF_REG_9, 0),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.prog_type = BPF_PROG_TYPE_SOCKET_FILTER,
|
||||
.errstr_unpriv = "!read_ok",
|
||||
.result_unpriv = REJECT,
|
||||
.errstr = "!read_ok",
|
||||
.result = REJECT,
|
||||
},
|
||||
{
|
||||
"jset: half-known const compare",
|
||||
.insns = {
|
||||
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_get_prandom_u32),
|
||||
BPF_ALU64_IMM(BPF_OR, BPF_REG_0, 2),
|
||||
BPF_JMP_IMM(BPF_JSET, BPF_REG_0, 3, 1),
|
||||
BPF_LDX_MEM(BPF_B, BPF_REG_8, BPF_REG_9, 0),
|
||||
BPF_MOV64_IMM(BPF_REG_0, 0),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.prog_type = BPF_PROG_TYPE_SOCKET_FILTER,
|
||||
.result_unpriv = ACCEPT,
|
||||
.result = ACCEPT,
|
||||
},
|
||||
{
|
||||
"jset: range",
|
||||
.insns = {
|
||||
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_get_prandom_u32),
|
||||
BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
|
||||
BPF_MOV64_IMM(BPF_REG_0, 0),
|
||||
BPF_ALU64_IMM(BPF_AND, BPF_REG_1, 0xff),
|
||||
BPF_JMP_IMM(BPF_JSET, BPF_REG_1, 0xf0, 3),
|
||||
BPF_JMP_IMM(BPF_JLT, BPF_REG_1, 0x10, 1),
|
||||
BPF_LDX_MEM(BPF_B, BPF_REG_8, BPF_REG_9, 0),
|
||||
BPF_EXIT_INSN(),
|
||||
BPF_JMP_IMM(BPF_JSET, BPF_REG_1, 0x10, 1),
|
||||
BPF_EXIT_INSN(),
|
||||
BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0x10, 1),
|
||||
BPF_LDX_MEM(BPF_B, BPF_REG_8, BPF_REG_9, 0),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.prog_type = BPF_PROG_TYPE_SOCKET_FILTER,
|
||||
.result_unpriv = ACCEPT,
|
||||
.result = ACCEPT,
|
||||
},
|
||||
@ -93,3 +93,194 @@
|
||||
.result = ACCEPT,
|
||||
.retval = 42 /* ultimate return value */,
|
||||
},
|
||||
{
|
||||
"ld_abs: invalid op 1",
|
||||
.insns = {
|
||||
BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
|
||||
BPF_LD_ABS(BPF_DW, 0),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
||||
.result = REJECT,
|
||||
.errstr = "unknown opcode",
|
||||
},
|
||||
{
|
||||
"ld_abs: invalid op 2",
|
||||
.insns = {
|
||||
BPF_MOV32_IMM(BPF_REG_0, 256),
|
||||
BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
|
||||
BPF_LD_IND(BPF_DW, BPF_REG_0, 0),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
||||
.result = REJECT,
|
||||
.errstr = "unknown opcode",
|
||||
},
|
||||
{
|
||||
"ld_abs: nmap reduced",
|
||||
.insns = {
|
||||
BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
|
||||
BPF_LD_ABS(BPF_H, 12),
|
||||
BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0x806, 28),
|
||||
BPF_LD_ABS(BPF_H, 12),
|
||||
BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0x806, 26),
|
||||
BPF_MOV32_IMM(BPF_REG_0, 18),
|
||||
BPF_STX_MEM(BPF_W, BPF_REG_10, BPF_REG_0, -64),
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_10, -64),
|
||||
BPF_LD_IND(BPF_W, BPF_REG_7, 14),
|
||||
BPF_STX_MEM(BPF_W, BPF_REG_10, BPF_REG_0, -60),
|
||||
BPF_MOV32_IMM(BPF_REG_0, 280971478),
|
||||
BPF_STX_MEM(BPF_W, BPF_REG_10, BPF_REG_0, -56),
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_10, -56),
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_10, -60),
|
||||
BPF_ALU32_REG(BPF_SUB, BPF_REG_0, BPF_REG_7),
|
||||
BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 15),
|
||||
BPF_LD_ABS(BPF_H, 12),
|
||||
BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0x806, 13),
|
||||
BPF_MOV32_IMM(BPF_REG_0, 22),
|
||||
BPF_STX_MEM(BPF_W, BPF_REG_10, BPF_REG_0, -56),
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_10, -56),
|
||||
BPF_LD_IND(BPF_H, BPF_REG_7, 14),
|
||||
BPF_STX_MEM(BPF_W, BPF_REG_10, BPF_REG_0, -52),
|
||||
BPF_MOV32_IMM(BPF_REG_0, 17366),
|
||||
BPF_STX_MEM(BPF_W, BPF_REG_10, BPF_REG_0, -48),
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_10, -48),
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_10, -52),
|
||||
BPF_ALU32_REG(BPF_SUB, BPF_REG_0, BPF_REG_7),
|
||||
BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
|
||||
BPF_MOV32_IMM(BPF_REG_0, 256),
|
||||
BPF_EXIT_INSN(),
|
||||
BPF_MOV32_IMM(BPF_REG_0, 0),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.data = {
|
||||
0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0x08, 0x06, 0,
|
||||
0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
|
||||
0x10, 0xbf, 0x48, 0xd6, 0x43, 0xd6,
|
||||
},
|
||||
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
||||
.result = ACCEPT,
|
||||
.retval = 256,
|
||||
},
|
||||
{
|
||||
"ld_abs: div + abs, test 1",
|
||||
.insns = {
|
||||
BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_1),
|
||||
BPF_LD_ABS(BPF_B, 3),
|
||||
BPF_ALU64_IMM(BPF_MOV, BPF_REG_2, 2),
|
||||
BPF_ALU32_REG(BPF_DIV, BPF_REG_0, BPF_REG_2),
|
||||
BPF_ALU64_REG(BPF_MOV, BPF_REG_8, BPF_REG_0),
|
||||
BPF_LD_ABS(BPF_B, 4),
|
||||
BPF_ALU64_REG(BPF_ADD, BPF_REG_8, BPF_REG_0),
|
||||
BPF_LD_IND(BPF_B, BPF_REG_8, -70),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.data = {
|
||||
10, 20, 30, 40, 50,
|
||||
},
|
||||
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
||||
.result = ACCEPT,
|
||||
.retval = 10,
|
||||
},
|
||||
{
|
||||
"ld_abs: div + abs, test 2",
|
||||
.insns = {
|
||||
BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_1),
|
||||
BPF_LD_ABS(BPF_B, 3),
|
||||
BPF_ALU64_IMM(BPF_MOV, BPF_REG_2, 2),
|
||||
BPF_ALU32_REG(BPF_DIV, BPF_REG_0, BPF_REG_2),
|
||||
BPF_ALU64_REG(BPF_MOV, BPF_REG_8, BPF_REG_0),
|
||||
BPF_LD_ABS(BPF_B, 128),
|
||||
BPF_ALU64_REG(BPF_ADD, BPF_REG_8, BPF_REG_0),
|
||||
BPF_LD_IND(BPF_B, BPF_REG_8, -70),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.data = {
|
||||
10, 20, 30, 40, 50,
|
||||
},
|
||||
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
||||
.result = ACCEPT,
|
||||
.retval = 0,
|
||||
},
|
||||
{
|
||||
"ld_abs: div + abs, test 3",
|
||||
.insns = {
|
||||
BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_1),
|
||||
BPF_ALU64_IMM(BPF_MOV, BPF_REG_7, 0),
|
||||
BPF_LD_ABS(BPF_B, 3),
|
||||
BPF_ALU32_REG(BPF_DIV, BPF_REG_0, BPF_REG_7),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.data = {
|
||||
10, 20, 30, 40, 50,
|
||||
},
|
||||
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
||||
.result = ACCEPT,
|
||||
.retval = 0,
|
||||
},
|
||||
{
|
||||
"ld_abs: div + abs, test 4",
|
||||
.insns = {
|
||||
BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_1),
|
||||
BPF_ALU64_IMM(BPF_MOV, BPF_REG_7, 0),
|
||||
BPF_LD_ABS(BPF_B, 256),
|
||||
BPF_ALU32_REG(BPF_DIV, BPF_REG_0, BPF_REG_7),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.data = {
|
||||
10, 20, 30, 40, 50,
|
||||
},
|
||||
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
||||
.result = ACCEPT,
|
||||
.retval = 0,
|
||||
},
|
||||
{
|
||||
"ld_abs: vlan + abs, test 1",
|
||||
.insns = { },
|
||||
.data = {
|
||||
0x34,
|
||||
},
|
||||
.fill_helper = bpf_fill_ld_abs_vlan_push_pop,
|
||||
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
||||
.result = ACCEPT,
|
||||
.retval = 0xbef,
|
||||
},
|
||||
{
|
||||
"ld_abs: vlan + abs, test 2",
|
||||
.insns = {
|
||||
BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
|
||||
BPF_LD_ABS(BPF_B, 0),
|
||||
BPF_LD_ABS(BPF_H, 0),
|
||||
BPF_LD_ABS(BPF_W, 0),
|
||||
BPF_MOV64_REG(BPF_REG_7, BPF_REG_6),
|
||||
BPF_MOV64_IMM(BPF_REG_6, 0),
|
||||
BPF_MOV64_REG(BPF_REG_1, BPF_REG_7),
|
||||
BPF_MOV64_IMM(BPF_REG_2, 1),
|
||||
BPF_MOV64_IMM(BPF_REG_3, 2),
|
||||
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
|
||||
BPF_FUNC_skb_vlan_push),
|
||||
BPF_MOV64_REG(BPF_REG_6, BPF_REG_7),
|
||||
BPF_LD_ABS(BPF_B, 0),
|
||||
BPF_LD_ABS(BPF_H, 0),
|
||||
BPF_LD_ABS(BPF_W, 0),
|
||||
BPF_MOV64_IMM(BPF_REG_0, 42),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.data = {
|
||||
0x34,
|
||||
},
|
||||
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
||||
.result = ACCEPT,
|
||||
.retval = 42,
|
||||
},
|
||||
{
|
||||
"ld_abs: jump around ld_abs",
|
||||
.insns = { },
|
||||
.data = {
|
||||
10, 11,
|
||||
},
|
||||
.fill_helper = bpf_fill_jump_around_ld_abs,
|
||||
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
||||
.result = ACCEPT,
|
||||
.retval = 10,
|
||||
},
|
||||
|
||||
36
tools/testing/selftests/bpf/verifier/ld_dw.c
Normal file
36
tools/testing/selftests/bpf/verifier/ld_dw.c
Normal file
@ -0,0 +1,36 @@
|
||||
{
|
||||
"ld_dw: xor semi-random 64 bit imms, test 1",
|
||||
.insns = { },
|
||||
.data = { },
|
||||
.fill_helper = bpf_fill_rand_ld_dw,
|
||||
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
||||
.result = ACCEPT,
|
||||
.retval = 4090,
|
||||
},
|
||||
{
|
||||
"ld_dw: xor semi-random 64 bit imms, test 2",
|
||||
.insns = { },
|
||||
.data = { },
|
||||
.fill_helper = bpf_fill_rand_ld_dw,
|
||||
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
||||
.result = ACCEPT,
|
||||
.retval = 2047,
|
||||
},
|
||||
{
|
||||
"ld_dw: xor semi-random 64 bit imms, test 3",
|
||||
.insns = { },
|
||||
.data = { },
|
||||
.fill_helper = bpf_fill_rand_ld_dw,
|
||||
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
||||
.result = ACCEPT,
|
||||
.retval = 511,
|
||||
},
|
||||
{
|
||||
"ld_dw: xor semi-random 64 bit imms, test 4",
|
||||
.insns = { },
|
||||
.data = { },
|
||||
.fill_helper = bpf_fill_rand_ld_dw,
|
||||
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
||||
.result = ACCEPT,
|
||||
.retval = 5,
|
||||
},
|
||||
100
tools/testing/selftests/bpf/verifier/map_ptr_mixing.c
Normal file
100
tools/testing/selftests/bpf/verifier/map_ptr_mixing.c
Normal file
@ -0,0 +1,100 @@
|
||||
{
|
||||
"calls: two calls returning different map pointers for lookup (hash, array)",
|
||||
.insns = {
|
||||
/* main prog */
|
||||
BPF_JMP_IMM(BPF_JNE, BPF_REG_1, 0, 2),
|
||||
BPF_CALL_REL(11),
|
||||
BPF_JMP_IMM(BPF_JA, 0, 0, 1),
|
||||
BPF_CALL_REL(12),
|
||||
BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
|
||||
BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
|
||||
BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
|
||||
BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
|
||||
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
|
||||
BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
|
||||
BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, offsetof(struct test_val, foo)),
|
||||
BPF_MOV64_IMM(BPF_REG_0, 1),
|
||||
BPF_EXIT_INSN(),
|
||||
/* subprog 1 */
|
||||
BPF_LD_MAP_FD(BPF_REG_0, 0),
|
||||
BPF_EXIT_INSN(),
|
||||
/* subprog 2 */
|
||||
BPF_LD_MAP_FD(BPF_REG_0, 0),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
||||
.fixup_map_hash_48b = { 13 },
|
||||
.fixup_map_array_48b = { 16 },
|
||||
.result = ACCEPT,
|
||||
.retval = 1,
|
||||
},
|
||||
{
|
||||
"calls: two calls returning different map pointers for lookup (hash, map in map)",
|
||||
.insns = {
|
||||
/* main prog */
|
||||
BPF_JMP_IMM(BPF_JNE, BPF_REG_1, 0, 2),
|
||||
BPF_CALL_REL(11),
|
||||
BPF_JMP_IMM(BPF_JA, 0, 0, 1),
|
||||
BPF_CALL_REL(12),
|
||||
BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
|
||||
BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
|
||||
BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
|
||||
BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
|
||||
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
|
||||
BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
|
||||
BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, offsetof(struct test_val, foo)),
|
||||
BPF_MOV64_IMM(BPF_REG_0, 1),
|
||||
BPF_EXIT_INSN(),
|
||||
/* subprog 1 */
|
||||
BPF_LD_MAP_FD(BPF_REG_0, 0),
|
||||
BPF_EXIT_INSN(),
|
||||
/* subprog 2 */
|
||||
BPF_LD_MAP_FD(BPF_REG_0, 0),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
||||
.fixup_map_in_map = { 16 },
|
||||
.fixup_map_array_48b = { 13 },
|
||||
.result = REJECT,
|
||||
.errstr = "R0 invalid mem access 'map_ptr'",
|
||||
},
|
||||
{
|
||||
"cond: two branches returning different map pointers for lookup (tail, tail)",
|
||||
.insns = {
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
|
||||
offsetof(struct __sk_buff, mark)),
|
||||
BPF_JMP_IMM(BPF_JNE, BPF_REG_6, 0, 3),
|
||||
BPF_LD_MAP_FD(BPF_REG_2, 0),
|
||||
BPF_JMP_IMM(BPF_JA, 0, 0, 2),
|
||||
BPF_LD_MAP_FD(BPF_REG_2, 0),
|
||||
BPF_MOV64_IMM(BPF_REG_3, 7),
|
||||
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_tail_call),
|
||||
BPF_MOV64_IMM(BPF_REG_0, 1),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.fixup_prog1 = { 5 },
|
||||
.fixup_prog2 = { 2 },
|
||||
.result_unpriv = REJECT,
|
||||
.errstr_unpriv = "tail_call abusing map_ptr",
|
||||
.result = ACCEPT,
|
||||
.retval = 42,
|
||||
},
|
||||
{
|
||||
