Open Menu / tools / testing / selftests / bpf / verifier / bounds_deduction.c
Loading...
  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
{
	"check deducing bounds from const, 1",
	.insns = {
		BPF_MOV64_IMM(BPF_REG_0, 1),
		BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 1, 0),
		BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
		BPF_EXIT_INSN(),
	},
	.result = REJECT,
	.errstr = "R0 tried to subtract pointer from scalar",
},
{
	"check deducing bounds from const, 2",
	.insns = {
		BPF_MOV64_IMM(BPF_REG_0, 1),
		BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 1, 1),
		BPF_EXIT_INSN(),
		BPF_JMP_IMM(BPF_JSLE, BPF_REG_0, 1, 1),
		BPF_EXIT_INSN(),
		BPF_ALU64_REG(BPF_SUB, BPF_REG_1, BPF_REG_0),
		BPF_EXIT_INSN(),
	},
	.result = ACCEPT,
	.retval = 1,
},
{
	"check deducing bounds from const, 3",
	.insns = {
		BPF_MOV64_IMM(BPF_REG_0, 0),
		BPF_JMP_IMM(BPF_JSLE, BPF_REG_0, 0, 0),
		BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
		BPF_EXIT_INSN(),
	},
	.result = REJECT,
	.errstr = "R0 tried to subtract pointer from scalar",
},
{
	"check deducing bounds from const, 4",
	.insns = {
		BPF_MOV64_IMM(BPF_REG_0, 0),
		BPF_JMP_IMM(BPF_JSLE, BPF_REG_0, 0, 1),
		BPF_EXIT_INSN(),
		BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 0, 1),
		BPF_EXIT_INSN(),
		BPF_ALU64_REG(BPF_SUB, BPF_REG_1, BPF_REG_0),
		BPF_EXIT_INSN(),
	},
	.result = ACCEPT,
},
{
	"check deducing bounds from const, 5",
	.insns = {
		BPF_MOV64_IMM(BPF_REG_0, 0),
		BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 1, 1),
		BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
		BPF_EXIT_INSN(),
	},
	.result = REJECT,
	.errstr = "R0 tried to subtract pointer from scalar",
},
{
	"check deducing bounds from const, 6",
	.insns = {
		BPF_MOV64_IMM(BPF_REG_0, 0),
		BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 0, 1),
		BPF_EXIT_INSN(),
		BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
		BPF_EXIT_INSN(),
	},
	.result = REJECT,
	.errstr = "R0 tried to subtract pointer from scalar",
},
{
	"check deducing bounds from const, 7",
	.insns = {
		BPF_MOV64_IMM(BPF_REG_0, ~0),
		BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 0, 0),
		BPF_ALU64_REG(BPF_SUB, BPF_REG_1, BPF_REG_0),
		BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
			    offsetof(struct __sk_buff, mark)),
		BPF_EXIT_INSN(),
	},
	.result = REJECT,
	.errstr = "dereference of modified ctx ptr",
	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
},
{
	"check deducing bounds from const, 8",
	.insns = {
		BPF_MOV64_IMM(BPF_REG_0, ~0),
		BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 0, 1),
		BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_0),
		BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
			    offsetof(struct __sk_buff, mark)),
		BPF_EXIT_INSN(),
	},
	.result = REJECT,
	.errstr = "dereference of modified ctx ptr",
	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
},
{
	"check deducing bounds from const, 9",
	.insns = {
		BPF_MOV64_IMM(BPF_REG_0, 0),
		BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 0, 0),
		BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
		BPF_EXIT_INSN(),
	},
	.result = REJECT,
	.errstr = "R0 tried to subtract pointer from scalar",
},
{
	"check deducing bounds from const, 10",
	.insns = {
		BPF_MOV64_IMM(BPF_REG_0, 0),
		BPF_JMP_IMM(BPF_JSLE, BPF_REG_0, 0, 0),
		/* Marks reg as unknown. */
		BPF_ALU64_IMM(BPF_NEG, BPF_REG_0, 0),
		BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
		BPF_EXIT_INSN(),
	},
	.result = REJECT,
	.errstr = "math between ctx pointer and register with unbounded min value is not allowed",
},