"cond: two branches returning same map pointers for lookup (tail, tail)",
|
||||
.insns = {
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
|
||||
offsetof(struct __sk_buff, mark)),
|
||||
BPF_JMP_IMM(BPF_JEQ, BPF_REG_6, 0, 3),
|
||||
BPF_LD_MAP_FD(BPF_REG_2, 0),
|
||||
BPF_JMP_IMM(BPF_JA, 0, 0, 2),
|
||||
BPF_LD_MAP_FD(BPF_REG_2, 0),
|
||||
BPF_MOV64_IMM(BPF_REG_3, 7),
|
||||
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_tail_call),
|
||||
BPF_MOV64_IMM(BPF_REG_0, 1),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.fixup_prog2 = { 2, 5 },
|
||||
.result_unpriv = ACCEPT,
|
||||
.result = ACCEPT,
|
||||
.retval = 42,
|
||||
},
|
||||
322
tools/testing/selftests/bpf/verifier/masking.c
Normal file
322
tools/testing/selftests/bpf/verifier/masking.c
Normal file
@ -0,0 +1,322 @@
|
||||
{
|
||||
"masking, test out of bounds 1",
|
||||
.insns = {
|
||||
BPF_MOV32_IMM(BPF_REG_1, 5),
|
||||
BPF_MOV32_IMM(BPF_REG_2, 5 - 1),
|
||||
BPF_ALU64_REG(BPF_SUB, BPF_REG_2, BPF_REG_1),
|
||||
BPF_ALU64_REG(BPF_OR, BPF_REG_2, BPF_REG_1),
|
||||
BPF_ALU64_IMM(BPF_NEG, BPF_REG_2, 0),
|
||||
BPF_ALU64_IMM(BPF_ARSH, BPF_REG_2, 63),
|
||||
BPF_ALU64_REG(BPF_AND, BPF_REG_1, BPF_REG_2),
|
||||
BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.result = ACCEPT,
|
||||
.retval = 0,
|
||||
},
|
||||
{
|
||||
"masking, test out of bounds 2",
|
||||
.insns = {
|
||||
BPF_MOV32_IMM(BPF_REG_1, 1),
|
||||
BPF_MOV32_IMM(BPF_REG_2, 1 - 1),
|
||||
BPF_ALU64_REG(BPF_SUB, BPF_REG_2, BPF_REG_1),
|
||||
BPF_ALU64_REG(BPF_OR, BPF_REG_2, BPF_REG_1),
|
||||
BPF_ALU64_IMM(BPF_NEG, BPF_REG_2, 0),
|
||||
BPF_ALU64_IMM(BPF_ARSH, BPF_REG_2, 63),
|
||||
BPF_ALU64_REG(BPF_AND, BPF_REG_1, BPF_REG_2),
|
||||
BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.result = ACCEPT,
|
||||
.retval = 0,
|
||||
},
|
||||
{
|
||||
"masking, test out of bounds 3",
|
||||
.insns = {
|
||||
BPF_MOV32_IMM(BPF_REG_1, 0xffffffff),
|
||||
BPF_MOV32_IMM(BPF_REG_2, 0xffffffff - 1),
|
||||
BPF_ALU64_REG(BPF_SUB, BPF_REG_2, BPF_REG_1),
|
||||
BPF_ALU64_REG(BPF_OR, BPF_REG_2, BPF_REG_1),
|
||||
BPF_ALU64_IMM(BPF_NEG, BPF_REG_2, 0),
|
||||
BPF_ALU64_IMM(BPF_ARSH, BPF_REG_2, 63),
|
||||
BPF_ALU64_REG(BPF_AND, BPF_REG_1, BPF_REG_2),
|
||||
BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.result = ACCEPT,
|
||||
.retval = 0,
|
||||
},
|
||||
{
|
||||
"masking, test out of bounds 4",
|
||||
.insns = {
|
||||
BPF_MOV32_IMM(BPF_REG_1, 0xffffffff),
|
||||
BPF_MOV32_IMM(BPF_REG_2, 1 - 1),
|
||||
BPF_ALU64_REG(BPF_SUB, BPF_REG_2, BPF_REG_1),
|
||||
BPF_ALU64_REG(BPF_OR, BPF_REG_2, BPF_REG_1),
|
||||
BPF_ALU64_IMM(BPF_NEG, BPF_REG_2, 0),
|
||||
BPF_ALU64_IMM(BPF_ARSH, BPF_REG_2, 63),
|
||||
BPF_ALU64_REG(BPF_AND, BPF_REG_1, BPF_REG_2),
|
||||
BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.result = ACCEPT,
|
||||
.retval = 0,
|
||||
},
|
||||
{
|
||||
"masking, test out of bounds 5",
|
||||
.insns = {
|
||||
BPF_MOV32_IMM(BPF_REG_1, -1),
|
||||
BPF_MOV32_IMM(BPF_REG_2, 1 - 1),
|
||||
BPF_ALU64_REG(BPF_SUB, BPF_REG_2, BPF_REG_1),
|
||||
BPF_ALU64_REG(BPF_OR, BPF_REG_2, BPF_REG_1),
|
||||
BPF_ALU64_IMM(BPF_NEG, BPF_REG_2, 0),
|
||||
BPF_ALU64_IMM(BPF_ARSH, BPF_REG_2, 63),
|
||||
BPF_ALU64_REG(BPF_AND, BPF_REG_1, BPF_REG_2),
|
||||
BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.result = ACCEPT,
|
||||
.retval = 0,
|
||||
},
|
||||
{
|
||||
"masking, test out of bounds 6",
|
||||
.insns = {
|
||||
BPF_MOV32_IMM(BPF_REG_1, -1),
|
||||
BPF_MOV32_IMM(BPF_REG_2, 0xffffffff - 1),
|
||||
BPF_ALU64_REG(BPF_SUB, BPF_REG_2, BPF_REG_1),
|
||||
BPF_ALU64_REG(BPF_OR, BPF_REG_2, BPF_REG_1),
|
||||
BPF_ALU64_IMM(BPF_NEG, BPF_REG_2, 0),
|
||||
BPF_ALU64_IMM(BPF_ARSH, BPF_REG_2, 63),
|
||||
BPF_ALU64_REG(BPF_AND, BPF_REG_1, BPF_REG_2),
|
||||
BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.result = ACCEPT,
|
||||
.retval = 0,
|
||||
},
|
||||
{
|
||||
"masking, test out of bounds 7",
|
||||
.insns = {
|
||||
BPF_MOV64_IMM(BPF_REG_1, 5),
|
||||
BPF_MOV32_IMM(BPF_REG_2, 5 - 1),
|
||||
BPF_ALU64_REG(BPF_SUB, BPF_REG_2, BPF_REG_1),
|
||||
BPF_ALU64_REG(BPF_OR, BPF_REG_2, BPF_REG_1),
|
||||
BPF_ALU64_IMM(BPF_NEG, BPF_REG_2, 0),
|
||||
BPF_ALU64_IMM(BPF_ARSH, BPF_REG_2, 63),
|
||||
BPF_ALU64_REG(BPF_AND, BPF_REG_1, BPF_REG_2),
|
||||
BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.result = ACCEPT,
|
||||
.retval = 0,
|
||||
},
|
||||
{
|
||||
"masking, test out of bounds 8",
|
||||
.insns = {
|
||||
BPF_MOV64_IMM(BPF_REG_1, 1),
|
||||
BPF_MOV32_IMM(BPF_REG_2, 1 - 1),
|
||||
BPF_ALU64_REG(BPF_SUB, BPF_REG_2, BPF_REG_1),
|
||||
BPF_ALU64_REG(BPF_OR, BPF_REG_2, BPF_REG_1),
|
||||
BPF_ALU64_IMM(BPF_NEG, BPF_REG_2, 0),
|
||||
BPF_ALU64_IMM(BPF_ARSH, BPF_REG_2, 63),
|
||||
BPF_ALU64_REG(BPF_AND, BPF_REG_1, BPF_REG_2),
|
||||
BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.result = ACCEPT,
|
||||
.retval = 0,
|
||||
},
|
||||
{
|
||||
"masking, test out of bounds 9",
|
||||
.insns = {
|
||||
BPF_MOV64_IMM(BPF_REG_1, 0xffffffff),
|
||||
BPF_MOV32_IMM(BPF_REG_2, 0xffffffff - 1),
|
||||
BPF_ALU64_REG(BPF_SUB, BPF_REG_2, BPF_REG_1),
|
||||
BPF_ALU64_REG(BPF_OR, BPF_REG_2, BPF_REG_1),
|
||||
BPF_ALU64_IMM(BPF_NEG, BPF_REG_2, 0),
|
||||
BPF_ALU64_IMM(BPF_ARSH, BPF_REG_2, 63),
|
||||
BPF_ALU64_REG(BPF_AND, BPF_REG_1, BPF_REG_2),
|
||||
BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.result = ACCEPT,
|
||||
.retval = 0,
|
||||
},
|
||||
{
|
||||
"masking, test out of bounds 10",
|
||||
.insns = {
|
||||
BPF_MOV64_IMM(BPF_REG_1, 0xffffffff),
|
||||
BPF_MOV32_IMM(BPF_REG_2, 1 - 1),
|
||||
BPF_ALU64_REG(BPF_SUB, BPF_REG_2, BPF_REG_1),
|
||||
BPF_ALU64_REG(BPF_OR, BPF_REG_2, BPF_REG_1),
|
||||
BPF_ALU64_IMM(BPF_NEG, BPF_REG_2, 0),
|
||||
BPF_ALU64_IMM(BPF_ARSH, BPF_REG_2, 63),
|
||||
BPF_ALU64_REG(BPF_AND, BPF_REG_1, BPF_REG_2),
|
||||
BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.result = ACCEPT,
|
||||
.retval = 0,
|
||||
},
|
||||
{
|
||||
"masking, test out of bounds 11",
|
||||
.insns = {
|
||||
BPF_MOV64_IMM(BPF_REG_1, -1),
|
||||
BPF_MOV32_IMM(BPF_REG_2, 1 - 1),
|
||||
BPF_ALU64_REG(BPF_SUB, BPF_REG_2, BPF_REG_1),
|
||||
BPF_ALU64_REG(BPF_OR, BPF_REG_2, BPF_REG_1),
|
||||
BPF_ALU64_IMM(BPF_NEG, BPF_REG_2, 0),
|
||||
BPF_ALU64_IMM(BPF_ARSH, BPF_REG_2, 63),
|
||||
BPF_ALU64_REG(BPF_AND, BPF_REG_1, BPF_REG_2),
|
||||
BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.result = ACCEPT,
|
||||
.retval = 0,
|
||||
},
|
||||
{
|
||||
"masking, test out of bounds 12",
|
||||
.insns = {
|
||||
BPF_MOV64_IMM(BPF_REG_1, -1),
|
||||
BPF_MOV32_IMM(BPF_REG_2, 0xffffffff - 1),
|
||||
BPF_ALU64_REG(BPF_SUB, BPF_REG_2, BPF_REG_1),
|
||||
BPF_ALU64_REG(BPF_OR, BPF_REG_2, BPF_REG_1),
|
||||
BPF_ALU64_IMM(BPF_NEG, BPF_REG_2, 0),
|
||||
BPF_ALU64_IMM(BPF_ARSH, BPF_REG_2, 63),
|
||||
BPF_ALU64_REG(BPF_AND, BPF_REG_1, BPF_REG_2),
|
||||
BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.result = ACCEPT,
|
||||
.retval = 0,
|
||||
},
|
||||
{
|
||||
"masking, test in bounds 1",
|
||||
.insns = {
|
||||
BPF_MOV32_IMM(BPF_REG_1, 4),
|
||||
BPF_MOV32_IMM(BPF_REG_2, 5 - 1),
|
||||
BPF_ALU64_REG(BPF_SUB, BPF_REG_2, BPF_REG_1),
|
||||
BPF_ALU64_REG(BPF_OR, BPF_REG_2, BPF_REG_1),
|
||||
BPF_ALU64_IMM(BPF_NEG, BPF_REG_2, 0),
|
||||
BPF_ALU64_IMM(BPF_ARSH, BPF_REG_2, 63),
|
||||
BPF_ALU64_REG(BPF_AND, BPF_REG_1, BPF_REG_2),
|
||||
BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.result = ACCEPT,
|
||||
.retval = 4,
|
||||
},
|
||||
{
|
||||
"masking, test in bounds 2",
|
||||
.insns = {
|
||||
BPF_MOV32_IMM(BPF_REG_1, 0),
|
||||
BPF_MOV32_IMM(BPF_REG_2, 0xffffffff - 1),
|
||||
BPF_ALU64_REG(BPF_SUB, BPF_REG_2, BPF_REG_1),
|
||||
BPF_ALU64_REG(BPF_OR, BPF_REG_2, BPF_REG_1),
|
||||
BPF_ALU64_IMM(BPF_NEG, BPF_REG_2, 0),
|
||||
BPF_ALU64_IMM(BPF_ARSH, BPF_REG_2, 63),
|
||||
BPF_ALU64_REG(BPF_AND, BPF_REG_1, BPF_REG_2),
|
||||
BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.result = ACCEPT,
|
||||
.retval = 0,
|
||||
},
|
||||
{
|
||||
"masking, test in bounds 3",
|
||||
.insns = {
|
||||
BPF_MOV32_IMM(BPF_REG_1, 0xfffffffe),
|
||||
BPF_MOV32_IMM(BPF_REG_2, 0xffffffff - 1),
|
||||
BPF_ALU64_REG(BPF_SUB, BPF_REG_2, BPF_REG_1),
|
||||
BPF_ALU64_REG(BPF_OR, BPF_REG_2, BPF_REG_1),
|
||||
BPF_ALU64_IMM(BPF_NEG, BPF_REG_2, 0),
|
||||
BPF_ALU64_IMM(BPF_ARSH, BPF_REG_2, 63),
|
||||
BPF_ALU64_REG(BPF_AND, BPF_REG_1, BPF_REG_2),
|
||||
BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.result = ACCEPT,
|
||||
.retval = 0xfffffffe,
|
||||
},
|
||||
{
|
||||
"masking, test in bounds 4",
|
||||
.insns = {
|
||||
BPF_MOV32_IMM(BPF_REG_1, 0xabcde),
|
||||
BPF_MOV32_IMM(BPF_REG_2, 0xabcdef - 1),
|
||||
BPF_ALU64_REG(BPF_SUB, BPF_REG_2, BPF_REG_1),
|
||||
BPF_ALU64_REG(BPF_OR, BPF_REG_2, BPF_REG_1),
|
||||
BPF_ALU64_IMM(BPF_NEG, BPF_REG_2, 0),
|
||||
BPF_ALU64_IMM(BPF_ARSH, BPF_REG_2, 63),
|
||||
BPF_ALU64_REG(BPF_AND, BPF_REG_1, BPF_REG_2),
|
||||
BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.result = ACCEPT,
|
||||
.retval = 0xabcde,
|
||||
},
|
||||
{
|
||||
"masking, test in bounds 5",
|
||||
.insns = {
|
||||
BPF_MOV32_IMM(BPF_REG_1, 0),
|
||||
BPF_MOV32_IMM(BPF_REG_2, 1 - 1),
|
||||
BPF_ALU64_REG(BPF_SUB, BPF_REG_2, BPF_REG_1),
|
||||
BPF_ALU64_REG(BPF_OR, BPF_REG_2, BPF_REG_1),
|
||||
BPF_ALU64_IMM(BPF_NEG, BPF_REG_2, 0),
|
||||
BPF_ALU64_IMM(BPF_ARSH, BPF_REG_2, 63),
|
||||
BPF_ALU64_REG(BPF_AND, BPF_REG_1, BPF_REG_2),
|
||||
BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.result = ACCEPT,
|
||||
.retval = 0,
|
||||
},
|
||||
{
|
||||
"masking, test in bounds 6",
|
||||
.insns = {
|
||||
BPF_MOV32_IMM(BPF_REG_1, 46),
|
||||
BPF_MOV32_IMM(BPF_REG_2, 47 - 1),
|
||||
BPF_ALU64_REG(BPF_SUB, BPF_REG_2, BPF_REG_1),
|
||||
BPF_ALU64_REG(BPF_OR, BPF_REG_2, BPF_REG_1),
|
||||
BPF_ALU64_IMM(BPF_NEG, BPF_REG_2, 0),
|
||||
BPF_ALU64_IMM(BPF_ARSH, BPF_REG_2, 63),
|
||||
BPF_ALU64_REG(BPF_AND, BPF_REG_1, BPF_REG_2),
|
||||
BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.result = ACCEPT,
|
||||
.retval = 46,
|
||||
},
|
||||
{
|
||||
"masking, test in bounds 7",
|
||||
.insns = {
|
||||
BPF_MOV64_IMM(BPF_REG_3, -46),
|
||||
BPF_ALU64_IMM(BPF_MUL, BPF_REG_3, -1),
|
||||
BPF_MOV32_IMM(BPF_REG_2, 47 - 1),
|
||||
BPF_ALU64_REG(BPF_SUB, BPF_REG_2, BPF_REG_3),
|
||||
BPF_ALU64_REG(BPF_OR, BPF_REG_2, BPF_REG_3),
|
||||
BPF_ALU64_IMM(BPF_NEG, BPF_REG_2, 0),
|
||||
BPF_ALU64_IMM(BPF_ARSH, BPF_REG_2, 63),
|
||||
BPF_ALU64_REG(BPF_AND, BPF_REG_3, BPF_REG_2),
|
||||
BPF_MOV64_REG(BPF_REG_0, BPF_REG_3),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.result = ACCEPT,
|
||||
.retval = 46,
|
||||
},
|
||||
{
|
||||
"masking, test in bounds 8",
|
||||
.insns = {
|
||||
BPF_MOV64_IMM(BPF_REG_3, -47),
|
||||
BPF_ALU64_IMM(BPF_MUL, BPF_REG_3, -1),
|
||||
BPF_MOV32_IMM(BPF_REG_2, 47 - 1),
|
||||
BPF_ALU64_REG(BPF_SUB, BPF_REG_2, BPF_REG_3),
|
||||
BPF_ALU64_REG(BPF_OR, BPF_REG_2, BPF_REG_3),
|
||||
BPF_ALU64_IMM(BPF_NEG, BPF_REG_2, 0),
|
||||
BPF_ALU64_IMM(BPF_ARSH, BPF_REG_2, 63),
|
||||
BPF_ALU64_REG(BPF_AND, BPF_REG_3, BPF_REG_2),
|
||||
BPF_MOV64_REG(BPF_REG_0, BPF_REG_3),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.result = ACCEPT,
|
||||
.retval = 0,
|
||||
},
|
||||
235
tools/testing/selftests/bpf/verifier/meta_access.c
Normal file
235
tools/testing/selftests/bpf/verifier/meta_access.c
Normal file
@ -0,0 +1,235 @@
|
||||
{
|
||||
"meta access, test1",
|
||||
.insns = {
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
|
||||
offsetof(struct xdp_md, data_meta)),
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
|
||||
BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
|
||||
BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
|
||||
BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
|
||||
BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
|
||||
BPF_MOV64_IMM(BPF_REG_0, 0),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.result = ACCEPT,
|
||||
.prog_type = BPF_PROG_TYPE_XDP,
|
||||
},
|
||||
{
|
||||
"meta access, test2",
|
||||
.insns = {
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
|
||||
offsetof(struct xdp_md, data_meta)),
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
|
||||
BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
|
||||
BPF_ALU64_IMM(BPF_SUB, BPF_REG_0, 8),
|
||||
BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
|
||||
BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 8),
|
||||
BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 1),
|
||||
BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
|
||||
BPF_MOV64_IMM(BPF_REG_0, 0),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.result = REJECT,
|
||||
.errstr = "invalid access to packet, off=-8",
|
||||
.prog_type = BPF_PROG_TYPE_XDP,
|
||||
},
|
||||
{
|
||||
"meta access, test3",
|
||||
.insns = {
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
|
||||
offsetof(struct xdp_md, data_meta)),
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
|
||||
offsetof(struct xdp_md, data_end)),
|
||||
BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
|
||||
BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
|
||||
BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
|
||||
BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
|
||||
BPF_MOV64_IMM(BPF_REG_0, 0),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.result = REJECT,
|
||||
.errstr = "invalid access to packet",
|
||||
.prog_type = BPF_PROG_TYPE_XDP,
|
||||
},
|
||||
{
|
||||
"meta access, test4",
|
||||
.insns = {
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
|
||||
offsetof(struct xdp_md, data_meta)),
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
|
||||
offsetof(struct xdp_md, data_end)),
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_4, BPF_REG_1, offsetof(struct xdp_md, data)),
|
||||
BPF_MOV64_REG(BPF_REG_0, BPF_REG_4),
|
||||
BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
|
||||
BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
|
||||
BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
|
||||
BPF_MOV64_IMM(BPF_REG_0, 0),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.result = REJECT,
|
||||
.errstr = "invalid access to packet",
|
||||
.prog_type = BPF_PROG_TYPE_XDP,
|
||||
},
|
||||
{
|
||||
"meta access, test5",
|
||||
.insns = {
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
|
||||
offsetof(struct xdp_md, data_meta)),
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_4, BPF_REG_1, offsetof(struct xdp_md, data)),
|
||||
BPF_MOV64_REG(BPF_REG_0, BPF_REG_3),
|
||||
BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
|
||||
BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_4, 3),
|
||||
BPF_MOV64_IMM(BPF_REG_2, -8),
|
||||
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_xdp_adjust_meta),
|
||||
BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_3, 0),
|
||||
BPF_MOV64_IMM(BPF_REG_0, 0),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.result = REJECT,
|
||||
.errstr = "R3 !read_ok",
|
||||
.prog_type = BPF_PROG_TYPE_XDP,
|
||||
},
|
||||
{
|
||||
"meta access, test6",
|
||||
.insns = {
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
|
||||
offsetof(struct xdp_md, data_meta)),
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
|
||||
BPF_MOV64_REG(BPF_REG_0, BPF_REG_3),
|
||||
BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
|
||||
BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
|
||||
BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 8),
|
||||
BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_0, 1),
|
||||
BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
|
||||
BPF_MOV64_IMM(BPF_REG_0, 0),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.result = REJECT,
|
||||
.errstr = "invalid access to packet",
|
||||
.prog_type = BPF_PROG_TYPE_XDP,
|
||||
},
|
||||
{
|
||||
"meta access, test7",
|
||||
.insns = {
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
|
||||
offsetof(struct xdp_md, data_meta)),
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
|
||||
BPF_MOV64_REG(BPF_REG_0, BPF_REG_3),
|
||||
BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
|
||||
BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
|
||||
BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 8),
|
||||
BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 1),
|
||||
BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
|
||||
BPF_MOV64_IMM(BPF_REG_0, 0),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.result = ACCEPT,
|
||||
.prog_type = BPF_PROG_TYPE_XDP,
|
||||
},
|
||||
{
|
||||
"meta access, test8",
|
||||
.insns = {
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
|
||||
offsetof(struct xdp_md, data_meta)),
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
|
||||
BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
|
||||
BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 0xFFFF),
|
||||
BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 1),
|
||||
BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
|
||||
BPF_MOV64_IMM(BPF_REG_0, 0),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.result = ACCEPT,
|
||||
.prog_type = BPF_PROG_TYPE_XDP,
|
||||
},
|
||||
{
|
||||
"meta access, test9",
|
||||
.insns = {
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
|
||||
offsetof(struct xdp_md, data_meta)),
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
|
||||
BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
|
||||
BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 0xFFFF),
|
||||
BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 1),
|
||||
BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 1),
|
||||
BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
|
||||
BPF_MOV64_IMM(BPF_REG_0, 0),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.result = REJECT,
|
||||
.errstr = "invalid access to packet",
|
||||
.prog_type = BPF_PROG_TYPE_XDP,
|
||||
},
|
||||
{
|
||||
"meta access, test10",
|
||||
.insns = {
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
|
||||
offsetof(struct xdp_md, data_meta)),
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_4, BPF_REG_1,
|
||||
offsetof(struct xdp_md, data_end)),
|
||||
BPF_MOV64_IMM(BPF_REG_5, 42),
|
||||
BPF_MOV64_IMM(BPF_REG_6, 24),
|
||||
BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_5, -8),
|
||||
BPF_STX_XADD(BPF_DW, BPF_REG_10, BPF_REG_6, -8),
|
||||
BPF_LDX_MEM(BPF_DW, BPF_REG_5, BPF_REG_10, -8),
|
||||
BPF_JMP_IMM(BPF_JGT, BPF_REG_5, 100, 6),
|
||||
BPF_ALU64_REG(BPF_ADD, BPF_REG_3, BPF_REG_5),
|
||||
BPF_MOV64_REG(BPF_REG_5, BPF_REG_3),
|
||||
BPF_MOV64_REG(BPF_REG_6, BPF_REG_2),
|
||||
BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 8),
|
||||
BPF_JMP_REG(BPF_JGT, BPF_REG_6, BPF_REG_5, 1),
|
||||
BPF_LDX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
|
||||
BPF_MOV64_IMM(BPF_REG_0, 0),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.result = REJECT,
|
||||
.errstr = "invalid access to packet",
|
||||
.prog_type = BPF_PROG_TYPE_XDP,
|
||||
},
|
||||
{
|
||||
"meta access, test11",
|
||||
.insns = {
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
|
||||
offsetof(struct xdp_md, data_meta)),
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
|
||||
BPF_MOV64_IMM(BPF_REG_5, 42),
|
||||
BPF_MOV64_IMM(BPF_REG_6, 24),
|
||||
BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_5, -8),
|
||||
BPF_STX_XADD(BPF_DW, BPF_REG_10, BPF_REG_6, -8),
|
||||
BPF_LDX_MEM(BPF_DW, BPF_REG_5, BPF_REG_10, -8),
|
||||
BPF_JMP_IMM(BPF_JGT, BPF_REG_5, 100, 6),
|
||||
BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_5),
|
||||
BPF_MOV64_REG(BPF_REG_5, BPF_REG_2),
|
||||
BPF_MOV64_REG(BPF_REG_6, BPF_REG_2),
|
||||
BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 8),
|
||||
BPF_JMP_REG(BPF_JGT, BPF_REG_6, BPF_REG_3, 1),
|
||||
BPF_LDX_MEM(BPF_B, BPF_REG_5, BPF_REG_5, 0),
|
||||
BPF_MOV64_IMM(BPF_REG_0, 0),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.result = ACCEPT,
|
||||
.prog_type = BPF_PROG_TYPE_XDP,
|
||||
},
|
||||
{
|
||||
"meta access, test12",
|
||||
.insns = {
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
|
||||
offsetof(struct xdp_md, data_meta)),
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_4, BPF_REG_1,
|
||||
offsetof(struct xdp_md, data_end)),
|
||||
BPF_MOV64_REG(BPF_REG_5, BPF_REG_3),
|
||||
BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, 16),
|
||||
BPF_JMP_REG(BPF_JGT, BPF_REG_5, BPF_REG_4, 5),
|
||||
BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_3, 0),
|
||||
BPF_MOV64_REG(BPF_REG_5, BPF_REG_2),
|
||||
BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, 16),
|
||||
BPF_JMP_REG(BPF_JGT, BPF_REG_5, BPF_REG_3, 1),
|
||||
BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
|
||||
BPF_MOV64_IMM(BPF_REG_0, 0),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.result = ACCEPT,
|
||||
.prog_type = BPF_PROG_TYPE_XDP,
|
||||
},
|
||||
607
tools/testing/selftests/bpf/verifier/ref_tracking.c
Normal file
607
tools/testing/selftests/bpf/verifier/ref_tracking.c
Normal file
@ -0,0 +1,607 @@
|
||||
{
|
||||
"reference tracking: leak potential reference",
|
||||
.insns = {
|
||||
BPF_SK_LOOKUP,
|
||||
BPF_MOV64_REG(BPF_REG_6, BPF_REG_0), /* leak reference */
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
||||
.errstr = "Unreleased reference",
|
||||
.result = REJECT,
|
||||
},
|
||||
{
|
||||
"reference tracking: leak potential reference on stack",
|
||||
.insns = {
|
||||
BPF_SK_LOOKUP,
|
||||
BPF_MOV64_REG(BPF_REG_4, BPF_REG_10),
|
||||
BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -8),
|
||||
BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_0, 0),
|
||||
BPF_MOV64_IMM(BPF_REG_0, 0),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
||||
.errstr = "Unreleased reference",
|
||||
.result = REJECT,
|
||||
},
|
||||
{
|
||||
"reference tracking: leak potential reference on stack 2",
|
||||
.insns = {
|
||||
BPF_SK_LOOKUP,
|
||||
BPF_MOV64_REG(BPF_REG_4, BPF_REG_10),
|
||||
BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -8),
|
||||
BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_0, 0),
|
||||
BPF_MOV64_IMM(BPF_REG_0, 0),
|
||||
BPF_ST_MEM(BPF_DW, BPF_REG_4, 0, 0),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
||||
.errstr = "Unreleased reference",
|
||||
.result = REJECT,
|
||||
},
|
||||
{
|
||||
"reference tracking: zero potential reference",
|
||||
.insns = {
|
||||
BPF_SK_LOOKUP,
|
||||
BPF_MOV64_IMM(BPF_REG_0, 0), /* leak reference */
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
||||
.errstr = "Unreleased reference",
|
||||
.result = REJECT,
|
||||
},
|
||||
{
|
||||
"reference tracking: copy and zero potential references",
|
||||
.insns = {
|
||||
BPF_SK_LOOKUP,
|
||||
BPF_MOV64_REG(BPF_REG_7, BPF_REG_0),
|
||||
BPF_MOV64_IMM(BPF_REG_0, 0),
|
||||
BPF_MOV64_IMM(BPF_REG_7, 0), /* leak reference */
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
||||
.errstr = "Unreleased reference",
|
||||
.result = REJECT,
|
||||
},
|
||||
{
|
||||
"reference tracking: release reference without check",
|
||||
.insns = {
|
||||
BPF_SK_LOOKUP,
|
||||
/* reference in r0 may be NULL */
|
||||
BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
|
||||
BPF_MOV64_IMM(BPF_REG_2, 0),
|
||||
BPF_EMIT_CALL(BPF_FUNC_sk_release),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
||||
.errstr = "type=sock_or_null expected=sock",
|
||||
.result = REJECT,
|
||||
},
|
||||
{
|
||||
"reference tracking: release reference",
|
||||
.insns = {
|
||||
BPF_SK_LOOKUP,
|
||||
BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
|
||||
BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
|
||||
BPF_EMIT_CALL(BPF_FUNC_sk_release),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
||||
.result = ACCEPT,
|
||||
},
|
||||
{
|
||||
"reference tracking: release reference 2",
|
||||
.insns = {
|
||||
BPF_SK_LOOKUP,
|
||||
BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
|
||||
BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
|
||||
BPF_EXIT_INSN(),
|
||||
BPF_EMIT_CALL(BPF_FUNC_sk_release),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
||||
.result = ACCEPT,
|
||||
},
|
||||
{
|
||||
"reference tracking: release reference twice",
|
||||
.insns = {
|
||||
BPF_SK_LOOKUP,
|
||||
BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
|
||||
BPF_MOV64_REG(BPF_REG_6, BPF_REG_0),
|
||||
BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
|
||||
BPF_EMIT_CALL(BPF_FUNC_sk_release),
|
||||
BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
|
||||
BPF_EMIT_CALL(BPF_FUNC_sk_release),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
||||
.errstr = "type=inv expected=sock",
|
||||
.result = REJECT,
|
||||
},
|
||||
{
|
||||
"reference tracking: release reference twice inside branch",
|
||||
.insns = {
|
||||
BPF_SK_LOOKUP,
|
||||
BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
|
||||
BPF_MOV64_REG(BPF_REG_6, BPF_REG_0),
|
||||
BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3), /* goto end */
|
||||
BPF_EMIT_CALL(BPF_FUNC_sk_release),
|
||||
BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
|
||||
BPF_EMIT_CALL(BPF_FUNC_sk_release),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
||||
.errstr = "type=inv expected=sock",
|
||||
.result = REJECT,
|
||||
},
|
||||
{
|
||||
"reference tracking: alloc, check, free in one subbranch",
|
||||
.insns = {
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
|
||||
offsetof(struct __sk_buff, data)),
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
|
||||
offsetof(struct __sk_buff, data_end)),
|
||||
BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
|
||||
BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 16),
|
||||
/* if (offsetof(skb, mark) > data_len) exit; */
|
||||
BPF_JMP_REG(BPF_JLE, BPF_REG_0, BPF_REG_3, 1),
|
||||
BPF_EXIT_INSN(),
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_2,
|
||||
offsetof(struct __sk_buff, mark)),
|
||||
BPF_SK_LOOKUP,
|
||||
BPF_JMP_IMM(BPF_JEQ, BPF_REG_6, 0, 1), /* mark == 0? */
|
||||
/* Leak reference in R0 */
|
||||
BPF_EXIT_INSN(),
|
||||
BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2), /* sk NULL? */
|
||||
BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
|
||||
BPF_EMIT_CALL(BPF_FUNC_sk_release),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
||||
.errstr = "Unreleased reference",
|
||||
.result = REJECT,
|
||||
.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
|
||||
},
|
||||
{
|
||||
"reference tracking: alloc, check, free in both subbranches",
|
||||
.insns = {
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
|
||||
offsetof(struct __sk_buff, data)),
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
|
||||
offsetof(struct __sk_buff, data_end)),
|
||||
BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
|
||||
BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 16),
|
||||
/* if (offsetof(skb, mark) > data_len) exit; */
|
||||
BPF_JMP_REG(BPF_JLE, BPF_REG_0, BPF_REG_3, 1),
|
||||
BPF_EXIT_INSN(),
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_2,
|
||||
offsetof(struct __sk_buff, mark)),
|
||||
BPF_SK_LOOKUP,
|
||||
BPF_JMP_IMM(BPF_JEQ, BPF_REG_6, 0, 4), /* mark == 0? */
|
||||
BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2), /* sk NULL? */
|
||||
BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
|
||||
BPF_EMIT_CALL(BPF_FUNC_sk_release),
|
||||
BPF_EXIT_INSN(),
|
||||
BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2), /* sk NULL? */
|
||||
BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
|
||||
BPF_EMIT_CALL(BPF_FUNC_sk_release),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
||||
.result = ACCEPT,
|
||||
.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
|
||||
},
|
||||
{
|
||||
"reference tracking in call: free reference in subprog",
|
||||
.insns = {
|
||||
BPF_SK_LOOKUP,
|
||||
BPF_MOV64_REG(BPF_REG_1, BPF_REG_0), /* unchecked reference */
|
||||
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
|
||||
BPF_MOV64_IMM(BPF_REG_0, 0),
|
||||
BPF_EXIT_INSN(),
|
||||
|
||||
/* subprog 1 */
|
||||
BPF_MOV64_REG(BPF_REG_2, BPF_REG_1),
|
||||
BPF_JMP_IMM(BPF_JEQ, BPF_REG_2, 0, 1),
|
||||
BPF_EMIT_CALL(BPF_FUNC_sk_release),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
||||
.result = ACCEPT,
|
||||
},
|
||||
{
|
||||
"reference tracking in call: free reference in subprog and outside",
|
||||
.insns = {
|
||||
BPF_SK_LOOKUP,
|
||||
BPF_MOV64_REG(BPF_REG_1, BPF_REG_0), /* unchecked reference */
|
||||
BPF_MOV64_REG(BPF_REG_6, BPF_REG_0),
|
||||
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
|
||||
BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
|
||||
BPF_EMIT_CALL(BPF_FUNC_sk_release),
|
||||
BPF_EXIT_INSN(),
|
||||
|
||||
/* subprog 1 */
|
||||
BPF_MOV64_REG(BPF_REG_2, BPF_REG_1),
|
||||
BPF_JMP_IMM(BPF_JEQ, BPF_REG_2, 0, 1),
|
||||
BPF_EMIT_CALL(BPF_FUNC_sk_release),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
||||
.errstr = "type=inv expected=sock",
|
||||
.result = REJECT,
|
||||
},
|
||||
{
|
||||
"reference tracking in call: alloc & leak reference in subprog",
|
||||
.insns = {
|
||||
BPF_MOV64_REG(BPF_REG_4, BPF_REG_10),
|
||||
BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -8),
|
||||
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
|
||||
BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
|
||||
BPF_MOV64_IMM(BPF_REG_0, 0),
|
||||
BPF_EXIT_INSN(),
|
||||
|
||||
/* subprog 1 */
|
||||
BPF_MOV64_REG(BPF_REG_6, BPF_REG_4),
|
||||
BPF_SK_LOOKUP,
|
||||
/* spill unchecked sk_ptr into stack of caller */
|
||||
BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_0, 0),
|
||||
BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
||||
.errstr = "Unreleased reference",
|
||||
.result = REJECT,
|
||||
},
|
||||
{
|
||||
"reference tracking in call: alloc in subprog, release outside",
|
||||
.insns = {
|
||||
BPF_MOV64_REG(BPF_REG_4, BPF_REG_10),
|
||||
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 4),
|
||||
BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
|
||||
BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
|
||||
BPF_EMIT_CALL(BPF_FUNC_sk_release),
|
||||
BPF_EXIT_INSN(),
|
||||
|
||||
/* subprog 1 */
|
||||
BPF_SK_LOOKUP,
|
||||
BPF_EXIT_INSN(), /* return sk */
|
||||
},
|
||||
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
||||
.retval = POINTER_VALUE,
|
||||
.result = ACCEPT,
|
||||
},
|
||||
{
|
||||
"reference tracking in call: sk_ptr leak into caller stack",
|
||||
.insns = {
|
||||
BPF_MOV64_REG(BPF_REG_4, BPF_REG_10),
|
||||
BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -8),
|
||||
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
|
||||
BPF_MOV64_IMM(BPF_REG_0, 0),
|
||||
BPF_EXIT_INSN(),
|
||||
|
||||
/* subprog 1 */
|
||||
BPF_MOV64_REG(BPF_REG_5, BPF_REG_10),
|
||||
BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, -8),
|
||||
BPF_STX_MEM(BPF_DW, BPF_REG_5, BPF_REG_4, 0),
|
||||
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 5),
|
||||
/* spill unchecked sk_ptr into stack of caller */
|
||||
BPF_MOV64_REG(BPF_REG_5, BPF_REG_10),
|
||||
BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, -8),
|
||||
BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_5, 0),
|
||||
BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_0, 0),
|
||||
BPF_EXIT_INSN(),
|
||||
|
||||
/* subprog 2 */
|
||||
BPF_SK_LOOKUP,
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
||||
.errstr = "Unreleased reference",
|
||||
.result = REJECT,
|
||||
},
|
||||
{
|
||||
"reference tracking in call: sk_ptr spill into caller stack",
|
||||
.insns = {
|
||||
BPF_MOV64_REG(BPF_REG_4, BPF_REG_10),
|
||||
BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -8),
|
||||
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
|
||||
BPF_MOV64_IMM(BPF_REG_0, 0),
|
||||
BPF_EXIT_INSN(),
|
||||
|
||||
/* subprog 1 */
|
||||
BPF_MOV64_REG(BPF_REG_5, BPF_REG_10),
|
||||
BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, -8),
|
||||
BPF_STX_MEM(BPF_DW, BPF_REG_5, BPF_REG_4, 0),
|
||||
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 8),
|
||||
/* spill unchecked sk_ptr into stack of caller */
|
||||
BPF_MOV64_REG(BPF_REG_5, BPF_REG_10),
|
||||
BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, -8),
|
||||
BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_5, 0),
|
||||
BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_0, 0),
|
||||
BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
|
||||
/* now the sk_ptr is verified, free the reference */
|
||||
BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_4, 0),
|
||||
BPF_EMIT_CALL(BPF_FUNC_sk_release),
|
||||
BPF_EXIT_INSN(),
|
||||
|
||||
/* subprog 2 */
|
||||
BPF_SK_LOOKUP,
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
||||
.result = ACCEPT,
|
||||
},
|
||||
{
|
||||
"reference tracking: allow LD_ABS",
|
||||
.insns = {
|
||||
BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
|
||||
BPF_SK_LOOKUP,
|
||||
BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
|
||||
BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
|
||||
BPF_EMIT_CALL(BPF_FUNC_sk_release),
|
||||
BPF_LD_ABS(BPF_B, 0),
|
||||
BPF_LD_ABS(BPF_H, 0),
|
||||
BPF_LD_ABS(BPF_W, 0),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
||||
.result = ACCEPT,
|
||||
},
|
||||
{
|
||||
"reference tracking: forbid LD_ABS while holding reference",
|
||||
.insns = {
|
||||
BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
|
||||
BPF_SK_LOOKUP,
|
||||
BPF_LD_ABS(BPF_B, 0),
|
||||
BPF_LD_ABS(BPF_H, 0),
|
||||
BPF_LD_ABS(BPF_W, 0),
|
||||
BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
|
||||
BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
|
||||
BPF_EMIT_CALL(BPF_FUNC_sk_release),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
||||
.errstr = "BPF_LD_[ABS|IND] cannot be mixed with socket references",
|
||||
.result = REJECT,
|
||||
},
|
||||
{
|
||||
"reference tracking: allow LD_IND",
|
||||
.insns = {
|
||||
BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
|
||||
BPF_SK_LOOKUP,
|
||||
BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
|
||||
BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
|
||||
BPF_EMIT_CALL(BPF_FUNC_sk_release),
|
||||
BPF_MOV64_IMM(BPF_REG_7, 1),
|
||||
BPF_LD_IND(BPF_W, BPF_REG_7, -0x200000),
|
||||
BPF_MOV64_REG(BPF_REG_0, BPF_REG_7),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
||||
.result = ACCEPT,
|
||||
.retval = 1,
|
||||
},
|
||||
{
|
||||
"reference tracking: forbid LD_IND while holding reference",
|
||||
.insns = {
|
||||
BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
|
||||
BPF_SK_LOOKUP,
|
||||
BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
|
||||
BPF_MOV64_IMM(BPF_REG_7, 1),
|
||||
BPF_LD_IND(BPF_W, BPF_REG_7, -0x200000),
|
||||
BPF_MOV64_REG(BPF_REG_0, BPF_REG_7),
|
||||
BPF_MOV64_REG(BPF_REG_1, BPF_REG_4),
|
||||
BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 1),
|
||||
BPF_EMIT_CALL(BPF_FUNC_sk_release),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
||||
.errstr = "BPF_LD_[ABS|IND] cannot be mixed with socket references",
|
||||
.result = REJECT,
|
||||
},
|
||||
{
|
||||
"reference tracking: check reference or tail call",
|
||||
.insns = {
|
||||
BPF_MOV64_REG(BPF_REG_7, BPF_REG_1),
|
||||
BPF_SK_LOOKUP,
|
||||
/* if (sk) bpf_sk_release() */
|
||||
BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
|
||||
BPF_JMP_IMM(BPF_JNE, BPF_REG_1, 0, 7),
|
||||
/* bpf_tail_call() */
|
||||
BPF_MOV64_IMM(BPF_REG_3, 2),
|
||||
BPF_LD_MAP_FD(BPF_REG_2, 0),
|
||||
BPF_MOV64_REG(BPF_REG_1, BPF_REG_7),
|
||||
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_tail_call),
|
||||
BPF_MOV64_IMM(BPF_REG_0, 0),
|
||||
BPF_EXIT_INSN(),
|
||||
BPF_EMIT_CALL(BPF_FUNC_sk_release),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.fixup_prog1 = { 17 },
|
||||
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
||||
.result = ACCEPT,
|
||||
},
|
||||
{
|
||||
"reference tracking: release reference then tail call",
|
||||
.insns = {
|
||||
BPF_MOV64_REG(BPF_REG_7, BPF_REG_1),
|
||||
BPF_SK_LOOKUP,
|
||||
/* if (sk) bpf_sk_release() */
|
||||
BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
|
||||
BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 1),
|
||||
BPF_EMIT_CALL(BPF_FUNC_sk_release),
|
||||
/* bpf_tail_call() */
|
||||
BPF_MOV64_IMM(BPF_REG_3, 2),
|
||||
BPF_LD_MAP_FD(BPF_REG_2, 0),
|
||||
BPF_MOV64_REG(BPF_REG_1, BPF_REG_7),
|
||||
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_tail_call),
|
||||
BPF_MOV64_IMM(BPF_REG_0, 0),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.fixup_prog1 = { 18 },
|
||||
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
||||
.result = ACCEPT,
|
||||
},
|
||||
{
|
||||
"reference tracking: leak possible reference over tail call",
|
||||
.insns = {
|
||||
BPF_MOV64_REG(BPF_REG_7, BPF_REG_1),
|
||||
/* Look up socket and store in REG_6 */
|
||||
BPF_SK_LOOKUP,
|
||||
/* bpf_tail_call() */
|
||||
BPF_MOV64_REG(BPF_REG_6, BPF_REG_0),
|
||||
BPF_MOV64_IMM(BPF_REG_3, 2),
|
||||
BPF_LD_MAP_FD(BPF_REG_2, 0),
|
||||
BPF_MOV64_REG(BPF_REG_1, BPF_REG_7),
|
||||
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_tail_call),
|
||||
BPF_MOV64_IMM(BPF_REG_0, 0),
|
||||
/* if (sk) bpf_sk_release() */
|
||||
BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
|
||||
BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 1),
|
||||
BPF_EMIT_CALL(BPF_FUNC_sk_release),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.fixup_prog1 = { 16 },
|
||||
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
||||
.errstr = "tail_call would lead to reference leak",
|
||||
.result = REJECT,
|
||||
},
|
||||
{
|
||||
"reference tracking: leak checked reference over tail call",
|
||||
.insns = {
|
||||
BPF_MOV64_REG(BPF_REG_7, BPF_REG_1),
|
||||
/* Look up socket and store in REG_6 */
|
||||
BPF_SK_LOOKUP,
|
||||
BPF_MOV64_REG(BPF_REG_6, BPF_REG_0),
|
||||
/* if (!sk) goto end */
|
||||
BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
|
||||
/* bpf_tail_call() */
|
||||
BPF_MOV64_IMM(BPF_REG_3, 0),
|
||||
BPF_LD_MAP_FD(BPF_REG_2, 0),
|
||||
BPF_MOV64_REG(BPF_REG_1, BPF_REG_7),
|
||||
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_tail_call),
|
||||
BPF_MOV64_IMM(BPF_REG_0, 0),
|
||||
BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
|
||||
BPF_EMIT_CALL(BPF_FUNC_sk_release),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.fixup_prog1 = { 17 },
|
||||
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
||||
.errstr = "tail_call would lead to reference leak",
|
||||
.result = REJECT,
|
||||
},
|
||||
{
|
||||
"reference tracking: mangle and release sock_or_null",
|
||||
.insns = {
|
||||
BPF_SK_LOOKUP,
|
||||
BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
|
||||
BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 5),
|
||||
BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
|
||||
BPF_EMIT_CALL(BPF_FUNC_sk_release),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
||||
.errstr = "R1 pointer arithmetic on sock_or_null prohibited",
|
||||
.result = REJECT,
|
||||
},
|
||||
{
|
||||
"reference tracking: mangle and release sock",
|
||||
.insns = {
|
||||
BPF_SK_LOOKUP,
|
||||
BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
|
||||
BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
|
||||
BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 5),
|
||||
BPF_EMIT_CALL(BPF_FUNC_sk_release),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
||||
.errstr = "R1 pointer arithmetic on sock prohibited",
|
||||
.result = REJECT,
|
||||
},
|
||||
{
|
||||
"reference tracking: access member",
|
||||
.insns = {
|
||||
BPF_SK_LOOKUP,
|
||||
BPF_MOV64_REG(BPF_REG_6, BPF_REG_0),
|
||||
BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3),
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_0, 4),
|
||||
BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
|
||||
BPF_EMIT_CALL(BPF_FUNC_sk_release),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
||||
.result = ACCEPT,
|
||||
},
|
||||
{
|
||||
"reference tracking: write to member",
|
||||
.insns = {
|
||||
BPF_SK_LOOKUP,
|
||||
BPF_MOV64_REG(BPF_REG_6, BPF_REG_0),
|
||||
BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
|
||||
BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
|
||||
BPF_LD_IMM64(BPF_REG_2, 42),
|
||||
BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_2,
|
||||
offsetof(struct bpf_sock, mark)),
|
||||
BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
|
||||
BPF_EMIT_CALL(BPF_FUNC_sk_release),
|
||||
BPF_LD_IMM64(BPF_REG_0, 0),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
||||
.errstr = "cannot write into socket",
|
||||
.result = REJECT,
|
||||
},
|
||||
{
|
||||
"reference tracking: invalid 64-bit access of member",
|
||||
.insns = {
|
||||
BPF_SK_LOOKUP,
|
||||
BPF_MOV64_REG(BPF_REG_6, BPF_REG_0),
|
||||
BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3),
|
||||
BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_0, 0),
|
||||
BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
|
||||
BPF_EMIT_CALL(BPF_FUNC_sk_release),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
||||
.errstr = "invalid bpf_sock access off=0 size=8",
|
||||
.result = REJECT,
|
||||
},
|
||||
{
|
||||
"reference tracking: access after release",
|
||||
.insns = {
|
||||
BPF_SK_LOOKUP,
|
||||
BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
|
||||
BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
|
||||
BPF_EMIT_CALL(BPF_FUNC_sk_release),
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 0),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
||||
.errstr = "!read_ok",
|
||||
.result = REJECT,
|
||||
},
|
||||
{
|
||||
"reference tracking: direct access for lookup",
|
||||
.insns = {
|
||||
/* Check that the packet is at least 64B long */
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
|
||||
offsetof(struct __sk_buff, data)),
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
|
||||
offsetof(struct __sk_buff, data_end)),
|
||||
BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
|
||||
BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 64),
|
||||
BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 9),
|
||||
/* sk = sk_lookup_tcp(ctx, skb->data, ...) */
|
||||
BPF_MOV64_IMM(BPF_REG_3, sizeof(struct bpf_sock_tuple)),
|
||||
BPF_MOV64_IMM(BPF_REG_4, 0),
|
||||
BPF_MOV64_IMM(BPF_REG_5, 0),
|
||||
BPF_EMIT_CALL(BPF_FUNC_sk_lookup_tcp),
|
||||
BPF_MOV64_REG(BPF_REG_6, BPF_REG_0),
|
||||
BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3),
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_0, 4),
|
||||
BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
|
||||
BPF_EMIT_CALL(BPF_FUNC_sk_release),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
||||
.result = ACCEPT,
|
||||
},
|
||||
@ -81,3 +81,76 @@
|
||||
.result = REJECT,
|
||||
.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
|
||||
},
|
||||
{
|
||||
"search pruning: all branches should be verified (nop operation)",
|
||||
.insns = {
|
||||
BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
|
||||
BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
|
||||
BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
|
||||
BPF_LD_MAP_FD(BPF_REG_1, 0),
|
||||
BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
|
||||
BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 11),
|
||||
BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_0, 0),
|
||||
BPF_JMP_IMM(BPF_JEQ, BPF_REG_3, 0xbeef, 2),
|
||||
BPF_MOV64_IMM(BPF_REG_4, 0),
|
||||
BPF_JMP_A(1),
|
||||
BPF_MOV64_IMM(BPF_REG_4, 1),
|
||||
BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_4, -16),
|
||||
BPF_EMIT_CALL(BPF_FUNC_ktime_get_ns),
|
||||
BPF_LDX_MEM(BPF_DW, BPF_REG_5, BPF_REG_10, -16),
|
||||
BPF_JMP_IMM(BPF_JEQ, BPF_REG_5, 0, 2),
|
||||
BPF_MOV64_IMM(BPF_REG_6, 0),
|
||||
BPF_ST_MEM(BPF_DW, BPF_REG_6, 0, 0xdead),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.fixup_map_hash_8b = { 3 },
|
||||
.errstr = "R6 invalid mem access 'inv'",
|
||||
.result = REJECT,
|
||||
.prog_type = BPF_PROG_TYPE_TRACEPOINT,
|
||||
},
|
||||
{
|
||||
"search pruning: all branches should be verified (invalid stack access)",
|
||||
.insns = {
|
||||
BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
|
||||
BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
|
||||
BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
|
||||
BPF_LD_MAP_FD(BPF_REG_1, 0),
|
||||
BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
|
||||
BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 8),
|
||||
BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_0, 0),
|
||||
BPF_MOV64_IMM(BPF_REG_4, 0),
|
||||
BPF_JMP_IMM(BPF_JEQ, BPF_REG_3, 0xbeef, 2),
|
||||
BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_4, -16),
|
||||
BPF_JMP_A(1),
|
||||
BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_4, -24),
|
||||
BPF_EMIT_CALL(BPF_FUNC_ktime_get_ns),
|
||||
BPF_LDX_MEM(BPF_DW, BPF_REG_5, BPF_REG_10, -16),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.fixup_map_hash_8b = { 3 },
|
||||
.errstr = "invalid read from stack off -16+0 size 8",
|
||||
.result = REJECT,
|
||||
.prog_type = BPF_PROG_TYPE_TRACEPOINT,
|
||||
},
|
||||
{
|
||||
"allocated_stack",
|
||||
.insns = {
|
||||
BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_1),
|
||||
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_get_prandom_u32),
|
||||
BPF_ALU64_REG(BPF_MOV, BPF_REG_7, BPF_REG_0),
|
||||
BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
|
||||
BPF_MOV64_IMM(BPF_REG_0, 0),
|
||||
BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_6, -8),
|
||||
BPF_LDX_MEM(BPF_DW, BPF_REG_6, BPF_REG_10, -8),
|
||||
BPF_STX_MEM(BPF_B, BPF_REG_10, BPF_REG_7, -9),
|
||||
BPF_LDX_MEM(BPF_B, BPF_REG_7, BPF_REG_10, -9),
|
||||
BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 0),
|
||||
BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 0),
|
||||
BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 0),
|
||||
BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 0),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.result = ACCEPT,
|
||||
.result_unpriv = ACCEPT,
|
||||
.insn_processed = 15,
|
||||
},
|
||||
|
||||
97
tools/testing/selftests/bpf/verifier/xadd.c
Normal file
97
tools/testing/selftests/bpf/verifier/xadd.c
Normal file
@ -0,0 +1,97 @@
|
||||
{
|
||||
"xadd/w check unaligned stack",
|
||||
.insns = {
|
||||
BPF_MOV64_IMM(BPF_REG_0, 1),
|
||||
BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
|
||||
BPF_STX_XADD(BPF_W, BPF_REG_10, BPF_REG_0, -7),
|
||||
BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -8),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.result = REJECT,
|
||||
.errstr = "misaligned stack access off",
|
||||
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
||||
},
|
||||
{
|
||||
"xadd/w check unaligned map",
|
||||
.insns = {
|
||||
BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
|
||||
BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
|
||||
BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
|
||||
BPF_LD_MAP_FD(BPF_REG_1, 0),
|
||||
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
|
||||
BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
|
||||
BPF_EXIT_INSN(),
|
||||
BPF_MOV64_IMM(BPF_REG_1, 1),
|
||||
BPF_STX_XADD(BPF_W, BPF_REG_0, BPF_REG_1, 3),
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_0, 3),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.fixup_map_hash_8b = { 3 },
|
||||
.result = REJECT,
|
||||
.errstr = "misaligned value access off",
|
||||
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
||||
},
|
||||
{
|
||||
"xadd/w check unaligned pkt",
|
||||
.insns = {
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
|
||||
offsetof(struct xdp_md, data_end)),
|
||||
BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
|
||||
BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
|
||||
BPF_JMP_REG(BPF_JLT, BPF_REG_1, BPF_REG_3, 2),
|
||||
BPF_MOV64_IMM(BPF_REG_0, 99),
|
||||
BPF_JMP_IMM(BPF_JA, 0, 0, 6),
|
||||
BPF_MOV64_IMM(BPF_REG_0, 1),
|
||||
BPF_ST_MEM(BPF_W, BPF_REG_2, 0, 0),
|
||||
BPF_ST_MEM(BPF_W, BPF_REG_2, 3, 0),
|
||||
BPF_STX_XADD(BPF_W, BPF_REG_2, BPF_REG_0, 1),
|
||||
BPF_STX_XADD(BPF_W, BPF_REG_2, BPF_REG_0, 2),
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_2, 1),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.result = REJECT,
|
||||
.errstr = "BPF_XADD stores into R2 pkt is not allowed",
|
||||
.prog_type = BPF_PROG_TYPE_XDP,
|
||||
.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
|
||||
},
|
||||
{
|
||||
"xadd/w check whether src/dst got mangled, 1",
|
||||
.insns = {
|
||||
BPF_MOV64_IMM(BPF_REG_0, 1),
|
||||
BPF_MOV64_REG(BPF_REG_6, BPF_REG_0),
|
||||
BPF_MOV64_REG(BPF_REG_7, BPF_REG_10),
|
||||
BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
|
||||
BPF_STX_XADD(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
|
||||
BPF_STX_XADD(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
|
||||
BPF_JMP_REG(BPF_JNE, BPF_REG_6, BPF_REG_0, 3),
|
||||
BPF_JMP_REG(BPF_JNE, BPF_REG_7, BPF_REG_10, 2),
|
||||
BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -8),
|
||||
BPF_EXIT_INSN(),
|
||||
BPF_MOV64_IMM(BPF_REG_0, 42),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.result = ACCEPT,
|
||||
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
||||
.retval = 3,
|
||||
},
|
||||
{
|
||||
"xadd/w check whether src/dst got mangled, 2",
|
||||
.insns = {
|
||||
BPF_MOV64_IMM(BPF_REG_0, 1),
|
||||
BPF_MOV64_REG(BPF_REG_6, BPF_REG_0),
|
||||
BPF_MOV64_REG(BPF_REG_7, BPF_REG_10),
|
||||
BPF_STX_MEM(BPF_W, BPF_REG_10, BPF_REG_0, -8),
|
||||
BPF_STX_XADD(BPF_W, BPF_REG_10, BPF_REG_0, -8),
|
||||
BPF_STX_XADD(BPF_W, BPF_REG_10, BPF_REG_0, -8),
|
||||
BPF_JMP_REG(BPF_JNE, BPF_REG_6, BPF_REG_0, 3),
|
||||
BPF_JMP_REG(BPF_JNE, BPF_REG_7, BPF_REG_10, 2),
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_10, -8),
|
||||
BPF_EXIT_INSN(),
|
||||
BPF_MOV64_IMM(BPF_REG_0, 42),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.result = ACCEPT,
|
||||
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
||||
.retval = 3,
|
||||
},
|
||||
14
tools/testing/selftests/bpf/verifier/xdp.c
Normal file
14
tools/testing/selftests/bpf/verifier/xdp.c
Normal file
@ -0,0 +1,14 @@
|
||||
{
|
||||
"XDP, using ifindex from netdev",
|
||||
.insns = {
|
||||
BPF_MOV64_IMM(BPF_REG_0, 0),
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
|
||||
offsetof(struct xdp_md, ingress_ifindex)),
|
||||
BPF_JMP_IMM(BPF_JLT, BPF_REG_2, 1, 1),
|
||||
BPF_MOV64_IMM(BPF_REG_0, 1),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.result = ACCEPT,
|
||||
.prog_type = BPF_PROG_TYPE_XDP,
|
||||
.retval = 1,
|
||||
},
|
||||
900
tools/testing/selftests/bpf/verifier/xdp_direct_packet_access.c
Normal file
900
tools/testing/selftests/bpf/verifier/xdp_direct_packet_access.c
Normal file
@ -0,0 +1,900 @@
|
||||
{
|
||||
"XDP pkt read, pkt_end mangling, bad access 1",
|
||||
.insns = {
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
|
||||
offsetof(struct xdp_md, data_end)),
|
||||
BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
|
||||
BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
|
||||
BPF_ALU64_IMM(BPF_ADD, BPF_REG_3, 8),
|
||||
BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1),
|
||||
BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
|
||||
BPF_MOV64_IMM(BPF_REG_0, 0),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.errstr = "R3 pointer arithmetic on pkt_end",
|
||||
.result = REJECT,
|
||||
.prog_type = BPF_PROG_TYPE_XDP,
|
||||
},
|
||||
{
|
||||
"XDP pkt read, pkt_end mangling, bad access 2",
|
||||
.insns = {
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
|
||||
offsetof(struct xdp_md, data_end)),
|
||||
BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
|
||||
BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
|
||||
BPF_ALU64_IMM(BPF_SUB, BPF_REG_3, 8),
|
||||
BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1),
|
||||
BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
|
||||
BPF_MOV64_IMM(BPF_REG_0, 0),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.errstr = "R3 pointer arithmetic on pkt_end",
|
||||
.result = REJECT,
|
||||
.prog_type = BPF_PROG_TYPE_XDP,
|
||||
},
|
||||
{
|
||||
"XDP pkt read, pkt_data' > pkt_end, good access",
|
||||
.insns = {
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
|
||||
offsetof(struct xdp_md, data_end)),
|
||||
BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
|
||||
BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
|
||||
BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1),
|
||||
BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
|
||||
BPF_MOV64_IMM(BPF_REG_0, 0),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.result = ACCEPT,
|
||||
.prog_type = BPF_PROG_TYPE_XDP,
|
||||
.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
|
||||
},
|
||||
{
|
||||
"XDP pkt read, pkt_data' > pkt_end, bad access 1",
|
||||
.insns = {
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
|
||||
offsetof(struct xdp_md, data_end)),
|
||||
BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
|
||||
BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
|
||||
BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1),
|
||||
BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -4),
|
||||
BPF_MOV64_IMM(BPF_REG_0, 0),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.errstr = "R1 offset is outside of the packet",
|
||||
.result = REJECT,
|
||||
.prog_type = BPF_PROG_TYPE_XDP,
|
||||
.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
|
||||
},
|
||||
{
|
||||
"XDP pkt read, pkt_data' > pkt_end, bad access 2",
|
||||
.insns = {
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
|
||||
offsetof(struct xdp_md, data_end)),
|
||||
BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
|
||||
BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
|
||||
BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 0),
|
||||
BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
|
||||
BPF_MOV64_IMM(BPF_REG_0, 0),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.errstr = "R1 offset is outside of the packet",
|
||||
.result = REJECT,
|
||||
.prog_type = BPF_PROG_TYPE_XDP,
|
||||
.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
|
||||
},
|
||||
{
|
||||
"XDP pkt read, pkt_end > pkt_data', good access",
|
||||
.insns = {
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
|
||||
offsetof(struct xdp_md, data_end)),
|
||||
BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
|
||||
BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
|
||||
BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_1, 1),
|
||||
BPF_JMP_IMM(BPF_JA, 0, 0, 1),
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
|
||||
BPF_MOV64_IMM(BPF_REG_0, 0),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.result = ACCEPT,
|
||||
.prog_type = BPF_PROG_TYPE_XDP,
|
||||
.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
|
||||
},
|
||||
{
|
||||
"XDP pkt read, pkt_end > pkt_data', bad access 1",
|
||||
.insns = {
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
|
||||
offsetof(struct xdp_md, data_end)),
|
||||
BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
|
||||
BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
|
||||
BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_1, 1),
|
||||
BPF_JMP_IMM(BPF_JA, 0, 0, 1),
|
||||
BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
|
||||
BPF_MOV64_IMM(BPF_REG_0, 0),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.errstr = "R1 offset is outside of the packet",
|
||||
.result = REJECT,
|
||||
.prog_type = BPF_PROG_TYPE_XDP,
|
||||
.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
|
||||
},
|
||||
{
|
||||
"XDP pkt read, pkt_end > pkt_data', bad access 2",
|
||||
.insns = {
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
|
||||
offsetof(struct xdp_md, data_end)),
|
||||
BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
|
||||
BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
|
||||
BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_1, 1),
|
||||
BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
|
||||
BPF_MOV64_IMM(BPF_REG_0, 0),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.errstr = "R1 offset is outside of the packet",
|
||||
.result = REJECT,
|
||||
.prog_type = BPF_PROG_TYPE_XDP,
|
||||
.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
|
||||
},
|
||||
{
|
||||
"XDP pkt read, pkt_data' < pkt_end, good access",
|
||||
.insns = {
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
|
||||
offsetof(struct xdp_md, data_end)),
|
||||
BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
|
||||
BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
|
||||
BPF_JMP_REG(BPF_JLT, BPF_REG_1, BPF_REG_3, 1),
|
||||
BPF_JMP_IMM(BPF_JA, 0, 0, 1),
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
|
||||
BPF_MOV64_IMM(BPF_REG_0, 0),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.result = ACCEPT,
|
||||
.prog_type = BPF_PROG_TYPE_XDP,
|
||||
.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
|
||||
},
|
||||
{
|
||||
"XDP pkt read, pkt_data' < pkt_end, bad access 1",
|
||||
.insns = {
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
|
||||
offsetof(struct xdp_md, data_end)),
|
||||
BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
|
||||
BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
|
||||
BPF_JMP_REG(BPF_JLT, BPF_REG_1, BPF_REG_3, 1),
|
||||
BPF_JMP_IMM(BPF_JA, 0, 0, 1),
|
||||
BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
|
||||
BPF_MOV64_IMM(BPF_REG_0, 0),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.errstr = "R1 offset is outside of the packet",
|
||||
.result = REJECT,
|
||||
.prog_type = BPF_PROG_TYPE_XDP,
|
||||
.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
|
||||
},
|
||||
{
|
||||
"XDP pkt read, pkt_data' < pkt_end, bad access 2",
|
||||
.insns = {
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
|
||||
offsetof(struct xdp_md, data_end)),
|
||||
BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
|
||||
BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
|
||||
BPF_JMP_REG(BPF_JLT, BPF_REG_1, BPF_REG_3, 1),
|
||||
BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
|
||||
BPF_MOV64_IMM(BPF_REG_0, 0),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.errstr = "R1 offset is outside of the packet",
|
||||
.result = REJECT,
|
||||
.prog_type = BPF_PROG_TYPE_XDP,
|
||||
.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
|
||||
},
|
||||
{
|
||||
"XDP pkt read, pkt_end < pkt_data', good access",
|
||||
.insns = {
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
|
||||
offsetof(struct xdp_md, data_end)),
|
||||
BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
|
||||
BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
|
||||
BPF_JMP_REG(BPF_JLT, BPF_REG_3, BPF_REG_1, 1),
|
||||
BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
|
||||
BPF_MOV64_IMM(BPF_REG_0, 0),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.result = ACCEPT,
|
||||
.prog_type = BPF_PROG_TYPE_XDP,
|
||||
.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
|
||||
},
|
||||
{
|
||||
"XDP pkt read, pkt_end < pkt_data', bad access 1",
|
||||
.insns = {
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
|
||||
offsetof(struct xdp_md, data_end)),
|
||||
BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
|
||||
BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
|
||||
BPF_JMP_REG(BPF_JLT, BPF_REG_3, BPF_REG_1, 1),
|
||||
BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -4),
|
||||
BPF_MOV64_IMM(BPF_REG_0, 0),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.errstr = "R1 offset is outside of the packet",
|
||||
.result = REJECT,
|
||||
.prog_type = BPF_PROG_TYPE_XDP,
|
||||
.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
|
||||
},
|
||||
{
|
||||
"XDP pkt read, pkt_end < pkt_data', bad access 2",
|
||||
.insns = {
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
|
||||
offsetof(struct xdp_md, data_end)),
|
||||
BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
|
||||
BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
|
||||
BPF_JMP_REG(BPF_JLT, BPF_REG_3, BPF_REG_1, 0),
|
||||
BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
|
||||
BPF_MOV64_IMM(BPF_REG_0, 0),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.errstr = "R1 offset is outside of the packet",
|
||||
.result = REJECT,
|
||||
.prog_type = BPF_PROG_TYPE_XDP,
|
||||
.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
|
||||
},
|
||||
{
|
||||
"XDP pkt read, pkt_data' >= pkt_end, good access",
|
||||
.insns = {
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
|
||||
offsetof(struct xdp_md, data_end)),
|
||||
BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
|
||||
BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
|
||||
BPF_JMP_REG(BPF_JGE, BPF_REG_1, BPF_REG_3, 1),
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
|
||||
BPF_MOV64_IMM(BPF_REG_0, 0),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.result = ACCEPT,
|
||||
.prog_type = BPF_PROG_TYPE_XDP,
|
||||
.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
|
||||
},
|
||||
{
|
||||
"XDP pkt read, pkt_data' >= pkt_end, bad access 1",
|
||||
.insns = {
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
|
||||
offsetof(struct xdp_md, data_end)),
|
||||
BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
|
||||
BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
|
||||
BPF_JMP_REG(BPF_JGE, BPF_REG_1, BPF_REG_3, 1),
|
||||
BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
|
||||
BPF_MOV64_IMM(BPF_REG_0, 0),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.errstr = "R1 offset is outside of the packet",
|
||||
.result = REJECT,
|
||||
.prog_type = BPF_PROG_TYPE_XDP,
|
||||
.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
|
||||
},
|
||||
{
|
||||
"XDP pkt read, pkt_data' >= pkt_end, bad access 2",
|
||||
.insns = {
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
|
||||
offsetof(struct xdp_md, data_end)),
|
||||
BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
|
||||
BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
|
||||
BPF_JMP_REG(BPF_JGE, BPF_REG_1, BPF_REG_3, 0),
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
|
||||
BPF_MOV64_IMM(BPF_REG_0, 0),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.errstr = "R1 offset is outside of the packet",
|
||||
.result = REJECT,
|
||||
.prog_type = BPF_PROG_TYPE_XDP,
|
||||
.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
|
||||
},
|
||||
{
|
||||
"XDP pkt read, pkt_end >= pkt_data', good access",
|
||||
.insns = {
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
|
||||
offsetof(struct xdp_md, data_end)),
|
||||
BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
|
||||
BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
|
||||
BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_1, 1),
|
||||
BPF_JMP_IMM(BPF_JA, 0, 0, 1),
|
||||
BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
|
||||
BPF_MOV64_IMM(BPF_REG_0, 0),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.result = ACCEPT,
|
||||
.prog_type = BPF_PROG_TYPE_XDP,
|
||||
.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
|
||||
},
|
||||
{
|
||||
"XDP pkt read, pkt_end >= pkt_data', bad access 1",
|
||||
.insns = {
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
|
||||
offsetof(struct xdp_md, data_end)),
|
||||
BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
|
||||
BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
|
||||
BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_1, 1),
|
||||
BPF_JMP_IMM(BPF_JA, 0, 0, 1),
|
||||
BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -4),
|
||||
BPF_MOV64_IMM(BPF_REG_0, 0),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.errstr = "R1 offset is outside of the packet",
|
||||
.result = REJECT,
|
||||
.prog_type = BPF_PROG_TYPE_XDP,
|
||||
.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
|
||||
},
|
||||
{
|
||||
"XDP pkt read, pkt_end >= pkt_data', bad access 2",
|
||||
.insns = {
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
|
||||
offsetof(struct xdp_md, data_end)),
|
||||
BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
|
||||
BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
|
||||
BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_1, 1),
|
||||
BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
|
||||
BPF_MOV64_IMM(BPF_REG_0, 0),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.errstr = "R1 offset is outside of the packet",
|
||||
.result = REJECT,
|
||||
.prog_type = BPF_PROG_TYPE_XDP,
|
||||
.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
|
||||
},
|
||||
{
|
||||
"XDP pkt read, pkt_data' <= pkt_end, good access",
|
||||
.insns = {
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
|
||||
offsetof(struct xdp_md, data_end)),
|
||||
BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
|
||||
BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
|
||||
BPF_JMP_REG(BPF_JLE, BPF_REG_1, BPF_REG_3, 1),
|
||||
BPF_JMP_IMM(BPF_JA, 0, 0, 1),
|
||||
BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
|
||||
BPF_MOV64_IMM(BPF_REG_0, 0),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.result = ACCEPT,
|
||||
.prog_type = BPF_PROG_TYPE_XDP,
|
||||
.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
|
||||
},
|
||||
{
|
||||
"XDP pkt read, pkt_data' <= pkt_end, bad access 1",
|
||||
.insns = {
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
|
||||
offsetof(struct xdp_md, data_end)),
|
||||
BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
|
||||
BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
|
||||
BPF_JMP_REG(BPF_JLE, BPF_REG_1, BPF_REG_3, 1),
|
||||
BPF_JMP_IMM(BPF_JA, 0, 0, 1),
|
||||
BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -4),
|
||||
BPF_MOV64_IMM(BPF_REG_0, 0),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.errstr = "R1 offset is outside of the packet",
|
||||
.result = REJECT,
|
||||
.prog_type = BPF_PROG_TYPE_XDP,
|
||||
.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
|
||||
},
|
||||
{
|
||||
"XDP pkt read, pkt_data' <= pkt_end, bad access 2",
|
||||
.insns = {
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
|
||||
offsetof(struct xdp_md, data_end)),
|
||||
BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
|
||||
BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
|
||||
BPF_JMP_REG(BPF_JLE, BPF_REG_1, BPF_REG_3, 1),
|
||||
BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
|
||||
BPF_MOV64_IMM(BPF_REG_0, 0),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.errstr = "R1 offset is outside of the packet",
|
||||
.result = REJECT,
|
||||
.prog_type = BPF_PROG_TYPE_XDP,
|
||||
.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
|
||||
},
|
||||
{
|
||||
"XDP pkt read, pkt_end <= pkt_data', good access",
|
||||
.insns = {
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
|
||||
offsetof(struct xdp_md, data_end)),
|
||||
BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
|
||||
BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
|
||||
BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_1, 1),
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
|
||||
BPF_MOV64_IMM(BPF_REG_0, 0),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.result = ACCEPT,
|
||||
.prog_type = BPF_PROG_TYPE_XDP,
|
||||
.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
|
||||
},
|
||||
{
|
||||
"XDP pkt read, pkt_end <= pkt_data', bad access 1",
|
||||
.insns = {
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
|
||||
offsetof(struct xdp_md, data_end)),
|
||||
BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
|
||||
BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
|
||||
BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_1, 1),
|
||||
BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
|
||||
BPF_MOV64_IMM(BPF_REG_0, 0),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.errstr = "R1 offset is outside of the packet",
|
||||
.result = REJECT,
|
||||
.prog_type = BPF_PROG_TYPE_XDP,
|
||||
.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
|
||||
},
|
||||
{
|
||||
"XDP pkt read, pkt_end <= pkt_data', bad access 2",
|
||||
.insns = {
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
|
||||
offsetof(struct xdp_md, data_end)),
|
||||
BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
|
||||
BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
|
||||
BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_1, 0),
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
|
||||
BPF_MOV64_IMM(BPF_REG_0, 0),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.errstr = "R1 offset is outside of the packet",
|
||||
.result = REJECT,
|
||||
.prog_type = BPF_PROG_TYPE_XDP,
|
||||
.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
|
||||
},
|
||||
{
|
||||
"XDP pkt read, pkt_meta' > pkt_data, good access",
|
||||
.insns = {
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
|
||||
offsetof(struct xdp_md, data_meta)),
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
|
||||
BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
|
||||
BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
|
||||
BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1),
|
||||
BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
|
||||
BPF_MOV64_IMM(BPF_REG_0, 0),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.result = ACCEPT,
|
||||
.prog_type = BPF_PROG_TYPE_XDP,
|
||||
.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
|
||||
},
|
||||
{
|
||||
"XDP pkt read, pkt_meta' > pkt_data, bad access 1",
|
||||
.insns = {
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
|
||||
offsetof(struct xdp_md, data_meta)),
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
|
||||
BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
|
||||
BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
|
||||
BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1),
|
||||
BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -4),
|
||||
BPF_MOV64_IMM(BPF_REG_0, 0),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.errstr = "R1 offset is outside of the packet",
|
||||
.result = REJECT,
|
||||
.prog_type = BPF_PROG_TYPE_XDP,
|
||||
.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
|
||||
},
|
||||
{
|
||||
"XDP pkt read, pkt_meta' > pkt_data, bad access 2",
|
||||
.insns = {
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
|
||||
offsetof(struct xdp_md, data_meta)),
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
|
||||
BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
|
||||
BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
|
||||
BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 0),
|
||||
BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
|
||||
BPF_MOV64_IMM(BPF_REG_0, 0),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.errstr = "R1 offset is outside of the packet",
|
||||
.result = REJECT,
|
||||
.prog_type = BPF_PROG_TYPE_XDP,
|
||||
.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
|
||||
},
|
||||
{
|
||||
"XDP pkt read, pkt_data > pkt_meta', good access",
|
||||
.insns = {
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
|
||||
offsetof(struct xdp_md, data_meta)),
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
|
||||
BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
|
||||
BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
|
||||
BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_1, 1),
|
||||
BPF_JMP_IMM(BPF_JA, 0, 0, 1),
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
|
||||
BPF_MOV64_IMM(BPF_REG_0, 0),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.result = ACCEPT,
|
||||
.prog_type = BPF_PROG_TYPE_XDP,
|
||||
.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
|
||||
},
|
||||
{
|
||||
"XDP pkt read, pkt_data > pkt_meta', bad access 1",
|
||||
.insns = {
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
|
||||
offsetof(struct xdp_md, data_meta)),
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
|
||||
BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
|
||||
BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
|
||||
BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_1, 1),
|
||||
BPF_JMP_IMM(BPF_JA, 0, 0, 1),
|
||||
BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
|
||||
BPF_MOV64_IMM(BPF_REG_0, 0),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.errstr = "R1 offset is outside of the packet",
|
||||
.result = REJECT,
|
||||
.prog_type = BPF_PROG_TYPE_XDP,
|
||||
.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
|
||||
},
|
||||
{
|
||||
"XDP pkt read, pkt_data > pkt_meta', bad access 2",
|
||||
.insns = {
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
|
||||
offsetof(struct xdp_md, data_meta)),
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
|
||||
BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
|
||||
BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
|
||||
BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_1, 1),
|
||||
BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
|
||||
BPF_MOV64_IMM(BPF_REG_0, 0),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.errstr = "R1 offset is outside of the packet",
|
||||
.result = REJECT,
|
||||
.prog_type = BPF_PROG_TYPE_XDP,
|
||||
.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
|
||||
},
|
||||
{
|
||||
"XDP pkt read, pkt_meta' < pkt_data, good access",
|
||||
.insns = {
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
|
||||
offsetof(struct xdp_md, data_meta)),
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
|
||||
BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
|
||||
BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
|
||||
BPF_JMP_REG(BPF_JLT, BPF_REG_1, BPF_REG_3, 1),
|
||||
BPF_JMP_IMM(BPF_JA, 0, 0, 1),
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
|
||||
BPF_MOV64_IMM(BPF_REG_0, 0),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.result = ACCEPT,
|
||||
.prog_type = BPF_PROG_TYPE_XDP,
|
||||
.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
|
||||
},
|
||||
{
|
||||
"XDP pkt read, pkt_meta' < pkt_data, bad access 1",
|
||||
.insns = {
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
|
||||
offsetof(struct xdp_md, data_meta)),
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
|
||||
BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
|
||||
BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
|
||||
BPF_JMP_REG(BPF_JLT, BPF_REG_1, BPF_REG_3, 1),
|
||||
BPF_JMP_IMM(BPF_JA, 0, 0, 1),
|
||||
BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
|
||||
BPF_MOV64_IMM(BPF_REG_0, 0),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.errstr = "R1 offset is outside of the packet",
|
||||
.result = REJECT,
|
||||
.prog_type = BPF_PROG_TYPE_XDP,
|
||||
.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
|
||||
},
|
||||
{
|
||||
"XDP pkt read, pkt_meta' < pkt_data, bad access 2",
|
||||
.insns = {
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
|
||||
offsetof(struct xdp_md, data_meta)),
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
|
||||
BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
|
||||
BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
|
||||
BPF_JMP_REG(BPF_JLT, BPF_REG_1, BPF_REG_3, 1),
|
||||
BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
|
||||
BPF_MOV64_IMM(BPF_REG_0, 0),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.errstr = "R1 offset is outside of the packet",
|
||||
.result = REJECT,
|
||||
.prog_type = BPF_PROG_TYPE_XDP,
|
||||
.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
|
||||
},
|
||||
{
|
||||
"XDP pkt read, pkt_data < pkt_meta', good access",
|
||||
.insns = {
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
|
||||
offsetof(struct xdp_md, data_meta)),
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
|
||||
BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
|
||||
BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
|
||||
BPF_JMP_REG(BPF_JLT, BPF_REG_3, BPF_REG_1, 1),
|
||||
BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
|
||||
BPF_MOV64_IMM(BPF_REG_0, 0),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.result = ACCEPT,
|
||||
.prog_type = BPF_PROG_TYPE_XDP,
|
||||
.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
|
||||
},
|
||||
{
|
||||
"XDP pkt read, pkt_data < pkt_meta', bad access 1",
|
||||
.insns = {
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
|
||||
offsetof(struct xdp_md, data_meta)),
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
|
||||
BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
|
||||
BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
|
||||
BPF_JMP_REG(BPF_JLT, BPF_REG_3, BPF_REG_1, 1),
|
||||
BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -4),
|
||||
BPF_MOV64_IMM(BPF_REG_0, 0),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.errstr = "R1 offset is outside of the packet",
|
||||
.result = REJECT,
|
||||
.prog_type = BPF_PROG_TYPE_XDP,
|
||||
.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
|
||||
},
|
||||
{
|
||||
"XDP pkt read, pkt_data < pkt_meta', bad access 2",
|
||||
.insns = {
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
|
||||
offsetof(struct xdp_md, data_meta)),
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
|
||||
BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
|
||||
BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
|
||||
BPF_JMP_REG(BPF_JLT, BPF_REG_3, BPF_REG_1, 0),
|
||||
BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
|
||||
BPF_MOV64_IMM(BPF_REG_0, 0),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.errstr = "R1 offset is outside of the packet",
|
||||
.result = REJECT,
|
||||
.prog_type = BPF_PROG_TYPE_XDP,
|
||||
.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
|
||||
},
|
||||
{
|
||||
"XDP pkt read, pkt_meta' >= pkt_data, good access",
|
||||
.insns = {
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
|
||||
offsetof(struct xdp_md, data_meta)),
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
|
||||
BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
|
||||
BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
|
||||
BPF_JMP_REG(BPF_JGE, BPF_REG_1, BPF_REG_3, 1),
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
|
||||
BPF_MOV64_IMM(BPF_REG_0, 0),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.result = ACCEPT,
|
||||
.prog_type = BPF_PROG_TYPE_XDP,
|
||||
.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
|
||||
},
|
||||
{
|
||||
"XDP pkt read, pkt_meta' >= pkt_data, bad access 1",
|
||||
.insns = {
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
|
||||
offsetof(struct xdp_md, data_meta)),
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
|
||||
BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
|
||||
BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
|
||||
BPF_JMP_REG(BPF_JGE, BPF_REG_1, BPF_REG_3, 1),
|
||||
BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
|
||||
BPF_MOV64_IMM(BPF_REG_0, 0),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.errstr = "R1 offset is outside of the packet",
|
||||
.result = REJECT,
|
||||
.prog_type = BPF_PROG_TYPE_XDP,
|
||||
.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
|
||||
},
|
||||
{
|
||||
"XDP pkt read, pkt_meta' >= pkt_data, bad access 2",
|
||||
.insns = {
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
|
||||
offsetof(struct xdp_md, data_meta)),
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
|
||||
BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
|
||||
BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
|
||||
BPF_JMP_REG(BPF_JGE, BPF_REG_1, BPF_REG_3, 0),
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
|
||||
BPF_MOV64_IMM(BPF_REG_0, 0),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.errstr = "R1 offset is outside of the packet",
|
||||
.result = REJECT,
|
||||
.prog_type = BPF_PROG_TYPE_XDP,
|
||||
.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
|
||||
},
|
||||
{
|
||||
"XDP pkt read, pkt_data >= pkt_meta', good access",
|
||||
.insns = {
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
|
||||
offsetof(struct xdp_md, data_meta)),
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
|
||||
BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
|
||||
BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
|
||||
BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_1, 1),
|
||||
BPF_JMP_IMM(BPF_JA, 0, 0, 1),
|
||||
BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
|
||||
BPF_MOV64_IMM(BPF_REG_0, 0),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.result = ACCEPT,
|
||||
.prog_type = BPF_PROG_TYPE_XDP,
|
||||
.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
|
||||
},
|
||||
{
|
||||
"XDP pkt read, pkt_data >= pkt_meta', bad access 1",
|
||||
.insns = {
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
|
||||
offsetof(struct xdp_md, data_meta)),
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
|
||||
BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
|
||||
BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
|
||||
BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_1, 1),
|
||||
BPF_JMP_IMM(BPF_JA, 0, 0, 1),
|
||||
BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -4),
|
||||
BPF_MOV64_IMM(BPF_REG_0, 0),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.errstr = "R1 offset is outside of the packet",
|
||||
.result = REJECT,
|
||||
.prog_type = BPF_PROG_TYPE_XDP,
|
||||
.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
|
||||
},
|
||||
{
|
||||
"XDP pkt read, pkt_data >= pkt_meta', bad access 2",
|
||||
.insns = {
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
|
||||
offsetof(struct xdp_md, data_meta)),
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
|
||||
BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
|
||||
BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
|
||||
BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_1, 1),
|
||||
BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
|
||||
BPF_MOV64_IMM(BPF_REG_0, 0),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.errstr = "R1 offset is outside of the packet",
|
||||
.result = REJECT,
|
||||
.prog_type = BPF_PROG_TYPE_XDP,
|
||||
.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
|
||||
},
|
||||
{
|
||||
"XDP pkt read, pkt_meta' <= pkt_data, good access",
|
||||
.insns = {
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
|
||||
offsetof(struct xdp_md, data_meta)),
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
|
||||
BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
|
||||
BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
|
||||
BPF_JMP_REG(BPF_JLE, BPF_REG_1, BPF_REG_3, 1),
|
||||
BPF_JMP_IMM(BPF_JA, 0, 0, 1),
|
||||
BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
|
||||
BPF_MOV64_IMM(BPF_REG_0, 0),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.result = ACCEPT,
|
||||
.prog_type = BPF_PROG_TYPE_XDP,
|
||||
.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
|
||||
},
|
||||
{
|
||||
"XDP pkt read, pkt_meta' <= pkt_data, bad access 1",
|
||||
.insns = {
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
|
||||
offsetof(struct xdp_md, data_meta)),
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
|
||||
BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
|
||||
BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
|
||||
BPF_JMP_REG(BPF_JLE, BPF_REG_1, BPF_REG_3, 1),
|
||||
BPF_JMP_IMM(BPF_JA, 0, 0, 1),
|
||||
BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -4),
|
||||
BPF_MOV64_IMM(BPF_REG_0, 0),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.errstr = "R1 offset is outside of the packet",
|
||||
.result = REJECT,
|
||||
.prog_type = BPF_PROG_TYPE_XDP,
|
||||
.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
|
||||
},
|
||||
{
|
||||
"XDP pkt read, pkt_meta' <= pkt_data, bad access 2",
|
||||
.insns = {
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
|
||||
offsetof(struct xdp_md, data_meta)),
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
|
||||
BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
|
||||
BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
|
||||
BPF_JMP_REG(BPF_JLE, BPF_REG_1, BPF_REG_3, 1),
|
||||
BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
|
||||
BPF_MOV64_IMM(BPF_REG_0, 0),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.errstr = "R1 offset is outside of the packet",
|
||||
.result = REJECT,
|
||||
.prog_type = BPF_PROG_TYPE_XDP,
|
||||
.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
|
||||
},
|
||||
{
|
||||
"XDP pkt read, pkt_data <= pkt_meta', good access",
|
||||
.insns = {
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
|
||||
offsetof(struct xdp_md, data_meta)),
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
|
||||
BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
|
||||
BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
|
||||
BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_1, 1),
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
|
||||
BPF_MOV64_IMM(BPF_REG_0, 0),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.result = ACCEPT,
|
||||
.prog_type = BPF_PROG_TYPE_XDP,
|
||||
.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
|
||||
},
|
||||
{
|
||||
"XDP pkt read, pkt_data <= pkt_meta', bad access 1",
|
||||
.insns = {
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
|
||||
offsetof(struct xdp_md, data_meta)),
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
|
||||
BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
|
||||
BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
|
||||
BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_1, 1),
|
||||
BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
|
||||
BPF_MOV64_IMM(BPF_REG_0, 0),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.errstr = "R1 offset is outside of the packet",
|
||||
.result = REJECT,
|
||||
.prog_type = BPF_PROG_TYPE_XDP,
|
||||
.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
|
||||
},
|
||||
{
|
||||
"XDP pkt read, pkt_data <= pkt_meta', bad access 2",
|
||||
.insns = {
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
|
||||
offsetof(struct xdp_md, data_meta)),
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
|
||||
BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
|
||||
BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
|
||||
BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_1, 0),
|
||||
BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
|
||||
BPF_MOV64_IMM(BPF_REG_0, 0),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.errstr = "R1 offset is outside of the packet",
|
||||
.result = REJECT,
|
||||
.prog_type = BPF_PROG_TYPE_XDP,
|
||||
.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
|
||||
},
|
||||
Loading…
Reference in New Issue
Block a user